{ "Event": { "published": true, "date": "2022-05-16", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-05-16", "timestamp": 1652745781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "617dec60-b2ae-40e5-962d-a1a7d07a2f96", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f3c0a8-d52f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652716171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716171, "uuid": "02b2b24e-3449-4191-97b1-c6d44e65ca07", "comment": "Malware payload (Heodo)", "value": "ecd0f69ac76a5d04d7eb950db66e65d1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716171, "uuid": "5fa36484-916c-47f6-8317-d90cf2b44c01", "comment": "Malware payload (Heodo)", "value": "0012af1d205a1a4a0d7349ffccc7b47ffe934ced1382c6f4df90065a237caee4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716171, "uuid": "ae4071d3-e119-4c70-bcbc-0e943459f669", "comment": "Malware payload (Heodo)", "value": "198edc31df97393098e81eb7f107972d52b19ac2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716171, "uuid": "4d397689-e16d-4fbb-97b4-4aa53bb4ecb9", "comment": "Malware payload (Heodo)", "value": "c635ae764ba45540a67fb44cbf7bc4969d9e4b9a77ae23f8968115591b2fa06a80f43473b24dc6f2a513bed299fa8ace", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716171, "uuid": "f9429439-e9a8-4af2-9fe3-f372d44e72e2", "value": "T13551AD283EDA2218F5F3DF71B9E875D6DEAABAB269015C5F0085030B4811E00ED9693F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716171, "uuid": "adb908da-7a86-42e1-85d4-528787874bb3", "value": "48:8mRzTc0V7Y7B8KTSukPNx4sedNk96BLdKzvnAjk2dt6B/vuoWN04ab:8mFpcd8MuNxp96/Kzvv2Hy/N34", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652716171, "uuid": "a40ce643-ea52-406f-bb96-bb689d22eb75", "value": 2632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652716171, "uuid": "8c3b0aa2-1808-4e22-9d72-fcd689470f49", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716171, "uuid": "62dd0cf3-1e2a-4560-aec3-b3cf7691b5ab", "value": "Data-926971.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c15158d-d4dd-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652680827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680827, "uuid": "b830cf33-10fe-4545-a91b-7e41e99fdc8e", "comment": "Malware payload (AgentTesla)", "value": "0b0366974c85cb23d7584579ec8373bc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680827, "uuid": "05d8ea30-c0ef-45c5-90ff-c17c476f1001", "comment": "Malware payload (AgentTesla)", "value": "008982c6201f38f41eddede68c66e959db4720529c4a18481b61cfaf2b39c977", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680827, "uuid": "e82f3e14-22ac-4c42-84b2-6e2b303ea9ab", "comment": "Malware payload (AgentTesla)", "value": "1f39fe808853ccde56fb9606a58dec5dd3361d98", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680827, "uuid": "b279eb9c-cfe4-44f6-865e-f4c4e1bb118d", "comment": "Malware payload (AgentTesla)", "value": "115f7f54e11434d922c8111463814da019d300dee4852b9315d454758fa23fcfdd4be8abcff2198ba0b21b33ab2098d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680827, "uuid": "21900e78-85c7-4334-afed-a27b8ce9c402", "value": "T1E894230775F54DDDE2369746263E43A91038BFA7ACE4B0330F681AE605E74A845633BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680827, "uuid": "75b2b7d6-a84c-478d-be0c-17fb9ec86f0b", "value": "12288:uO8kVz3f6M4PbyDRXjFTvsiBU5IpCyml/bb:uOfNkudzFsinwyml/bb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652680827, "uuid": "324a7d43-edd7-4017-8fc2-14568dcff153", "value": 446600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652680827, "uuid": "726a682b-be75-45a3-b549-ec6a81d6c3fb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680827, "uuid": "b479a0a6-6295-418e-84a2-a6ad4ce76c7b", "value": "PO.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ce6d92-d4e3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1652683253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652683253, "uuid": "13d1aa32-3f12-4f78-b188-7cc382af358e", "comment": "Malware payload (Smoke Loader)", "value": "eae211a03a2c881028a177fabaffe830", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652683253, "uuid": "bcf02c0e-1f7c-4419-9056-065503514a45", "comment": "Malware payload (Smoke Loader)", "value": "0098901d9b40d0d1e34f820347bd7af6d39da582115aab1918a5a71dd03bf7b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652683253, "uuid": "955f7714-aa81-4f0c-b825-547729ea912b", "comment": "Malware payload (Smoke Loader)", "value": "94bf1645d4f4bc810abcab96c29dda21b2812033", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652683253, "uuid": "c1995581-5d08-4da0-a5df-48c81a294a8f", "comment": "Malware payload (Smoke Loader)", "value": "f571b83242c7cb6590d26c2f4439d564b98de5762289c7160a98b35fb268cb49bfb4b1ccc55506a62b61f8d9f7ddf43b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652683253, "uuid": "75eb9435-108a-4d6c-a9fe-98589a5c75db", "value": "T154049D02B5D2D871C6A649709830DBE41E7FF8715AF0458B73982BAF2FB32D07A25752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652683253, "uuid": "50f5f301-1d72-4876-98ae-36f866053b93", "value": "fdb1d18fcb1774aedc78ecdbb5413a24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652683253, "uuid": "14ee1e8a-1dbf-4ff3-a673-34bc5548aa47", "value": "3072:oKV4NBV8cf5rFIxR73piKXax0+uchsGh2am10/:oKqfrKF3VnPa211", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652683253, "uuid": "38a3cbe4-2fca-4935-95f9-3255794c2ef6", "value": 176640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652683253, "uuid": "3d161115-77f9-42de-adbe-55103386f9a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652683253, "uuid": "82b5239e-1cde-4fed-8a92-a0d59d91b447", "value": "0098901d9b40d0d1e34f820347bd7af6d39da582115aab1918a5a71dd03bf7b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a3aa91-d512-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1652703732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703732, "uuid": "74b7383e-64ed-4d38-a449-cb3a5ba722a2", "comment": "Malware payload (AveMariaRAT)", "value": "1f077e3f73b3b6c5fb147dc1cfbbf4e1", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703732, "uuid": "58f40c34-c12b-45fd-9a0c-dc32bf246609", "comment": "Malware payload (AveMariaRAT)", "value": "00b73d71fcd02120d14b43d28e847959b61059e497465971bf90d5e5e5993c07", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703732, "uuid": "1f84fbac-6a6d-4c73-8e2e-45c13c78057a", "comment": "Malware payload (AveMariaRAT)", "value": "6cfc50484be5a6809b4e319d5da90c01141a5114", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703732, "uuid": "d7246559-36b2-4471-b2a2-f72892d1967c", "comment": "Malware payload (AveMariaRAT)", "value": "051bb5446cb4b1988b18c2da52a375b74afe367ffcaa8ba0efefbe424a59b8e7bd5fae34ce8f5f303eaf6a1e288a1c36", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703732, "uuid": "ea415ae4-2b07-4293-90e9-2b2c4a355bfe", "value": "T1AE336A9977F4BE13CA075B3930DE65461B30DA81FA06E797A217C2150F42BC22EE9297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703732, "uuid": "3d823170-11ec-4090-9ce7-b5f8d03e7669", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703732, "uuid": "aac6f37d-f588-458f-952c-b6b5426cfb4d", "value": "768:jvd6BSato0uEyoWtMoClrJ81AAFeSPlltjOLp83IfKe9eDGveE2DGyDeEt:jIUato0uEEyokrOP/C83IfKmdCD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703732, "uuid": "57eecc5c-a24a-4a70-a2de-25aa22889a1c", "value": 54336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703732, "uuid": "7a3ffc60-5fa4-4053-b848-1b2856facce4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703732, "uuid": "94ddf9b1-3ce0-4791-8b3e-15826f3aeb32", "value": "TNT_AWB_TRACKING_DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2156b8cf-d4b2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652662207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662207, "uuid": "86755718-8467-4953-863e-5547e69515a4", "comment": "Malware payload (Mirai)", "value": "c144d9457fd8ad4597b152803d153914", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662207, "uuid": "4ff263b2-9f09-4b4b-b770-879dc2e34802", "comment": "Malware payload (Mirai)", "value": "00d97f09543fd595729f93ee1bb0d4e44274f8df3478d4cab97c14442a69fb2f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662207, "uuid": "14b79860-ef8f-434b-9e20-fc8b1e64be75", "comment": "Malware payload (Mirai)", "value": "4f15a0b82f68740b80d3e4b44796818c98f9a838", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662207, "uuid": "7c0aee83-3fed-405a-8806-c9148fd3b0e1", "comment": "Malware payload (Mirai)", "value": "fdcf1f03208e4dbd7215c75b8d3586be56a951c138f82be429b6f26b69ab9fe4d0cb99d00bf73c968ac1842b58578bf7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652662207, "uuid": "a606e107-c0e5-4ab7-9925-2b20a74b00f1", "value": "T1B9539449F9B5539BDBD4B2FBFA0811CEB62D479872EE3127DD31058033C4E6A716A068", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652662207, "uuid": "dfc32e25-54c6-45d2-8b93-d33819526e5e", "value": "1536:hyPFymeSyNOFPGlrfXYkMQRNlIW6UvU3:SwNhkorfqW6yU3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652662207, "uuid": "7258afdb-2e8c-42b5-870e-2b49d9a662b8", "value": 60988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652662207, "uuid": "f9303271-5ad6-4886-81e7-66f984931a42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652662207, "uuid": "ea4bbff8-f979-4576-9b03-44d5f24c0175", "value": "boat.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84ffa30f-d4dc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652680413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680413, "uuid": "b3a5d115-31c2-4d85-83a8-59f2f51798ca", "comment": "Malware payload", "value": "009e7304fe746215973551f454c4a72a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680413, "uuid": "4d0e1541-a6ea-49c9-a3ce-ed76547f1fd4", "comment": "Malware payload", "value": "0135d5722ae7a3d29a7785e2b823fd9bfc3cb8118d617dd4af404fac2c1abfcd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680413, "uuid": "6e3a6f9f-7141-423c-adb8-794dd3e7355d", "comment": "Malware payload", "value": "8b4ce866bce8f35180cf4d5f81c19810acd769bc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680413, "uuid": "31e72b9f-59bd-4d43-9d98-98cc76bf64a0", "comment": "Malware payload", "value": "243378dc0b1b97c62adf29a98ddbc0d293c887a764cf59a755c6ac4291e2fcf7cd1e058b607234065e22bd7b9d80aa4d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680413, "uuid": "0367658a-ab5d-4891-8bbf-beda4b96eb2f", "value": "T1A444225DE74F49A9CF40A373421B8E8405F8BB7EF34161A4759C83B43BAC92D44A95BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680413, "uuid": "7a615749-e097-47a0-bd04-e8ea8c4c23ca", "value": "768:CqB7XQccTPqdm7QaxNXAzeGcK2MO9tS2b:CwA/idm7QaxNXACGcH3/Si", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652680413, "uuid": "9290e75a-772d-4961-8b12-3568e3a57479", "value": 272974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652680413, "uuid": "f39cad5f-083f-414c-8a5f-4f4e8c33d2fe", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680413, "uuid": "92e7684f-03c0-4ccb-aa48-b9f2d32d92b4", "value": "11.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7eab6bf-d4f2-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1652690001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690001, "uuid": "4c36a901-50f6-45a9-a52c-f0e8c8e128df", "comment": "Malware payload (AveMariaRAT)", "value": "974a1cf371fc1324fb7f4b3f3a6d8b36", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690001, "uuid": "2ad3d7df-72be-44f1-8b7d-ecac1d82acdb", "comment": "Malware payload (AveMariaRAT)", "value": "0160c43aff1ae48b814dd1b0304daf91a5376cf90d262f3092e3568d4b9b5021", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690001, "uuid": "221c984b-0001-4e71-ad1c-6302d0c46ba2", "comment": "Malware payload (AveMariaRAT)", "value": "80a259739668145768fba010a0f25fe38dec8af8", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690001, "uuid": "2ff05228-79f5-4179-8501-acc00aa40c9e", "comment": "Malware payload (AveMariaRAT)", "value": "33d6c6267c7adcec768c4f4bcd4869d5408e16d977644f34652500941cc03e254c8259ff41cc85e05600442ce9021c3f", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690001, "uuid": "d59f79f7-8605-47a2-baaa-441c24714b63", "value": "T19AA47F7CBA451A72FC0E90704F01CE08BB660F83225CA99657DBE5CAC75F2672D25CB8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690001, "uuid": "54ebdd21-7f9c-4a83-959c-146799be44f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690001, "uuid": "48573d78-91d7-473f-a994-30058d4e92fa", "value": "6144:kWHsNVKSVDxwBtncj9586GqXsH6KyrttKV5LMbBYcF/T32J93Bj:kksNYS/wjn+zlSHqCbkXF/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652690001, "uuid": "d9f4c51d-68b9-46fd-b1ac-1b885200b8d8", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652690001, "uuid": "6417b9be-f945-4a40-a79a-1398279b77a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690001, "uuid": "76a99df1-808d-4f60-b368-3ddb62a26bd6", "value": "Yeni sipari\u015f _WJO-001, pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84ee535f-d4f0-11ec-8e58-42010a9c0032", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1652689002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689002, "uuid": "fa87adf6-2192-4a07-b7d7-d32e50905152", "comment": "Malware payload (ArkeiStealer)", "value": "5c6523b1d00c016ff09f4b3d23343103", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689002, "uuid": "79b7198d-bcfc-4c19-96cb-2e5365e711f6", "comment": "Malware payload (ArkeiStealer)", "value": "0163734f39ee011ebc32cd0c68b928288ba99d40fb705630ab0b1a257af1b8ed", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689002, "uuid": "a583d815-ad5b-4d6a-b311-549599b4b3f6", "comment": "Malware payload (ArkeiStealer)", "value": "33a49c339884808d4e4fd37ec0645d18120d0b0b", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689002, "uuid": "1f015580-14c7-40f5-a45d-ddf8eb3b22a6", "comment": "Malware payload (ArkeiStealer)", "value": "802423579392eb22ae5a353a08e008cff84799702884f57554c0630312c8b2a9fd0dbfe73ac1af9a819cf13997068cb3", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689002, "uuid": "f8969c49-111e-419e-aef3-52fdcafd7c64", "value": "T1645533F4A63DB016ECDE1DB2F997E58F110EEE5B68A0E1F74189BE23A93047A461440D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689002, "uuid": "58d68153-cbdd-44b4-a628-908a84bb8bf6", "value": "78e32b8ef2ba86b2ccf37211da49c7f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689002, "uuid": "2cb1df32-1b3c-4770-8b88-bd3557f109eb", "value": "24576:TltAW4lBqIddU7NbKznXTi7z5tzUwAfguvFHFHkvnVPGK/cRgOnmq9g6zYf7LT8:ptAbBZK5bqTi7Ntzgfg0FqvVPdcOU7mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652689002, "uuid": "4909345c-1efa-46a3-b6ff-c77956af595b", "value": 1297808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652689002, "uuid": "32568d2f-b7b9-4d8c-bf83-46d8cdd3cbca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689002, "uuid": "b08adbd2-e714-4170-95ad-fa6c633a27d6", "value": "0163734f39ee011ebc32cd0c68b928288ba99d40fb705630ab0b1a257af1b8ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "877e52f9-d4f0-11ec-8e58-42010a9c0032", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1652689007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689007, "uuid": "3765c8ce-2e32-4852-b1b4-24bffbed9077", "comment": "Malware payload (ArkeiStealer)", "value": "58da13675493de98bc6685901001288c", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689007, "uuid": "0c60e4ba-df62-4be8-919b-b4be610b2c4c", "comment": "Malware payload (ArkeiStealer)", "value": "01c42408c4c635837b334ebdf2342d3d165676f1ccbe6a0a7128555083a15804", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689007, "uuid": "9136f690-b12d-466f-838a-9e5588f60d0f", "comment": "Malware payload (ArkeiStealer)", "value": "1b2443f3c1de0d1e044881cc0d4e9eb84d92b530", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689007, "uuid": "791c264e-2ac6-4fc3-9edc-ee84360b17e7", "comment": "Malware payload (ArkeiStealer)", "value": "5ce2fec8a51b34bccff00e74ea11a6bc0765a8373efe35bdfefa12f6fb67c255901ae51dd20313b37cda9b3dd2b870f8", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689007, "uuid": "0a695c54-9e3b-4d24-85d7-21cdacf38164", "value": "T1D2E4BF26F2D2D077D0332131DA6E27268ABABA3214319487F7D50B5A5EA11D1BF3E713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689007, "uuid": "32337036-92a7-4cc7-8940-ba692c07d4dd", "value": "764f2c8a1402bd58514309fa518ccb90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689007, "uuid": "1959b54c-c035-4abc-9cc0-b818be206041", "value": "12288:7goLOArxbVkI4VH/BC0/8icBBeIYZ8jlu+xzcWyua7VlJ+jZlqxRCQs+B6ezdQCw:sSjlt16MtLgMis0blOG4DAglEO1AIrzB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652689007, "uuid": "e6ba5dd6-47b0-48df-a220-4008132a8681", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652689007, "uuid": "b9e92d73-8793-4b27-a1e0-ed37a3c99732", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689007, "uuid": "4c07fc00-4684-435f-92c6-443f5091f4e1", "value": "01c42408c4c635837b334ebdf2342d3d165676f1ccbe6a0a7128555083a15804", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7c9f4f9-d524-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652711422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652711422, "uuid": "0147d1f7-568d-4aa4-bf2d-1f0698bca804", "comment": "Malware payload", "value": "dc9a5fb0065944a1f47a698f975198b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652711422, "uuid": "8b8d647e-dc86-46bc-84f5-05bf5fb528ab", "comment": "Malware payload", "value": "0204f52ade9ed653e0ed1efb665a486ed422c771c243eb93adda03e68d817dd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652711422, "uuid": "ba1493e6-f6a5-449b-81ee-ba30193dfe2b", "comment": "Malware payload", "value": "e7d14317f9bc398bed22e28530df2dcd6923f0c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652711422, "uuid": "e90972e0-6649-4c4d-906c-66936daaac84", "comment": "Malware payload", "value": "d8fb2eea4b6c8a0141aac540be6459fadf7c568d68256e05bdec8ed770ec5b6224417ee6446bc759635554121efe708a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652711422, "uuid": "a73ce8e8-dd72-420c-a669-116ed62f9483", "value": "T10A5623BD624C3718C41EC9748133AD09B3F6515E1BF8953EB2DBBAC46B9B8159AC2F01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652711422, "uuid": "eba68ab5-e747-4b83-90b1-5b0b433228d1", "value": "29ca858660fb2eeec4f42b887efada9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652711422, "uuid": "bfd41a96-12fc-444e-999b-1927fc3673ec", "value": "98304:qDm8wMfcCPcRAvl0WOPmGKAF+CwQJd9NgUAfblSTgMlKNdIpIYPy2szY2wipZba:efcCPcWqWONNF+QEUAfblDPNGppPZszn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652711422, "uuid": "ea671de0-84f1-4998-bd57-eca25e1d4db8", "value": 6172160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652711422, "uuid": "37d4f0b0-478e-4a14-8d58-70d2263c70bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652711422, "uuid": "a983dc8a-f853-428c-94e1-f3e5f8b3dac5", "value": "dc9a5fb0065944a1f47a698f975198b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e938758e-d514-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652704633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652704633, "uuid": "c32e4634-fcb3-4cd2-8f77-867e05e4cee8", "comment": "Malware payload", "value": "f29fe566b8797d64ac411332c46012f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652704633, "uuid": "3d4bb899-e2ac-4a86-ba09-89fac9f8b93e", "comment": "Malware payload", "value": "025263cde993621dab74b48373910273a8e770930b6e564068377b73a41ac0ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652704633, "uuid": "9b51fae0-c1e3-4ca4-a11e-115cf0408a85", "comment": "Malware payload", "value": "4a443134a6f354c063dafcbf83a09b81c164be9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652704633, "uuid": "8f0d2370-3d67-4de6-a013-f507d5ad5ac1", "comment": "Malware payload", "value": "28d79155028525a218705726852b7f4183c21c469c1d19c7c939adbe215e4e06477732bd9aa33c81750537e89debd5e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652704633, "uuid": "18449460-9e9e-4b67-92ec-655eee73397c", "value": "T13725230182FCA437D5B223B10AF91763063E79F54B33936F66994AC81C623C97A7635B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652704633, "uuid": "3be3bb80-54cb-45c3-a1ca-58bbe43f3874", "value": "bc70c4fa605f17c85050b7c7b6d42e44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652704633, "uuid": "e7b78e51-fd86-4a4d-9cae-993a3f80e87c", "value": "24576:dQy9FSK11L+24esEKcLZ0uEC6sU3LBopOhQr+wonk:dQyGKTB4esERdEh3LBqwJwon", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652704633, "uuid": "aba05b88-bbd6-43dd-ba89-3a852cceb44b", "value": 993280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652704633, "uuid": "96c18f76-1b7e-44f0-b94e-beee7a4b0f0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652704633, "uuid": "50285ce0-3a98-4b5c-bfeb-f2e96e63a3c2", "value": "FJEfRXZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2b8f139-d4e4-11ec-8e58-42010a9c0032", "comment": "Malware payload (EternityStealer)", "timestamp": 1652683979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652683979, "uuid": "82b23bfd-55a5-4fba-adfc-918ad3278e56", "comment": "Malware payload (EternityStealer)", "value": "c4b46a2d0898e9ba438366f878cd74bd", "object_relation": "md5", "Tag": [ { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "Eternity", "colour": "#271FB4", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652683979, "uuid": "8836eb6c-e5dd-4706-acf3-544c71a5da93", "comment": "Malware payload (EternityStealer)", "value": "025e74a98cb22aab0eb2dbff69cb5abd4f1d529925d9e456f92f5fd6ff1e11c3", "object_relation": "sha256", "Tag": [ { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "Eternity", "colour": "#271FB4", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652683979, "uuid": "efb10226-f3f0-4181-b4f9-976ff38ef6ee", "comment": "Malware payload (EternityStealer)", "value": "f95a0529fbb8aa61cd3dee602fa6555b2c86dd62", "object_relation": "sha1", "Tag": [ { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "Eternity", "colour": "#271FB4", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652683979, "uuid": "d4e07e83-7e2b-4d9b-b224-633866a5336c", "comment": "Malware payload (EternityStealer)", "value": "862087a68f1746f0da85dc986a7dd9ba1e95433aafc7c2596796274e555c471301adf579f80c68df79c010fc097cd059", "object_relation": "sha3-384", "Tag": [ { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "Eternity", "colour": "#271FB4", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652683979, "uuid": "e2e52c72-7aa7-4e25-9e2f-bc172936a2af", "value": "T1C853B624BFFA5129F1B26A3DCDF27567C76DA2632B02B31A255122470E139C5CD831FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652683979, "uuid": "842a5cf2-25a0-4759-8a3e-a374e44e2615", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652683979, "uuid": "9a66ba51-8f43-44a0-81c2-8f54d50f622a", "value": "1536:U8554pstCdoPpYyb1f3uOQyP7GrhMfTMhBeUAoKT7f:U85cssdKJb1f3LHKMbjUAoKT7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652683979, "uuid": "166ef818-24e2-4acd-bef1-844ddd80cc5c", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652683979, "uuid": "822ca78a-1734-4552-9590-78111bb8512e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652683979, "uuid": "40b8b687-d5bc-4ac1-9cd0-2a03d893dd50", "value": "025e74a98cb22aab0eb2dbff69cb5abd4f1d529925d9e456f92f5fd6ff1e11c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9279191-d52f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652716175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716175, "uuid": "3cc06b5c-44c3-4dd4-b50c-31ae9b463053", "comment": "Malware payload (Heodo)", "value": "0a12e7a035d8f87c6c513909c8404a04", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716175, "uuid": "2695bf82-b29c-4a10-8a2c-e73994752a65", "comment": "Malware payload (Heodo)", "value": "0277804ac14922f684bc88b75d450de729ad841118d1f43a1d26750e8c98c890", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716175, "uuid": "e9d7d379-b0ae-4694-9b0c-d260ce7bdc7c", "comment": "Malware payload (Heodo)", "value": "dfd1e9fb8a151740a76dc16c333e661d2b98a6b5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716175, "uuid": "76671d44-676d-463f-8e54-ca8a39f27b0a", "comment": "Malware payload (Heodo)", "value": "416e261874794d98e2c1665ae6855883feba8af7d3ce5f92ba656acf28e4fa354e9dc25db2be855b1a9a4ba0f00e1370", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716175, "uuid": "c4224932-39a3-4db4-836e-f901f2090e5a", "value": "T1E8734A4AB98AC96CE615C739499743A9B313FC114FAB078B3109F3727FF49A05A0761B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716175, "uuid": "e7a0444d-7e89-4824-92ac-fe01037dca50", "value": "1536:tpKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg5AezwrMCtvJecvRtbTNF8:zKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652716175, "uuid": "8ba04e53-2bcb-4ed3-bc1a-f304a1e3c9f9", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652716175, "uuid": "97e3197e-1e3a-4e64-80f0-1154f11c2a4b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716175, "uuid": "154eb172-de6c-4995-8fdc-6963b1acae6f", "value": "documentazione 4472.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd7ff5f-d554-11ec-8e58-42010a9c0032", "comment": "Malware payload (OskiStealer)", "timestamp": 1652731940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652731940, "uuid": "c699f559-d947-43ff-8a3d-c85dd6f01a28", "comment": "Malware payload (OskiStealer)", "value": "2d204abdf1430a77271041c926b1ec5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652731940, "uuid": "a7395653-949c-4e95-9709-26fa91a293d3", "comment": "Malware payload (OskiStealer)", "value": "03e727533b2ca8ed0dd10444ce7e95ef19334124fb3014fb090784b2371957b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652731940, "uuid": "17fc6c0e-8174-4d78-a3e1-47d072c00023", "comment": "Malware payload (OskiStealer)", "value": "d2c6ca114d462a259573b4ad23a053b53f2bcdaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652731940, "uuid": "6ef87320-a0fa-4266-ad11-1cd8713eea8a", "comment": "Malware payload (OskiStealer)", "value": "7f31775fc8baa1f964fba53040ec5735b65f882e1f79e49d9da81ef04d9e431afe79199b20cd03145a9e934b645fe94f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652731940, "uuid": "92e0aae4-1548-4276-804f-80ff44d35ad2", "value": "T166E40228BFA5DD12D1BE2F3BD0FA20244BB5BE899133D72F569816090E0339B4E55367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652731940, "uuid": "3db99eba-4918-44ae-85d2-efce7996b3e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652731940, "uuid": "f86dea7b-e4a8-4370-a051-ac14bbc2afbc", "value": "12288:lCxMpMpg3P+YjC0spXWrZd40PL4gFOar/RUyKKX19Fqp:Tq41C0spXWrZLnkiRDzF9Fq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652731940, "uuid": "f0eb4c56-5f52-42bf-91b8-216dcd4b99a5", "value": 698880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652731940, "uuid": "aa0a4420-93cb-4970-a365-ae4023fadaf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652731940, "uuid": "89858b0a-b071-4a40-a929-333bc2c81c1b", "value": "2d204abdf1430a77271041c926b1ec5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4016472-d4f0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Stop)", "timestamp": 1652689055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689055, "uuid": "ae96657c-a9b4-4288-9580-2c750cd01613", "comment": "Malware payload (Stop)", "value": "1d94e767cb2a3a08bc04612a737c73fc", "object_relation": "md5", "Tag": [ { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689055, "uuid": "9c0e407e-5c9b-4272-bdc7-0a7522ad3504", "comment": "Malware payload (Stop)", "value": "03ff8b23e8ece95ca08d0ab4a9d0505f4c4b4189b59fb50f1859a2232bd8b589", "object_relation": "sha256", "Tag": [ { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689055, "uuid": "43ada16b-b720-4515-bceb-ea4ce18a25ab", "comment": "Malware payload (Stop)", "value": "cd35f26a449d38ffdaadab2e8a712b0f68837176", "object_relation": "sha1", "Tag": [ { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689055, "uuid": "235f615a-fac1-4f73-b1e6-63a1a77eaaf1", "comment": "Malware payload (Stop)", "value": "dd221a364d28d1c9edfa99dc5513ce1c3e3d705282f019dea8fd00e4f93472b1bf191f47ccfd6107286307a86dae4ef5", "object_relation": "sha3-384", "Tag": [ { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689055, "uuid": "4b827984-30d9-4b34-9ee8-ee87649c09df", "value": "T1BC05F110BB90D034F1B722F455BA8269B62A7DE15B2851CF53E56BEEA7355E0EC3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689055, "uuid": "60429db1-2038-436c-9218-87c8026a475e", "value": "d679cbfb1d71e0ea69e6075cdad8b074", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689055, "uuid": "078ac12d-2149-47c9-9764-6437882849f8", "value": "24576:MSzbDC6apuM5WpR216WVS3zC9UjMPrhy1x1:1W5cR28ES3zC9Ujch8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652689055, "uuid": "be15252d-7215-4640-b40d-38194626ee33", "value": 853504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652689055, "uuid": "24310beb-a7a7-4b8a-a86e-7eb722f2cf2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689055, "uuid": "9188503f-e63f-4dfb-9fad-3b51ab07f835", "value": "03ff8b23e8ece95ca08d0ab4a9d0505f4c4b4189b59fb50f1859a2232bd8b589", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42a9c59f-d51c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652707789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707789, "uuid": "728c786b-5736-4e9b-8b02-bee2ff02d100", "comment": "Malware payload (AgentTesla)", "value": "a0ffff1b8e930cc262de2f0d4ec77369", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707789, "uuid": "dd3d76fc-a61d-4ed8-8513-72bc3cbd3fce", "comment": "Malware payload (AgentTesla)", "value": "043dd3cf08aeff664fd655c468a95e0e2bf0467931bf24735ac9bacca6576a92", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707789, "uuid": "ea8a9924-5597-4f67-a339-80a17986d1c3", "comment": "Malware payload (AgentTesla)", "value": "727bcb1ac27a5e38a02f6254884bc93c8b101a31", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707789, "uuid": "61b11be9-5f67-4aed-8215-507488de7359", "comment": "Malware payload (AgentTesla)", "value": "892cf44e8e936b00ece5a6782b2d734bdb75b1aee1156b630936152d9f2f8c0989fcfa1e9753507c4cd098efbbe89f66", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707789, "uuid": "fbacf94d-da03-4ab2-bc50-8c8f3f18de10", "value": "T15EC4235F359CA721C91A13BA1AB65608A3F1B5552082FE490CC521EBB773F58CDE0BD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707789, "uuid": "de881568-32fa-4ae7-9561-af9245d262b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707789, "uuid": "7898b070-f25d-461f-9d5b-230bc5c8825e", "value": "12288:IyO2iNPSUL/EV2x9Yz6/PrtKIvF8Ct8tAfs6U3+V0Anhneh:IR1gULcsY+B/8CuAfs1uVh9eh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652707789, "uuid": "99996cf1-491c-4092-8085-8631363e9466", "value": 562688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652707789, "uuid": "ad4b5084-8c39-48d8-8f98-878b84f2f383", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707789, "uuid": "26ede868-3309-4045-a310-3bf121fdb297", "value": "a0ffff1b8e930cc262de2f0d4ec77369", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34f23d2-d4e1-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652682638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682638, "uuid": "5b3d17dc-fca0-4d99-820f-37f2b47dc118", "comment": "Malware payload (RedLineStealer)", "value": "df5e1c28a977446f3cb06300e645ee20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682638, "uuid": "0eba612b-7b90-4c82-9a17-d5b880ab1c34", "comment": "Malware payload (RedLineStealer)", "value": "043fefce38431a825ec0ee15bb352c7a95fd3332fd346d81c5b3f87f16b02f1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682638, "uuid": "6b59dea1-a904-4865-91f0-884157fef27b", "comment": "Malware payload (RedLineStealer)", "value": "7909aba88dbede10621b2f178b965f60a851905e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682638, "uuid": "466632ac-65b8-4c74-a596-34348a38e4d8", "comment": "Malware payload (RedLineStealer)", "value": "b767a065b32bb4f39aa1bf5f77b52f0e14dcb9fe78f0fdde605a2bedc5cec8a3a8fb9ad18dcf5bf1475f8bc639684630", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682638, "uuid": "3d499044-6fdd-47b1-aed5-a691719a5165", "value": "T1E774F1A2B391C038E0D6163814B4E6764E7E78326A74985B37A41A390F607D19F7F35F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682638, "uuid": "ad5a5956-6a8f-4850-b745-09a8d46d5875", "value": "e9503a060b34f2ce3765168e17b66379", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682638, "uuid": "987928df-6069-4615-9d08-7d2408792ec6", "value": "6144:EPJLPDCDE3CAtk0TebWfVuQ7rKbkfizV:EPJLPDCYSAR6bcVuDbkqz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652682638, "uuid": "53679657-0bf4-4414-8d7b-00fa5ed25b7a", "value": 355840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652682638, "uuid": "d3493179-3d0f-47cc-b7ec-9532260a7a31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682638, "uuid": "31a4518c-6215-4fcc-8537-7e1418d55d2a", "value": "df5e1c28a977446f3cb06300e645ee20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1553c2ee-d527-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652712437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652712437, "uuid": "d04ff9a5-af8b-4bc0-b091-496e70826a92", "comment": "Malware payload (Loki)", "value": "3a84efd2cc07cd03691716b98b808d9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652712437, "uuid": "67fb4d5f-02d2-44a6-b45c-cfa7081d77f4", "comment": "Malware payload (Loki)", "value": "04a0fad143712f6841702e01f6d0ab73cd0fd0185004794309e3f5d4f55af2ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652712437, "uuid": "bf1c511e-05bb-4ba4-9bec-4b82357cfa8d", "comment": "Malware payload (Loki)", "value": "84549e927ea844e3d03270ce48a9f95013d6f885", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652712437, "uuid": "71110ec7-df9a-4782-9820-beb6332f6dc9", "comment": "Malware payload (Loki)", "value": "67a2f7b320c7c487b15b2d1e2455934f9c2ddafaa5e4dbde5b215cbb5c0cc716a6810b229e63840459a0d022aa85c0be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652712437, "uuid": "d60d0eea-e8f6-4655-ac1d-b74907106794", "value": "T113C412697A6A163EC42C5B3EE3D34D4237FD24231A21D1151F8E9AC70A0BE625B13E5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652712437, "uuid": "59bd65e0-9687-410f-9e64-c5a361683cd9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652712437, "uuid": "463bc885-78b3-4ae1-b275-7ab61539340e", "value": "12288:9A+ypzTZjyZ28TYWoxWaNZxPj8qNORfhL9I3rQCUHSSXWqkW1W:9KNjS28TYWmfNlmhL9IkcW1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652712437, "uuid": "6316301e-180c-4c2f-8348-b4936b4b4be8", "value": 590336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652712437, "uuid": "5ef09be2-fa22-4de2-b0d6-632ad153bc01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652712437, "uuid": "d7fc9a2a-8d07-4d78-99cb-0e61e119e99d", "value": "duration.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9703af6-d54c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1652728712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652728712, "uuid": "47257d96-f10f-4973-8c16-41abeffe3ac9", "comment": "Malware payload (AveMariaRAT)", "value": "ce488babc73497c16ce8d2de5ed218a7", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652728712, "uuid": "c76f064b-b009-4b86-bfa8-877e4368687e", "comment": "Malware payload (AveMariaRAT)", "value": "0585a3a0fddedd9a937cb3f39ce3343596a2f204c97b753f4b8ac108b6d50ab6", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652728712, "uuid": "50aa8930-bf04-4df2-b52b-a5ebe45e6a7e", "comment": "Malware payload (AveMariaRAT)", "value": "dd423d955d724381bea010e7a927dc21ec501eb2", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652728712, "uuid": "156357a3-4294-45c3-a1f5-907d06c5c309", "comment": "Malware payload (AveMariaRAT)", "value": "7315594ae3f18cac5122b64d89ef033634ad8b4e65732777ad657fb3128be295ebdd9d19579c74f27e507ff731dfa084", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652728712, "uuid": "cf21fbd6-f674-4b20-9207-6f0956b292d9", "value": "T1CB74E004B2A0D856CAE136741FA6D9352B72DC1D452A471727F07F6F79FEA23A80D3A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652728712, "uuid": "854061e9-fa71-49ee-a14e-661449d4b089", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652728712, "uuid": "5a7cf778-256e-402d-bf1c-2a90d3ff6ede", "value": "3072:+fY/TU9fE9PEtu6GJM+CgnGbtSD4tP9O0IkGhFwHcOoljYFbAu0Pi7JcNXu+Ke5G:oYa67M+C7SjjYFEnPzKrB1Pb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652728712, "uuid": "ef847acb-813e-4b94-bb4d-e3e1fd2d2c4b", "value": 346452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652728712, "uuid": "819fcac0-c9e1-4679-b853-25c0e9ddfb83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652728712, "uuid": "93fa952f-4e6a-4ed8-afdc-64af6bb99231", "value": "THC-GW089 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caebadab-d52f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652716178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716178, "uuid": "0ec98f70-f3ee-4e0b-8868-427de6c24a49", "comment": "Malware payload", "value": "ec48a65498f45eb79acf2aad1912fa0c", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716178, "uuid": "a9e52efe-012d-4885-b793-e845dc58fe67", "comment": "Malware payload", "value": "060a99e4b3c3a6b780aef45d7460e9f49ed305e465167294ddd6d09e704ec218", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716178, "uuid": "a31eb2da-e1f8-4a42-87b4-5754998c9e4b", "comment": "Malware payload", "value": "06f85092b24f15fe90dc9697d43e519c314abb3a", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716178, "uuid": "c48b815d-7394-4683-954f-8b18a4dae808", "comment": "Malware payload", "value": "a5337ef5044d504d4193170bc39d704e6b4abe5c1509537c0b3883bc2112e2b1aa370b3cab7c79b0714104a4ab67f9d1", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716178, "uuid": "b57ddc8c-0d47-4235-bf47-b23fb6e93f0d", "value": "T1DF51AF283DDA6128F5B3DF717AD875D6DE6ABAB279015D4F1081030B4811E40ED96D3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716178, "uuid": "bae2aa14-04a7-458e-8b12-a126a0da7533", "value": "48:8ms5XJi7B8KTSukPNx4sedNk96BLdKzvnAjk2dt6B/vuoWN04ab:8msJJid8MuNxp96/Kzvv2Hy/N34", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652716178, "uuid": "a9a694be-91c9-4c45-b953-09fda3476389", "value": 2632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652716178, "uuid": "2c07511f-11ea-436b-8e04-2bdf0e5972d3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716178, "uuid": "db0e1c1e-c7e7-490d-b51a-492ddb9cf768", "value": "List-349811273.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f6d9d17-d4f9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652692671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692671, "uuid": "c3f24491-463e-4908-8490-42ebadea719e", "comment": "Malware payload (Formbook)", "value": "ed508346f62a14b3f237b85d34530cf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692671, "uuid": "9ea99ec4-e654-492b-993a-b90524462dde", "comment": "Malware payload (Formbook)", "value": "06f3408edbcaee5fa7d4ad6479a40277e2e96a840a12c1bf56070e3d86c4e4fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692671, "uuid": "1b0c0a1e-e264-4054-af07-4c5c7d68a798", "comment": "Malware payload (Formbook)", "value": "b226d8cde35803e34379cbc646b914cbc93e6f9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692671, "uuid": "217cb1ff-e18d-4dfc-8ada-7f65d9c2bb19", "comment": "Malware payload (Formbook)", "value": "ac573e50526f2ba1f8becdc6f5452d1f1c58be76f48f6dc292e93b01894822ab50946d76e86f7eac303e139ed801763b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692671, "uuid": "3d81fe89-0703-4e9d-b88c-8e8c986f6be1", "value": "T1BD541284B7D5AD17EAE39F735D5B920A5FEAC81671D28B0B07F0169D3C31382622F690", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692671, "uuid": "19c0f4ea-eaee-4bc6-8427-93dde6e7b162", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692671, "uuid": "dabd34b7-c560-450b-b625-9f4f41920cfa", "value": "6144:LOtIOJuDKPFO9vmY0jVi86M/gY1asNJZ9l9UIK1I0XkbVlHY:LOLJASODk4M/pNJ/nUIKB4VBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652692671, "uuid": "2d1a47d3-3311-4333-9548-e2153085aa26", "value": 289312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652692671, "uuid": "d23fb133-7172-42e7-9b31-9edc63e0225b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692671, "uuid": "b8242f3a-dab0-499c-a250-2cb52a3191e8", "value": "payment advice_007100013.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a4868f-d506-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1652698417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698417, "uuid": "4ba4f749-d17a-4e0e-b545-be346e5e998e", "comment": "Malware payload (SilentBuilder)", "value": "ddfb9e91237cbdaafde4582164b8dd3f", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698417, "uuid": "12ecad24-4aaf-4b92-a85a-7d4dfdfb987f", "comment": "Malware payload (SilentBuilder)", "value": "076d139118311b2b4354eb369eae79b1c5bda0b53ce74f190b63c3a36fbe1888", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698417, "uuid": "8dbb73ec-a8cf-4e84-864e-b058ccb30aba", "comment": "Malware payload (SilentBuilder)", "value": "608e38426da6aa7ebdb9d3492b79959fb36913be", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698417, "uuid": "262e5c28-b658-4b57-bd1a-1859f3953061", "comment": "Malware payload (SilentBuilder)", "value": "1740142cb108c08078d92a7436a34e7f420447a6439e77bb96e544e3eca159ed40f39009db490d05a5cb4f7cc629ff8b", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698417, "uuid": "ec5dbc8f-b407-496f-8696-ec4e12345027", "value": "T144734A4AB98AC96CE615C739499743A9B313FC114FAB078B3109F3727FF49A05A0761B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698417, "uuid": "e17c762c-605d-4b2b-a1fe-51c4db2b2343", "value": "1536:tpKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg5AezwrMCtvJecvRtbTNFY:zKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652698417, "uuid": "268da3b7-fadc-4444-be38-36d88816a428", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652698417, "uuid": "b4a85513-4fdd-47ce-bdff-5cd99d52f9bf", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698417, "uuid": "d5828593-4d58-4c49-a958-8ce2550e40c3", "value": "Dokumente_7544.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acfb5d7b-d4f0-11ec-8e58-42010a9c0032", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1652689070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689070, "uuid": "d956d745-2e42-4d7f-8447-872305248950", "comment": "Malware payload (ArkeiStealer)", "value": "e9135139ddd4ba4c876aad5745f5a1b3", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689070, "uuid": "a4c12583-77d6-485d-b554-95911fc2bc3f", "comment": "Malware payload (ArkeiStealer)", "value": "078a1454758249c9ee1016a0ee2e9c149965a9e3a50345287f3086cceccd4442", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689070, "uuid": "5686f56b-14cd-4a61-85c3-443d127c1eb2", "comment": "Malware payload (ArkeiStealer)", "value": "4414492f2c16674b57e98d7529f191fa01c754ee", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689070, "uuid": "c8c3ef0e-d484-4ce5-8786-afa0d63ba58c", "comment": "Malware payload (ArkeiStealer)", "value": "50a03224fc27d552f95872d9b2c2a98d4bb33e39cc397c18c2e8db89692d1cfece867093080a2568147acbb1ec1005c5", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689070, "uuid": "e26d4622-4914-494e-962a-a37837cd8233", "value": "T1A5D5BF738301C36AD793703A81CF9D25720A5671662FBCC267056BA8DB172EE5624FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689070, "uuid": "535e7ff3-078e-446c-8171-66464996b917", "value": "9de116a58a6964e888a644a836e6e83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689070, "uuid": "27ea7b39-6d7a-4a37-8f84-0e268df04a8c", "value": "49152:f2ENDjoOpIv2pZyq6ZnvX+1O6zFdNCpufscoAdhd7eC//y7FMKmGhrRxyF:f2ENDjoOq2pZyq6ZnvX+1O6zFdNCpufR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652689070, "uuid": "236ae9fc-22c9-4221-9603-43dd5a57ff2d", "value": 2784736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652689070, "uuid": "70a32b87-c6d4-4d09-9868-cbf5cc1f0b08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689070, "uuid": "e765f570-e07c-43dd-8f5a-c627a5acb661", "value": "078a1454758249c9ee1016a0ee2e9c149965a9e3a50345287f3086cceccd4442", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a2c270-d4fa-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652693431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693431, "uuid": "c79a8ed8-b16b-4087-8053-dfa191b580f6", "comment": "Malware payload (Heodo)", "value": "93c9b756043ae3e1f2db4d9bfc8dd0fd", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693431, "uuid": "4dba6180-cddd-4448-8c8f-936efdb8472e", "comment": "Malware payload (Heodo)", "value": "07cf4f61776265b015789b18d3a131faf48e93b982a8658283f7afd46676588f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693431, "uuid": "f781f3c1-c691-4a0f-9394-7ddeeab8562a", "comment": "Malware payload (Heodo)", "value": "bac906541bf9724a5885d88d00fff1c4dd5de605", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693431, "uuid": "ccc5390e-194d-439c-8cd5-87634e657727", "comment": "Malware payload (Heodo)", "value": "0535eeeb59f304943f81469c0c69eacdadb08644deaab8365e3fd4c31022df6412001ca4f3d718682ff862d0c775ca9a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693431, "uuid": "0d3e90fd-baca-4913-92d4-f92fc7791c50", "value": "T1B9055A35FB6C8492C6A3953D88A34B06EE6AFE840B6183CB1290733E9E777D45C35671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693431, "uuid": "17723fe2-9fd7-4c1d-b389-fefde0b2cac8", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693431, "uuid": "126e32cc-9e41-4072-aa1b-207a46770dd3", "value": "12288:Q9983xnvoz0/7aG8GkZHFT1YicDAXmvQaZsbNg:A9UhozAWGxGx16AWvVZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652693431, "uuid": "1a521c64-37e0-4496-bf8d-fe785a539caf", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652693431, "uuid": "1663196b-d865-4437-86c1-b9539bfc04e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693431, "uuid": "9bd6fc5a-3bce-4f62-8e9b-67cd962b55dd", "value": "93c9b756043ae3e1f2db4d9bfc8dd0fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b038e625-d526-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652712268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652712268, "uuid": "c24d78f8-3098-4c2b-8dae-b8c716cc27fd", "comment": "Malware payload", "value": "99fa47f7c2881ed5bc215e8b125f8ac1", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652712268, "uuid": "c295b9c0-a992-4aa9-9229-2d7bda4989e6", "comment": "Malware payload", "value": "07edd16480abf76139b853bdd2e4c37652bcfebec6217cf55c7e8f695796b810", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652712268, "uuid": "70f12de9-4f35-44f8-b9c6-bfe3a86cfe9f", "comment": "Malware payload", "value": "e4f1cd7865a52bc2baac531027af85f13be43f37", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652712268, "uuid": "9805b9fb-2146-49a4-bee0-4f6ac8860888", "comment": "Malware payload", "value": "9504715d59d4e00155cc210037dda37ca8fbf3eec3079d1ef35c3e4e337de7f970c04580ce9585e618b13115d5fe97f3", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652712268, "uuid": "260e6962-8a2e-4409-94d0-d0d7df14d6ce", "value": "T1A551304D304FB92915332EB2DD2B186EA4B24793B3BD01407A0AEAD5CD3946CBB96D1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652712268, "uuid": "0c81fe01-af20-493e-bfd8-2d15d35ca41a", "value": "48:K6BwIfjgwXJz1rS30B5IwtinaKWVC7B2SipIe9V0BdAqlPe3:kH2Jz1rS3s57Ena1hge9Vu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652712268, "uuid": "3a71b9e9-26e3-42cf-98e9-e1e31ec124aa", "value": 3044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652712268, "uuid": "0768c1b1-e2a0-48ea-b32a-2bfd92c8a3f1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652712268, "uuid": "422482e7-b6a6-4dd6-a9b9-63f1091018c9", "value": "9012_883_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13205b11-d4e8-11ec-8e58-42010a9c0032", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1652685376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652685376, "uuid": "e07c5b41-bd5e-47f3-a586-e1c9fd48f28c", "comment": "Malware payload (ArkeiStealer)", "value": "2b037a2c06313308444a96ac4941128e", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652685376, "uuid": "81639da2-31d1-41a2-8b9a-00b9898a52dd", "comment": "Malware payload (ArkeiStealer)", "value": "07ee7b94d6bea6279df2347f129ff9c5e519b18d1d6c1c3f9b78551d0a4879a1", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652685376, "uuid": "2776efb2-b125-43a7-a6bf-fa10a78f189e", "comment": "Malware payload (ArkeiStealer)", "value": "48de4839a33d637e15e0b8d5cfbc96c9efa5320d", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652685376, "uuid": "1026362d-19eb-42e0-9e91-ca6ccb300043", "comment": "Malware payload (ArkeiStealer)", "value": "a2c6ae5f269394543d7a7e3b3cbaf5bef4b9deee3dca4346b3bf3714b3c08b4ddf449a1afc0f2376debacd8bf36a7ad9", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652685376, "uuid": "6d8361db-f96e-4d8b-81cc-2e35add1ef03", "value": "T128C402213DF68032D5A29EB84A35C7E54A777C60C32095CF6BE9E4B72E696F18B34341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652685376, "uuid": "66397508-69ae-4de4-8dfd-d4e88a679ed5", "value": "4b61e3a00ead3af8a18b2eed863b2e92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652685376, "uuid": "6ed4b358-c53b-44f8-89c3-c9a70994a5e7", "value": "6144:ukPImA4qRrJP1peg9+TqX+7cRg5PNvLjHCtprc381Qu0l8KNEP1dJgjwHW2EAXEg:ukPnrqRrJmqX+JdLjpiKNu1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652685376, "uuid": "3a63ec29-eeae-40c6-8a15-a53a8d616ea3", "value": 560128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652685376, "uuid": "8c481a0f-e12c-423a-85a0-32f480180dec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652685376, "uuid": "1acf892e-30d4-49bb-860d-9f7b00c868ee", "value": "07EE7B94D6BEA6279DF2347F129FF9C5E519B18D1D6C1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c83f54b7-d4f4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652690833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690833, "uuid": "fa1bee64-7006-40ad-9853-6b1d101c0547", "comment": "Malware payload (Heodo)", "value": "f00ec369ae7b8ef259a2565d2b2f2332", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690833, "uuid": "7afad8ae-60bc-471f-8f99-3999d1db9b29", "comment": "Malware payload (Heodo)", "value": "084a58972d6d7d33c321f386d7b3f7a50499b121f4494c0ce8fefe58ad33df52", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690833, "uuid": "1f2ca2fa-9922-42f8-9f98-03447475f29a", "comment": "Malware payload (Heodo)", "value": "857e396917e68c113a3f3cd0c9fc6d908badb560", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690833, "uuid": "a97bd68a-297e-49ad-a240-1565c73c2ca1", "comment": "Malware payload (Heodo)", "value": "079d2dbc92a552468384343ead9a1c6e22a54fb6242b692559c38c8484c18dfa3116abdbb431f6f8be4b2d055f31ee30", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690833, "uuid": "ecff4d32-835f-48e0-972a-15cb51c49577", "value": "T1F0055A35FB6C8492C6A3953D88A34B06EE6AFE840B6183CB1290733E9E777D45C35671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690833, "uuid": "88ad8383-9d21-4f76-9919-161aa9c73b61", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690833, "uuid": "06e718b3-4951-430e-936f-a20add3046d4", "value": "12288:Q9983xeoz0/7aG8GkZHFT1YicDAXmvQaZsbNg:A9UoozAWGxGx16AWvVZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652690833, "uuid": "e7d77404-8e5e-46dc-b0e0-9d05caf4d02d", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652690833, "uuid": "1a3059cc-b414-4399-9b53-b75334d846ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690833, "uuid": "5552f659-0f94-4fd3-96fa-b663c69dcecd", "value": "f00ec369ae7b8ef259a2565d2b2f2332", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03e87a30-d4f9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652692651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692651, "uuid": "dc5060c9-d962-4f14-8dde-17e7a69ccc86", "comment": "Malware payload (Formbook)", "value": "3bb534e12b1e1d68444a435630c950e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692651, "uuid": "e705e391-4217-4184-a3bf-e4aead6c13a8", "comment": "Malware payload (Formbook)", "value": "086a9d09a1cca4a91dccd357c82da83e618393a276156e8843480d96ee5303d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692651, "uuid": "7e9cae7b-f3b1-4589-9d68-a3523fb941ed", "comment": "Malware payload (Formbook)", "value": "f413567090800f62dc637e9ba85d15e19f7437e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692651, "uuid": "11d070a1-53bc-444c-acfe-593e05eacfb2", "comment": "Malware payload (Formbook)", "value": "60584c56d3495cffc2e0b05a9354c86f57be46e129f79cdcb82be2f110c39c728d4c979c8de594a639556888a5d5355d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692651, "uuid": "6707f7d0-20f9-4d28-97ad-2754fde21e66", "value": "T1AD3412117614C5A7E8F306302D7A5BA22FFB761A12A5AD0F13247F1C3D2A5A4CE1E395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692651, "uuid": "a566447e-c7da-4e6c-8b3d-4ac4434c3cb7", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692651, "uuid": "de92bfb5-709c-4539-915e-22ecd8aa9b41", "value": "6144:HNeZmw13er9amvid65it4f8Hipb0Dsc0DL:HNlhr9amviRLipwDsceL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652692651, "uuid": "31483bb1-3cb5-474b-8701-e25ad37a00a9", "value": 239805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652692651, "uuid": "f619fa76-d0a3-41f1-8b93-a80eff18c481", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692651, "uuid": "414b3f76-a46f-4148-97e1-4d1841d5fd91", "value": "April Settlement 2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b1ed9ba-d4b3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652662840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662840, "uuid": "c8410ed2-604d-4be0-a657-d887005d7c8f", "comment": "Malware payload (Mirai)", "value": "d4986418996e015696f9127682dc9253", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662840, "uuid": "5cf752e2-96ce-4eab-beba-69bf0ce2d0ed", "comment": "Malware payload (Mirai)", "value": "090ec4b7e71b7d6df880c2a7a0c05482b5a44abe0c6164a790712a3c6a80889f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662840, "uuid": "d3c03c25-a204-44db-a0fe-c554bbc90868", "comment": "Malware payload (Mirai)", "value": "39ff672f03d9c33dc96a30382577cca3d5d66307", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662840, "uuid": "6a1d7e61-cebd-43b1-b059-94cca092f4db", "comment": "Malware payload (Mirai)", "value": "4d0720b3ad41789d6823b0e8e324bac3bd89d388c4b52413246052dd094f6ccdef57d235af42bf1e91e008a102cb48aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652662840, "uuid": "c1d31266-9034-404a-9818-fc708fea475f", "value": "T15763B506BF614FB7E86FED3709E91B05248C541B21A97B3A7E34D818F64B25F19E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652662840, "uuid": "c231c694-b6b1-4d1f-8175-19a16db5d6cd", "value": "1536:xic5msW0dVJnzwIFIzUP8UTtDOPHtb3cvS:xP53BlEOYtaS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652662840, "uuid": "2d441564-3ff0-4933-a5a6-86b2ab208ed1", "value": 71508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652662840, "uuid": "1f712b6c-c59b-476a-bfed-d4bee0c30442", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652662840, "uuid": "2a486b97-24a8-4d5d-a34c-54008d06aafa", "value": "d4986418996e015696f9127682dc9253", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5195f0a-d52f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652716168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716168, "uuid": "f6e80bdf-6992-414d-9c31-f8c5bb4115cd", "comment": "Malware payload", "value": "822cf4de963a37cff0009186dbdbe3a3", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716168, "uuid": "265f4c9e-ba50-44f3-91a2-1acde28a86ba", "comment": "Malware payload", "value": "09e3990697c97b0ebfd73d3159aee21eeedebbe38192d8ea46b3ea26a4b030aa", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716168, "uuid": "5d2f6276-6819-41bb-8b32-fdc43efb37ed", "comment": "Malware payload", "value": "32bec02b8682e9a750f8fb5f1c72d7f7b590bc25", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716168, "uuid": "107d87c9-2a42-4486-a613-7d566e321ef3", "comment": "Malware payload", "value": "d974bc8faeb286d9366446e28e1078c2166913f31e129d5b008ecd13a3bda913b7676d49b40971acbe2a7ef901811745", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716168, "uuid": "9f036510-9ed0-451c-b318-fb0955ed5356", "value": "T1F4516D282EDE1129F5F3AFB16DD879DADEAFB6B77501494D0041434A0912A40ED82D3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716168, "uuid": "2b9019b3-5225-4447-b52f-1c28a969febd", "value": "48:8mym7XLXjYgzUmdNA3O4b2dt6BKRv4eq4ab:8myUZ1NoO4b2HyKRgT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652716168, "uuid": "b3dbd4ab-258b-4b1b-8fc6-b673c19c47f6", "value": 2672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652716168, "uuid": "229b2fcd-4a45-4a36-9c97-cf65b604b6d2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716168, "uuid": "eb664157-1274-44b8-93cd-eaa01619fb0c", "value": "Copia Fattura.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce66ff1-d51b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652707672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707672, "uuid": "1023d40d-c3c8-4358-af11-4c14fbeb145b", "comment": "Malware payload", "value": "3c76519608cfe942223d217fddc2b73a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707672, "uuid": "dd1fa29c-9bc6-437d-b424-72a004b6f6ed", "comment": "Malware payload", "value": "0a8afb4243985fd2c84a9abb3a4922aabb1436ced787d3e009e3f51eb0cf7edc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707672, "uuid": "8712a1d8-095d-4150-ad1f-5487e0c7451e", "comment": "Malware payload", "value": "0971594db9369585c327c9daeb995db69cf4be80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707672, "uuid": "f4893a9f-2b6c-4e84-b6fe-e20e1156a0ea", "comment": "Malware payload", "value": "c6038565d3da8c8af1d88fad76e796e732ac60490d53daa51bd5a3f480520e4df3828aab7ccb6c39d966775873719ace", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707672, "uuid": "10f82918-b025-489c-8500-4b61b9920dc5", "value": "T1F275122172D1C036D476033198A6837BB262FF619F35838F6BC1FA9E5E759828D38752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707672, "uuid": "66728436-a40c-4b24-9e0c-13ab4f54b07a", "value": "966b221031482c468178125fbf7eb0c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707672, "uuid": "0da8c820-a188-4f03-b387-5c8128c25915", "value": "24576:ORv9UmZs9XObfeeBAMLCv6cC2SS0cu6cKjd0XKEvwXEOUKcc1EwFC5j7ipByUt:ORFhs9XOLeAypuyjd4KIg1DCOy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652707672, "uuid": "5c92dd86-e2d8-42b1-b34f-a885d6a01203", "value": 1652656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652707672, "uuid": "d16ce304-fbe8-4764-9389-7bb57ecbee3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707672, "uuid": "1e86c743-2aab-4755-bc4e-0ef7791847f7", "value": "XCC06\u70b9\u51fb\u5b89\u88c5\u98de\u673a\u7b80\u4f53\u4e2d\u6587\u8bed\u8a00\u5305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc689bb5-d564-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652738917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652738917, "uuid": "8b81a30f-2dff-433b-88a2-27edd4781b1f", "comment": "Malware payload", "value": "dc4a53d183206f20627879ded2edcf91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652738917, "uuid": "896348d2-ead8-47c9-9bc8-146a3ff5d82e", "comment": "Malware payload", "value": "0ab6fc39f65f1c1d2196dcaa8ded12df941a3051c523d902f4e6458bd40a9e7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652738917, "uuid": "f87d7f07-d9bb-4db4-a9d1-a9401f32e5ba", "comment": "Malware payload", "value": "4106494cca5ac6914504b15a0e895cd1f4ceed0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652738917, "uuid": "332cc0ff-c842-4dd0-b5e8-ae282c17e031", "comment": "Malware payload", "value": "f11b1ae9ab55790242a51850aad5dbb8557db603a6ab32058c876083f2d684d9b5b0d939a4e6d8c6ad5528ecd4ba24d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652738917, "uuid": "5849b24c-0605-42a6-9248-b2ba208f4247", "value": "T14A62BA0B639A4379D5A10B76AD720BA64374D302BE4FDB4A6854E6163F73BC34E91B10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652738917, "uuid": "fe0e566a-a752-4c81-893d-556890aeed1d", "value": "384:WKqxNbS464Jc9KlQXa2JBeYq3U+5S3UuX:23W46Z9+3UR3XX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652738917, "uuid": "7a8e77d0-32d7-4803-be66-115ba2565f94", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652738917, "uuid": "9b5f8650-689c-4205-85c9-89183cbf1631", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652738917, "uuid": "426d2bd9-1491-4e9c-869d-691c6b1f699a", "value": "1dBpUZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0771376d-d4f6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652691369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652691369, "uuid": "7eafbd89-02e8-4711-a4af-57131941b229", "comment": "Malware payload (Loki)", "value": "4f2b5d6712ca51ba7619581acc9e6c06", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652691369, "uuid": "824ebb99-917c-493a-b8d4-be8e314ff334", "comment": "Malware payload (Loki)", "value": "0ae66057bf982b72a3dec4b4b8c57e04f8fd1633b70c73e78fb52d513fa89526", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652691369, "uuid": "74edf29d-5350-490b-a0e0-43f004c80cab", "comment": "Malware payload (Loki)", "value": "aed438c946744523fed8d7791dfb0decfe2b06ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652691369, "uuid": "cda77ec6-de36-4e49-8bcb-193dc2f9bdfc", "comment": "Malware payload (Loki)", "value": "4b2c77227c1b78354da8a5faece9b3df9e44d7aab5d12f880902d6a3ffab07bcaef9291a56518b87cd10247a42977824", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652691369, "uuid": "aa33ed9c-f6b1-4312-8827-5302c6b9bc3a", "value": "T17604029057D5D1BBE9F167312E36F72BCFEE8125A46496476330A6AC7C73280813F682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652691369, "uuid": "3a4e6eea-bcc7-4e10-81f4-9cf05b0a2e18", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652691369, "uuid": "e2c56c4b-3376-4c3e-9335-cff57fa85708", "value": "3072:LODZGPEounbTmVGkKYFMNcxlCtNCdH4rxWxw1G6ZtFu2itubVNYbpl:LOtIOCDbFM6+UdH4rx6w1rZlituSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652691369, "uuid": "eb1fa276-f034-44d4-b123-6e7a77669de3", "value": 186052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652691369, "uuid": "13bc4aee-e837-46e1-996b-57dd1e2536af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652691369, "uuid": "c58f44c7-9c7b-4b28-bfe2-9a3be10a9d72", "value": "4f2b5d6712ca51ba7619581acc9e6c06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee16a684-d539-11ec-8e58-42010a9c0032", "comment": "Malware payload (DCRat)", "timestamp": 1652720532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652720532, "uuid": "b5041e6b-c6cd-481e-a327-0d1cb2960440", "comment": "Malware payload (DCRat)", "value": "41937db442356afa8933d024ef8cc377", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652720532, "uuid": "7d5e755e-4443-4395-bf68-43b5f35692e0", "comment": "Malware payload (DCRat)", "value": "0aec2ca096ad5b30e9d542cdc96171de86ca12f0b9bc9066cc05de583adf5ad1", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652720532, "uuid": "6cc9d8b3-cfa9-4f93-87f7-6e399ea064bb", "comment": "Malware payload (DCRat)", "value": "b5917e27512afad14b67e2f456c51a95d655595f", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652720532, "uuid": "4c9aa704-afac-4758-9a5d-c529aa97545f", "comment": "Malware payload (DCRat)", "value": "b9c67754e8daa052e64e68f61c2c1c6706ea0ae07179d0cf896d66136a880adff449803fa926bb5eac6af54756682ab8", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652720532, "uuid": "38c1f637-e4db-485a-ae0d-1777ba471c8f", "value": "T1A5A5BF017E64CE11F00A1633C2EF454847B49E516AA6E32B7CBA37BE55123A77C1DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652720532, "uuid": "6d61dcb5-eaa6-4503-b939-a50c05598bbf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652720532, "uuid": "daa38e0b-e9e3-4d72-a838-7e7e1b360d16", "value": "49152:jQQcKKPKxmvwBoKRcTtwHZtpQ3QJWOBJlizZXmT:UQcKKyovlKRcTtE8fOBJlizZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652720532, "uuid": "75037179-50f9-4339-a1a8-b02352edf88a", "value": 2253312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652720532, "uuid": "ed300529-6469-4bda-b00a-942cb59f0964", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652720532, "uuid": "6f6f5d0a-a7e4-44ba-a8fd-2d016048534a", "value": "41937DB442356AFA8933D024EF8CC377.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9cb8313-d52f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652716176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716176, "uuid": "4a15aec0-adca-4a4a-9d15-ce593b1b7eac", "comment": "Malware payload", "value": "ef79d24ab226fd7509b3752cf0395f87", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716176, "uuid": "211ccdfd-f299-4626-9004-fb9d35a7aa8b", "comment": "Malware payload", "value": "0afed4e3941e0a5a74dcc0dd78c27d59368bec3de9601d5a76e5ac7e04ab9d2e", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716176, "uuid": "0eb452db-4468-4104-bd83-cbac45b1d6dc", "comment": "Malware payload", "value": "5f2fbd85064c476a64729189e45a1129a89e5d13", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716176, "uuid": "e5e59989-2388-4a96-8c0d-c3b7f0d66412", "comment": "Malware payload", "value": "4ca651eb3caae18f71c0262daabfa4bba0d1b2652dd89e743588bc8ea527d72024d2e3cda300c13d38211fbcd882eac0", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716176, "uuid": "906f886f-10db-49ae-868e-999a75a1baa2", "value": "T1F0519E282EDE1129F5F3EFB16DD829DADEEAB5B378014D4E0082034A0911A40EDD2D3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716176, "uuid": "fc0a9f5f-61d8-40f7-a15e-88bf6bdce90c", "value": "48:8mEm7XLXjYgzUmdNA3O4b2dt6BKRv4eq4ab:8mEUZ1NoO4b2HyKRgT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652716176, "uuid": "814f6281-352c-426f-ab37-68fc4faa5d56", "value": 2672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652716176, "uuid": "0a9bc810-3393-417c-b213-d216e581914c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716176, "uuid": "fca5c738-d464-423b-b9f8-cc1e1a95c3c1", "value": "Electronic form.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44e8bee1-d51c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1652707793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707793, "uuid": "347aaaaa-9d1b-4800-b46e-964175675410", "comment": "Malware payload (Gh0stRAT)", "value": "7eab6165e77fd17883f46b885d050b63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707793, "uuid": "f367ef6b-6de0-4473-b787-77d41ca831bf", "comment": "Malware payload (Gh0stRAT)", "value": "0b6c89b22573e68597c41166312f65fcccb13b218677381bff88545a8a306ef1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707793, "uuid": "4df05443-c9ef-453e-9ba8-d33aa31ca15d", "comment": "Malware payload (Gh0stRAT)", "value": "366bf7e9b9ceaca1a110032082fd182e0ce266f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707793, "uuid": "2bda6ac1-7074-4fa6-9f38-3297b421b609", "comment": "Malware payload (Gh0stRAT)", "value": "2398fd451fbcfc54ef31d543b9704c46a567f85bc92b6bae86ab436b3123285dfb346867c7f1446ac12d89fd4497b330", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707793, "uuid": "febe5d6a-e242-4803-a523-cf94267f4f3f", "value": "T198451204FDCD84E5C22A313F146F26359E66ED565A254FB36308FE2E1B7E09C692234B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707793, "uuid": "de1d0073-41c1-4d11-888d-207550b49df2", "value": "330068b13c3c0b7642b8e4c646974e60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707793, "uuid": "dcad7fe2-08cd-400a-9f2d-08601498203a", "value": "24576:z1CZ7u2lG4todQqm+NWbLrI4pCYB3FWOuCjZvDJhz9TVbizBPRy98c:RmlG44BgH9B3FdZvNVWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652707793, "uuid": "efffcbe0-518f-4b2c-879e-c83b42df6cd6", "value": 1196032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652707793, "uuid": "f1137ac8-0285-471e-b38b-bde279a6c7ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707793, "uuid": "31401b97-fbdf-4d52-9490-9201d6e2b3f8", "value": "\u70b9\u51fb\u6b64\u5904\u5b89\u88c5\u7b80\u4f53zh-CN\u4e2d\u6587\u7ffb\u8bd1\u8bed\u8a00\u5305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf80f0c0-d52f-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1652716159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716159, "uuid": "a1161e61-baf3-48e4-9add-7e903f001869", "comment": "Malware payload (SilentBuilder)", "value": "689a8b920f935e789e0ff36db6ad32ae", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716159, "uuid": "a3e00a87-ff03-45a0-b3bd-9e65c074b8b5", "comment": "Malware payload (SilentBuilder)", "value": "0b7fe3b69d2dd07737c1da3bea7b3042cab67aaf9ca02ca26e0b349ce5d3ca06", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716159, "uuid": "360bf0cc-bdb2-411e-84fe-2bd0b80a86d0", "comment": "Malware payload (SilentBuilder)", "value": "335de9dca5e54f7e2858577b742aa80a94dc2ec4", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716159, "uuid": "d7e5ab60-2713-40e1-8214-7392341d5219", "comment": "Malware payload (SilentBuilder)", "value": "daf6d786c170c74cdf280cb92b13d9738b2f86443373366b9830f04269c43684fa8edbb014d395e31003eaebd33dcdaf", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716159, "uuid": "5e520fc4-ca14-4be0-b10c-20901f81477c", "value": "T1AA734A4AB98AC96CF611873949D747A9B313FC110FAB0B8B3509F3627FF49A05A0751B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716159, "uuid": "5b8edbf4-f317-4888-8dee-7147cd631827", "value": "1536:tpKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgCAezwrMCtvJecvRtbu0j5m:zKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652716159, "uuid": "4e7770cb-8a97-4560-83e3-cb32594e786f", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652716159, "uuid": "a0fafcfd-8624-4428-9c93-e2fab437bc0b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716159, "uuid": "e3b40a46-7c4d-4e3f-834f-3230bf92894d", "value": "10011376568842023932551.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a3b9e8-d507-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652698937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698937, "uuid": "75b3e457-ca16-49db-b1b4-96cc9952fc29", "comment": "Malware payload (Heodo)", "value": "28d104ff1166fc575a3b214b4a4667a9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698937, "uuid": "e96ed49b-6fd9-4c68-a688-fccd40cea88c", "comment": "Malware payload (Heodo)", "value": "0b9be510ad2772d7afb72fa49a910fd344c9ab35b2a83319422aa24c6e4c34a6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698937, "uuid": "3cb8e94e-8ccc-4f48-b62b-f3f8b249933a", "comment": "Malware payload (Heodo)", "value": "b8ab34df5511a22d6ea7ed28380d21ef88986e1c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698937, "uuid": "698a1d3f-1a51-4e56-b802-65260afb6051", "comment": "Malware payload (Heodo)", "value": "d4f9a1cc3c700dbdb078cee652497f5f0b476bf4b192fd02149522900547f497769bfea7f706a2935230c5b343f43b11", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698937, "uuid": "c067bb5f-6d84-430e-a36d-6d3a0b0cd580", "value": "T191055A31EB6C8492C6A3553D88A34B06EE7AFE940B6183CB12A0733E9E777D45C35671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698937, "uuid": "2aa5cc8f-0794-4f5d-afdd-88216b4d64d4", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698937, "uuid": "c0b12b28-6c87-460d-bf02-a609a834797b", "value": "12288:BeI3xgoz0/7aG8GkZHFT1Yi5a8kL37eGfv37:cYOozAWGxGx1Na8kLqGff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652698937, "uuid": "25bbbbe9-7c26-4905-b72f-6d05906b0da6", "value": 800256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652698937, "uuid": "c4eb1161-0498-4bfe-8a36-a71f2e06b9b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698937, "uuid": "884d1814-288b-437d-9390-20a7b06276c1", "value": "28d104ff1166fc575a3b214b4a4667a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05326d0b-d4ff-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1652695231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652695231, "uuid": "340232cd-40a0-4a4e-9ac2-d0a03a3fcdc8", "comment": "Malware payload (SilentBuilder)", "value": "2a4b3032c069044ff20337fb680c36ea", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652695231, "uuid": "bf2c9b9d-11f7-4662-af8f-1778a14abf27", "comment": "Malware payload (SilentBuilder)", "value": "0c260a047fd09a204a82e7c439c3b60d83cae8caea6f7592b777fa0b2caec634", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652695231, "uuid": "2b500bed-2b4b-4b27-96d3-275c63dde369", "comment": "Malware payload (SilentBuilder)", "value": "63e773790c594a7d6801ccb3d4b7679b66702fe9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652695231, "uuid": "2c07d222-3735-4d51-9294-7cd2fdb4aeb9", "comment": "Malware payload (SilentBuilder)", "value": "6d41590ff135ef029b2dc4827c18fd3e9ede5224ea76447f24ab41e7b64e6f1840238ff58509ed92a3ed28f20aad2fa1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652695231, "uuid": "2ce911e8-b15b-4e1a-beea-d606a9feb418", "value": "T1BE734A4AB98AC96CE615C739499743A9B313FC114FAB078B3109F3727FF49A05A0761B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652695231, "uuid": "c64ae0fb-141d-4bf6-9158-2ddd275b699e", "value": "1536:tpKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg5AezwrMCtvJecvRtbTNFo:zKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652695231, "uuid": "ce12d290-1006-4649-84c8-416140112de0", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652695231, "uuid": "c8238c45-cb76-4237-9a03-479431e112dc", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652695231, "uuid": "ac852ab1-a94d-46b4-8064-0075d623f7b3", "value": "documento-16052022.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eea63bbc-d506-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652698629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698629, "uuid": "fac20abe-5b8d-4078-a3b3-1b80aaf6b457", "comment": "Malware payload (AgentTesla)", "value": "29aad7ed71320b5292c1c490ec322aea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698629, "uuid": "fbdb663f-cb2f-4ef2-9157-3a81a0bb6b28", "comment": "Malware payload (AgentTesla)", "value": "0c75e4a35a5750558b331c46f7d0ffe945c989b094b8bad5e5050bf4ecc2db4f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698629, "uuid": "bab00db9-f682-405e-aff2-0bbf93b5b385", "comment": "Malware payload (AgentTesla)", "value": "f7cf0e4ce17eb62db655989bff51548fdde1346f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698629, "uuid": "9a8c6c0a-a3bd-43fd-a442-fe8dabfb21e1", "comment": "Malware payload (AgentTesla)", "value": "3b67f7158b249c5155c03ccd62508682021e9bd3ef6c419f5895602e30c37e423986708c37e2f1ec16d9f22003aeadcd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698629, "uuid": "e0b14f95-61d3-4ca2-af8b-ca7f1474211c", "value": "T171D4E0AC325476EFC8ABC5768E591C64AB2030BB931F9207946751EE9E1CA87CF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698629, "uuid": "92083787-0fa2-4008-a1f1-b092d3a243b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698629, "uuid": "f3a924a3-81fa-4e5a-ae5c-c448d4b065a6", "value": "12288:QVFO3Gbod58H5nEU2v9/Yoxa+SJVgCfVfmeHNs7WLwGm7/Hs4cu7W6illnSdiJxp:z3yH5nEU+5YnbXvfVfmeH3LPm7vNpSDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652698629, "uuid": "a821e4a2-5224-4e54-9229-bd28421629b4", "value": 625664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652698629, "uuid": "ffd1b78e-8e7e-4b41-bb86-f2a69415bf38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698629, "uuid": "58929d16-1aca-484b-8df1-66a08d6efbb5", "value": "DHL-AWB6878628680.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ad6f25-d4f0-11ec-8e58-42010a9c0032", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1652689084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689084, "uuid": "ffa2847e-196a-4d91-b265-f9985a790a07", "comment": "Malware payload (ArkeiStealer)", "value": "ba041a9fc41225152308162ac9073707", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689084, "uuid": "a48d8b58-581f-4022-80df-69841cdc833b", "comment": "Malware payload (ArkeiStealer)", "value": "0d5bfe99b0e343aa66584a28af6000c39f8b9aacc7f304d13b7e2a8cc31d16eb", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689084, "uuid": "b91b6c5e-9f9f-43ef-859e-59f6b488f0d9", "comment": "Malware payload (ArkeiStealer)", "value": "2a4622d6e4974d71862b3976309d38d51603052b", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689084, "uuid": "9745c88a-95fc-4b73-ad82-2a31c978d6c3", "comment": "Malware payload (ArkeiStealer)", "value": "792fe25498948b6936625bb4b916b3f164e5870d77b838b0c8a28b951cbd5720df6b70c10fcc8476bafb7a0ce540a1b0", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689084, "uuid": "fdd6ef5e-d46b-40e5-a6cf-a322b208d542", "value": "T139D5D0BF9705D81ECB433475859F92A25002B671690FB5935F847AA9D32B0CEFF22B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689084, "uuid": "03eca510-19b6-4120-a48e-10d1e9eeeb97", "value": "37a87ba4c777dcd1db50684f6b029f1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689084, "uuid": "dc4d7e29-5aaf-487b-bbd8-20a3119c00b6", "value": "49152:3WyTwJ2fG+yThQNqBG5GcjvlIDvXZW1Q0WjVX3+RINaHdNnOV1abkRFtPu+mdMmd:3WyTwwfry1LG5GcjvlIDvXZkQ0WhX3+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652689084, "uuid": "2f9dae62-b19a-4fe6-9b32-04b81d7471c2", "value": 2805688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652689084, "uuid": "f79f5732-0759-4295-ad6f-304891be7e78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689084, "uuid": "fa2139bf-d77f-480f-97ed-6ff72d849b37", "value": "0d5bfe99b0e343aa66584a28af6000c39f8b9aacc7f304d13b7e2a8cc31d16eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd5ec133-d529-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652713605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652713605, "uuid": "cded5aaa-cdcf-44d6-8b8a-aba42da108db", "comment": "Malware payload (Loki)", "value": "4e1ea6968374c2122d2fe747e4bfbb79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652713605, "uuid": "e21bbb96-61f8-4ee3-8695-f09b00de5e6b", "comment": "Malware payload (Loki)", "value": "0dbfd62347f3cb216a4c4716ad199de9dd7bd99b3c5c206dacc17641d64ffe70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652713605, "uuid": "c49748db-bf3a-4efd-970c-5c5daa4d5de0", "comment": "Malware payload (Loki)", "value": "8bfa46a7cd9ad56989c9903311543922f2bc2347", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652713605, "uuid": "cc2ac233-4642-413a-a76e-f9e04e566f35", "comment": "Malware payload (Loki)", "value": "24f3bb4c772bc6770fda445400d74d616d0342bfe477007c7043338f1ca6fa1ea1f16d26b5b2548e00bc0c7e83cf45d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652713605, "uuid": "8ea774e0-f208-4e50-9add-bc75a790e92f", "value": "T1C684F15096A0E82BC97643B2C51EE3F4AAF85E8DF100DA5387E07DBB7E76651D8C81C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652713605, "uuid": "d46d701b-a49b-42f4-9803-de25290be991", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652713605, "uuid": "b4b889c6-ff86-4598-a863-ccff9a951fe0", "value": "6144:BOtI1QQ0W+GDK5mJy3d+9W2i5I9Om/1JqdZ6sH5jq16ASN1D2u6KckNKbQuoDLqX:BOGrBK5CaMsH5OA5NlLu3MuoDLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652713605, "uuid": "eb7eb442-81a7-4eb8-81e5-d306a514ac5a", "value": 392129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652713605, "uuid": "861da682-9d16-4d76-bd99-32e0abdbb518", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652713605, "uuid": "02de8d4a-5b54-42bd-a903-d2f9fd31e413", "value": "4e1ea6968374c2122d2fe747e4bfbb79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8144c41a-d4b3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652662797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662797, "uuid": "e15ba288-beae-475a-8c0f-690ce130cf92", "comment": "Malware payload (Mirai)", "value": "06c0f8d039eee10b88a33a94ffb775b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662797, "uuid": "408d8c62-ed53-4d4b-ad6c-363b163653db", "comment": "Malware payload (Mirai)", "value": "0df715cdaa691b19f3e8857dc6a038f3a73e8c4ee094d4efda7c2f2dd72e6ae3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662797, "uuid": "f0d53712-57b2-4f0d-b162-620939bab13b", "comment": "Malware payload (Mirai)", "value": "d301b5226989ce53175cb55a7e76255b02bb713f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662797, "uuid": "ba4e0429-9d0a-447a-91c8-63ad50778554", "comment": "Malware payload (Mirai)", "value": "73e6fa84980342123df776ced50986c11cccdea27c4a1a827d6e1a3588d10cc3607f41eccd0e6695d898573b66fb1a6d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652662797, "uuid": "b465555e-f8d3-4cec-b1a6-bd9d4e718474", "value": "T1244307C17881A626C3D05377FE5F018D33199798E0EA33568C295FA47B8AC1F0D6B74A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652662797, "uuid": "b95779bd-854c-43f2-8da0-7f8a0ac6f430", "value": "768:K/9qJEBv+zFvDLtU07KuucD056SRmYKrI4ekVrZBfV7ZKbwvTLwCVy/rCxHghW1A:Kq+WFbpnJYKrnj7ZKEShW5i5m//zqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652662797, "uuid": "395301a5-80a4-46f7-aea5-4cf6c29701b2", "value": 56332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652662797, "uuid": "a88d7c11-5892-4cca-8b6e-740bf6fbbc00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652662797, "uuid": "9d95fc98-7940-42f7-98bc-238e3846a76b", "value": "06c0f8d039eee10b88a33a94ffb775b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c22f57-d4e4-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652683843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652683843, "uuid": "742d4f7d-9358-400e-9ebd-32cba3ad57fa", "comment": "Malware payload", "value": "fbc6129b05dd93d85a9b6cbe68280623", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652683843, "uuid": "42f30f9c-29a6-4605-adf4-d94244648eaf", "comment": "Malware payload", "value": "0e505a2018bff80d51d361d46cba13856d0755a5aa020b4f154ad756f0fbdeab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652683843, "uuid": "d10c5159-1284-45ef-8b01-43ccf42d4c2e", "comment": "Malware payload", "value": "9c3ab91bcea1784d89ad80e60b47c7d677e2c4b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652683843, "uuid": "4e7b9369-77da-4807-b9bb-d2a9f7c42f87", "comment": "Malware payload", "value": "b28281d831890309adfabe39e2e2cab699ff40b208953bd664037537c99b28a980ef652916a785093480fcb6d2128e23", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652683843, "uuid": "24dfa314-9c92-4110-adfb-6a946b21155e", "value": "T10C92443EF28B8F9CCB07C294110A3F861668F94C93D994D2A7BCE7346A4596FD722534", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652683843, "uuid": "eb77c79d-18f2-4ebc-bd85-6148507a7d35", "value": "384:J15ZGPuU+NVKdRPjIDEeeMzEKoqjUJcklbhKreb6m6vE:JjwPL+NvcMzPoqj2ckVV6m6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652683843, "uuid": "7708196b-af01-4cc0-aedf-94f44e948bad", "value": 20475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652683843, "uuid": "35a99ccd-3200-4238-b1de-1c92411c711e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652683843, "uuid": "8b49f176-d213-40b1-9bda-8410632fa16c", "value": "Quotation for 472412-1.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b6ac0a0-d551-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652730701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652730701, "uuid": "654763a5-9b88-4b68-9a76-74821be629f4", "comment": "Malware payload", "value": "451f8d0a1a76d9cece4a1368f637412d", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652730701, "uuid": "d055829e-2f98-4cac-85f8-2487181e22fe", "comment": "Malware payload", "value": "0e701ae54a4756ad5a19d08d80dfd297d1c3bb50e4b18be79bec88eadc24aff2", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652730701, "uuid": "76733b2d-dbb3-4028-8a04-d4eb4f878028", "comment": "Malware payload", "value": "ef8f92773a509a935ed12c13a137959c10bf4c1a", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652730701, "uuid": "c41137af-6fca-477b-9845-5614774daa76", "comment": "Malware payload", "value": "a2e9851f27750187f2f796bee49693fdbe00fe3a0aa34ff4753c4760b0c0311a673e51521fd4f35b530baea0633a99d2", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652730701, "uuid": "8bec251a-d117-4eef-9005-729538e5cd12", "value": "T14B8533103CE5A5108940633160F595ED2FA87953B85AC45FBFB1C5BB5EF03A2E3CA8AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652730701, "uuid": "efc8e002-19cf-4844-a99a-de2c800117bd", "value": "49152:JW+4KXzWYUAzrVi+MamnMo6BTtlRx1bknE:AsXEAzrIBMnBBbD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652730701, "uuid": "4c2893f0-09dc-499e-9af4-fc0f1bf52ce3", "value": 1736714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652730701, "uuid": "05bc2016-fde1-4ea6-9cc4-6f4d5b2ca9c7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652730701, "uuid": "1b41db86-4f30-4f8b-b783-9d175ff58173", "value": "Packing List and COA.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53336d56-d50c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652700945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700945, "uuid": "7fac3653-30f2-49ed-8293-a01f71daee20", "comment": "Malware payload", "value": "573456f537ad7b3e105a2b11b0945120", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700945, "uuid": "2037a8b4-ff1d-4b67-8c9a-e38913d65cd9", "comment": "Malware payload", "value": "0e96b9421e48e190463073a6837ed7e1c240dc9754cc2d4c3077cbe187872a37", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700945, "uuid": "09b6ded0-f0f0-4a47-9c76-367adb0c151d", "comment": "Malware payload", "value": "fe2c271af13331f93890b673ad4709c4b14ec484", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700945, "uuid": "fe533928-aedd-4895-8ef1-c15d75083075", "comment": "Malware payload", "value": "30fdf105d8f42d34f1b0bc67364679423171794d74a455c33e0edc7c7a19b948b889d466d18205b1010063ed775eccec", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700945, "uuid": "4430cee8-a7ec-4e92-afb8-3628df74a5ea", "value": "T14C167C23B244B53EC4AB1A3A9937A758993B7A303926CC4B57F40D8C8F365407B7E647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700945, "uuid": "9cd189cf-b35c-45d5-a0e4-ff1ce4745dfc", "value": "49152:iB82b4500huXNptwsBiSyzYDqc8jA4oIGNo/BRTadqFrkOglTGiNRynOYLEA:z2s5QxIk3No6dq9kOg7NonOYAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652700945, "uuid": "f9447d89-28a1-401f-b79b-074bb804edbc", "value": 4107776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652700945, "uuid": "fc90c9a1-3aeb-476c-b943-286114c4409f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700945, "uuid": "5e24bf5e-a6f7-4b45-92f9-15dd2c46b32d", "value": "Archivo.Carrefour1605.MSI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c10d1fd-d50c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652700879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700879, "uuid": "5941b0e0-94fc-4316-b241-7781e26f95d2", "comment": "Malware payload", "value": "f0154b8aab7bab6b91a5c787d66fe0b9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700879, "uuid": "08cf4db9-5adf-443f-b833-f2078f39e357", "comment": "Malware payload", "value": "0eaf2f83fcd16fc9c7de348835a3671327191617e8b9b8a2998c3ea8ff866cee", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700879, "uuid": "7bfedaa5-1eab-46e0-a0b0-ae3e8d28bd17", "comment": "Malware payload", "value": "b9ab74c5b71a9bccb3c241980e41d5f97e0036c2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700879, "uuid": "f8a5628b-befc-40cc-8347-61360abe5e52", "comment": "Malware payload", "value": "c324f7e8a91d59695870a67562333c7ed938652a8ffa22c193068787b2c3d3998a190e8b61b6fcc60f6abf8652a10844", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700879, "uuid": "89d54b94-8ed1-4a67-94f8-349cc9eaed95", "value": "T148F3ECE01583D9AAE4150F4A55D8F7268E333742D0DC2E71FF27A9689FD4602B2E908F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700879, "uuid": "12163790-e12b-4742-b43f-ae01d595dd6b", "value": "1536:Kch6dtRGWbCtpl5kmrJ//RFxXxBpzB9TBtiBqK8Qf6YXkY0kY0kY92i3e+6fw5bV:iMy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652700879, "uuid": "b9215146-b65e-43ac-a952-21c69dc510ff", "value": 157994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652700879, "uuid": "8d95d46f-857c-43eb-a11a-44dbb0001775", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700879, "uuid": "fbee5045-5dbf-42c4-a810-89e1a83f9076", "value": "PI3994892.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1363b75f-d50f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652702126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652702126, "uuid": "34cdfb00-d143-4638-add3-80f44d47c30f", "comment": "Malware payload (Mirai)", "value": "e94958fb5d8da1a7d544c06d4632c846", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652702126, "uuid": "0933ca74-e7e5-42e3-a98e-46a414119c75", "comment": "Malware payload (Mirai)", "value": "0ec1ae5752fd6770b25b0e51d83503cf758b5b84a1939dcca1eef4d9ad50b4a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652702126, "uuid": "14170761-0558-4504-a208-51112c34bd67", "comment": "Malware payload (Mirai)", "value": "f66479adc6f036533919b6155a7e310cf4f07928", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652702126, "uuid": "e4b10df6-8fc0-474e-be40-94b197e5826a", "comment": "Malware payload (Mirai)", "value": "b13dce1fe6cdabefcf17d22134a37900399a750969610cb0507a0a6b011772960b2366744810e5addb1fb4b1756c23c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652702126, "uuid": "8c3d2e7d-70fe-4e9c-bba3-e16cd282992d", "value": "T1B583AF72C16C6F2CD2044AB47961EF368753A40083AB6FF79999C7666443DACF6087F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652702126, "uuid": "4d2c5b67-4a38-481b-add0-19f34126f499", "value": "1536:KVyy0IgITcOFkcwo82Kq6pkILtHhwxeK82WDyG9ECl9n8j96:OynQLD/6pkIxHhwxR8d9EOcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652702126, "uuid": "985eacc5-ad11-42f0-a73b-999d0c8fd598", "value": 81308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652702126, "uuid": "7cf2b51a-fe9b-4fa5-82ce-ab559ffcc2a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652702126, "uuid": "c3638675-abd7-4599-9b02-4e7d95114d1f", "value": "e94958fb5d8da1a7d544c06d4632c846", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2a4d0d4-d540-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652723412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723412, "uuid": "b70deb6f-681a-4fe9-8a40-c35e62fab932", "comment": "Malware payload", "value": "26eedd79810ec6b40870da6a9d3e1336", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723412, "uuid": "50cefb61-5cf5-49ee-b369-79b6ed7cb5ec", "comment": "Malware payload", "value": "0f58ea0d132c1d3a829432f5a8b051ab72ae01e9790096e1f98af52cbd969d3b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723412, "uuid": "a7abdc78-38e5-4edd-b560-c29eaeadcd80", "comment": "Malware payload", "value": "129cba4a1ae39ba858c292a2921b1997c975ba3a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723412, "uuid": "30e70903-60f4-4b3d-94a8-5e75eb8df152", "comment": "Malware payload", "value": "e65d3fa3440955384bdfec71584551fd0309bdc51c9818dfd4c852040feda5cafcf5690e7cf6e698415de69c58383e07", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723412, "uuid": "4cf96a12-4704-4334-9a8f-fedf12cee017", "value": "T15D8533ABFCD7C161EE8BB43AD70563836ABA4158E14DF9AB47F610B468D2D10A707D03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723412, "uuid": "b383a4ed-cbaa-401a-a67c-fde1c56988ed", "value": "49152:8k8BXZk3YPYF1/+m3Ux2z10x+t+zoh7UXR1:8RiYQbm8UIh7+zkUh1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652723412, "uuid": "aa1ce895-98e0-48c5-9b34-5c2fd3fcfe8d", "value": 1792415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652723412, "uuid": "787e0730-be23-48be-a7b4-51e6c813e901", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723412, "uuid": "1a67974a-a9e4-4416-94e1-d61649257ffd", "value": "eblagh.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "795f9a86-d4ec-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652687265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687265, "uuid": "c33b440d-1efb-4b3a-a00a-6a08a5524ece", "comment": "Malware payload (Mirai)", "value": "21fa6a0d76b65a0ae307368e47e611ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687265, "uuid": "b9171c94-87f5-413a-846c-118158b564bf", "comment": "Malware payload (Mirai)", "value": "0ffcbe2915d683de95b4165f4a48f4b8ecc26628e122f5660d850dad316b955b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687265, "uuid": "3040e82f-fe11-4c4a-8072-1449d8588ca4", "comment": "Malware payload (Mirai)", "value": "3baeb1a8e38864e14bb074bdcaa27a4c016b2893", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687265, "uuid": "82efa14e-215e-4a26-93e0-00d546b22183", "comment": "Malware payload (Mirai)", "value": "af5be79c730caecb6e0ec0f25e33552633876cd72d631e7fb044f3269c36f9668e21f08fe94e02b3e32bc75737975854", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687265, "uuid": "abe5dd4e-cd58-450c-8bda-63fc5c433f01", "value": "T1CFC2DF8DE0F4EECFD65C29FDF16603B1AE4CB05152478BCD17404A85B2A8AABB15E4F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687265, "uuid": "b09bd43e-9f5b-4b4f-9e38-ce8c9d9dc904", "value": "384:BtsizZ9XBGbCcjEdC9/m0NSmtIorNAMxZkplUdJe9uSVeFvsQxFnRWGVCz0Nv/z:Bt5Z9RGpjfe0NS0IQ/ZOUTMuFFv3Wu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652687265, "uuid": "38b92ee9-d43e-4871-9f6f-fe41b9f2f15a", "value": 26272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652687265, "uuid": "1f6ece96-9609-46fd-a558-8071866cc833", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687265, "uuid": "37136292-56e6-4da7-ab26-013ab6780135", "value": "21fa6a0d76b65a0ae307368e47e611ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc76552-d4d8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652678686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652678686, "uuid": "4ce18536-c010-43ce-92ae-bb7778e1f21b", "comment": "Malware payload (Mirai)", "value": "7a012297c6c05168d4deea5a35f47491", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652678686, "uuid": "f7aa01cd-70b5-46d4-8770-5a2b2dfeeed3", "comment": "Malware payload (Mirai)", "value": "107bff729cf893fe24c82fb09619735371d3162e727d6a97ff0aced1b6a6f54d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652678686, "uuid": "34e3190b-9f0b-4cfd-ad40-788bd5bba151", "comment": "Malware payload (Mirai)", "value": "c351948fda46c23ea3807cf73acff46564f1afbd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652678686, "uuid": "902612c5-0e50-441f-bb28-fcd79bd06e0d", "comment": "Malware payload (Mirai)", "value": "07b196423049f9dbbb8be37340b76ae4210ea91472bfb23d06aa88e7e1742e2cd1c65e87d0cf69e5b285d882f69bc579", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652678686, "uuid": "0122844c-e20a-4be6-96cd-133d826c2422", "value": "T1CFF2F110C7069DC686712CF6B49A434B354A2F79BFBDB6252A5E12AC02B341E29F85C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652678686, "uuid": "7b4dc3e0-3376-4fe5-af82-4182a1a13fca", "value": "768:Q/6Qx5nndnORX2xHawZP1Je61UWYodJz0qc9q3UELj/:Cv0RmpaGd1jYu0qlLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652678686, "uuid": "6214eed2-aaaf-47e1-acc9-4b798cd199f7", "value": 34372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652678686, "uuid": "98125868-ac32-4e74-9792-0c37167dc3d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652678686, "uuid": "1e9b840c-b47b-47d4-bf6a-ca467ff5cf0c", "value": "7a012297c6c05168d4deea5a35f47491", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa836b0d-d4d3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652676610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652676610, "uuid": "ace7f6ba-f3eb-4452-9ded-a7939dc0060a", "comment": "Malware payload (Mirai)", "value": "7f9be1ce8ff2f31cf123b030f232f837", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652676610, "uuid": "cd63e836-18da-4bb6-b906-e640fa511e05", "comment": "Malware payload (Mirai)", "value": "10a9f3a86a783c10c6c32854c2a53eb7706c39d8b161ff6121dfe2dc7abaad06", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652676610, "uuid": "ceb30aff-5985-4d2f-b3b2-ee48a9a5696e", "comment": "Malware payload (Mirai)", "value": "7ca86c4398daa7b8431d37511036a73446d87212", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652676610, "uuid": "d2425d95-2da6-4b21-8e4b-a9b8667a4fb1", "comment": "Malware payload (Mirai)", "value": "9f62a28c73c8b3ee5195c0b55efeac37f2864a3a5631f7f3396ce95f20898c85ff59abb9f2aa77f216f309858a652aa3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652676610, "uuid": "3a37cf4a-f7eb-489c-8ffd-a85d99055023", "value": "T169D2E13B367BBE37F829063F59DA892B2608EC5F9F6F165D8B00480B74798C16562DC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652676610, "uuid": "904e2d12-59ff-45a5-979b-4a50890a7ad4", "value": "768:ajEryfqZRpxoqf4gt40TZJp7SU91EqrLs1K1D5kW:aj6yfqtx3QN4Zn7x1zvsGD1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652676610, "uuid": "65fd0096-2e02-4e80-bf2a-23ae784f0c4d", "value": 29804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652676610, "uuid": "6d8460ee-0f41-4bc6-9b9e-424455f259c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652676610, "uuid": "dd8fdfc0-c959-477a-8d05-92f213177d00", "value": "z3hir.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dedced4a-d4f4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652690871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690871, "uuid": "f1cf6dca-c6bb-48f2-a5d6-2a551a099ffb", "comment": "Malware payload (Heodo)", "value": "b9ab9c808b47e0d8add5bbe672b3ca62", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690871, "uuid": "f0008265-836f-4680-b66a-7ea4a6bbc6cd", "comment": "Malware payload (Heodo)", "value": "10fce827ab211509a193b3759b1f9998f2982b40255488736cd1eb59cc9347ec", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690871, "uuid": "0acab7b9-aa42-4a29-8b5d-bafa86d9fc4e", "comment": "Malware payload (Heodo)", "value": "bef2ad04dc659213e8c919a3f089c705304f206a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690871, "uuid": "ed206c2d-b289-4c9f-a7a8-eac7ed44278f", "comment": "Malware payload (Heodo)", "value": "03316c23c5a6a4f97a8197e409b53cfcde93253bf604829636b0f60cd9ea13747a4bbf8fc6f0b1f21ab95dba137780b3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690871, "uuid": "b60bd81a-bc54-4bf1-b1f6-870637f88221", "value": "T134055A35FB6C8492C6A3953D88A34B06EE6AFE840B6183CB1290733E9E777D45C35671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690871, "uuid": "2ea1b5ff-cca2-49eb-b2d0-04955c5cb0eb", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690871, "uuid": "6042df24-6398-412f-aa03-9f64e465bffa", "value": "12288:Q9983xMoz0/7aG8GkZHFT1YicDAXmvQaZsbNg:A9UOozAWGxGx16AWvVZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652690871, "uuid": "9cb635df-2dea-49a8-a843-fd1d0afe1592", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652690871, "uuid": "df4b624e-f1fc-4be7-9bcb-df672f0f9d8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690871, "uuid": "98163afc-33ff-4537-af6e-8613d7a3eac5", "value": "b9ab9c808b47e0d8add5bbe672b3ca62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdf2e418-d4e1-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652682656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682656, "uuid": "87593c17-a5dc-40ed-ad0d-cd40386c0fd9", "comment": "Malware payload (RedLineStealer)", "value": "b3f98f7667e4e3f1de7473b6fa005ab3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682656, "uuid": "8f34a3af-53da-4f5f-8b02-306009652ade", "comment": "Malware payload (RedLineStealer)", "value": "114fbb0c82a2027da02fc1b88930598a667c6ebf4bcd764f6a4a83dd3c5fd40e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682656, "uuid": "a91063ab-6fcb-4aff-aa91-e5ca999f4b19", "comment": "Malware payload (RedLineStealer)", "value": "7b7b7c26239105f455ec902e10c318926c1c6bc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682656, "uuid": "c7ae8234-bdfa-47c1-8e1b-e101bd2c3ba2", "comment": "Malware payload (RedLineStealer)", "value": "26e543a04faaffe24b8859fc459a3e14ba578025db29ce45194327449c6ed690c12cc131eba950e02ad7b696b20e81c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682656, "uuid": "90cf2794-dd0e-4cb2-9b3f-cd6bfaf0c11c", "value": "T11564AF4074C6D033DA76183805F8E6756A3DB9501B205DFBA7945BBE4F30793EA30BAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682656, "uuid": "65840d3b-902a-4d36-9c4e-f92295bc60a1", "value": "c0864c9bc2a9439a8dca02c3a6407cc4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682656, "uuid": "59409a74-6514-46b5-9b09-b556e9de450e", "value": "6144:l1GsH43SwsfjZ1MiDZnPoAO6Maacbkd8p8cV4n/3iuc/G:lx4i5fjD5o8YXvnqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652682656, "uuid": "b4e7b955-8b33-48aa-bfd6-41881231622a", "value": 311032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652682656, "uuid": "bff23f2d-1df6-4a2a-bcc0-8f1cc9769797", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682656, "uuid": "7258e989-1ec4-411b-b3fe-a7b47843497e", "value": "114fbb0c82a2027da02fc1b88930598a667c6ebf4bcd7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "601d12d7-d519-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652706550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706550, "uuid": "89113786-d13d-4891-8d79-c5193cefbf90", "comment": "Malware payload (AgentTesla)", "value": "7ab445dff1a86523b4f6ebd47a227476", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706550, "uuid": "97b43d98-4b9b-499f-b043-270c21e14bf8", "comment": "Malware payload (AgentTesla)", "value": "11aa1387d6db581a617c5dfe9bab342d30f31b07ffb477e330ac491ff9226e66", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706550, "uuid": "2298a82d-364d-4b96-8edc-710475c438a8", "comment": "Malware payload (AgentTesla)", "value": "1de6c4b436e06969bf65b81da932c28b29bdf009", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706550, "uuid": "a193e434-e65c-4ea1-bd31-6fedda33002c", "comment": "Malware payload (AgentTesla)", "value": "ce5e43c1574cfd9772a4e94243b9debb83de9e4ec7ac4b179c6da5d804ee8c14ffaeb9e11f6600eaff416d722e753eb0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706550, "uuid": "d08da27a-5262-48eb-924d-736ec37af0d0", "value": "T13173E466F2774115C5DACA7FEBF18580ED10B97C490DCE82D1486F9E1AAE25209F0EB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706550, "uuid": "31b17304-ed76-40cc-9cd6-d54fab3612cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706550, "uuid": "59c08ed8-a461-49fd-8584-daeab60a7b66", "value": "1536:rQYqxQAI5OVvvdY7b31lZREem9gs5LSrGh+cjG:iYOVvVGb31fW2s5YF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652706550, "uuid": "59dbb2fc-678f-4cd8-81fa-074bab663b1e", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652706550, "uuid": "e9c5d4e8-d321-4a9b-a0d5-6638b86c6b83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706550, "uuid": "b834f4c9-9fdd-490b-a61e-9cb37f59fb72", "value": "7ab445dff1a86523b4f6ebd47a227476.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d678dc19-d4db-11ec-8e58-42010a9c0032", "comment": "Malware payload (FormBook)", "timestamp": 1652680120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680120, "uuid": "6fb4548c-e136-4ace-bcd4-3ae77de670ca", "comment": "Malware payload (FormBook)", "value": "48ff20877efe9407c7b6e1215cbd6523", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680120, "uuid": "3ffbe6f0-7fa7-4aa1-a0de-615fb92fb4d1", "comment": "Malware payload (FormBook)", "value": "11dd00b072a09a1fbb102e92ed096edb02f0dac02a88a690666873d4bcd2c515", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680120, "uuid": "a07a0da7-920c-42bd-8b3c-c164ea6c6eeb", "comment": "Malware payload (FormBook)", "value": "c44196b0b3aec567fff47b2a35958dfa093af6dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680120, "uuid": "a769f609-7d1b-4612-89cd-44f5706ed4f4", "comment": "Malware payload (FormBook)", "value": "12d73f81d69357a8f5c2b771bee37819634120f1d5d9ab33255e1457ba0f2d2a575c2dea3438ff3b6ec3a3ffe5a0242d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680120, "uuid": "52474663-7205-42d4-a05e-e1b7bd4224d9", "value": "T1D9B4124477FCC269E67F37753A3604211279D4658822D72E7CD2A4EF2D72B844F80BAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680120, "uuid": "ea9915c0-e60e-4144-a1a2-045953214ce8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680120, "uuid": "994bef8c-55f5-4d18-93c2-e19286eaf698", "value": "12288:0XD72EwG4N3t83RSbR617CQqGkHCmo1fCHa41iUspANuQr1:0XD6EP4N3t83QbR8mNGkHDo1fCHpiUEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652680120, "uuid": "c8bca2eb-9e2e-4349-bce0-3ed1b3d4abb5", "value": 525824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652680120, "uuid": "f533810d-ff55-4a00-8371-8ec8ceaaebf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680120, "uuid": "a544a09b-b596-4de3-a6c1-443907849fa9", "value": "temminition-Luke from ZMS Cable.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52411753-d4cc-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652673456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652673456, "uuid": "4ecabf80-f68d-4136-8649-a82965e55040", "comment": "Malware payload (AgentTesla)", "value": "0d7db1febe925dee41c0bd8930787772", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652673456, "uuid": "30060025-d216-4f92-a32c-b2fd9b6923e2", "comment": "Malware payload (AgentTesla)", "value": "126fbeb2bdc2dfac5b7b62ca004930a912ae5f3cb6171173b5bf1c92e0e18359", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652673456, "uuid": "4e537302-8a46-46e8-aaa2-8519babd1138", "comment": "Malware payload (AgentTesla)", "value": "6fafa16430ec0309d6f4d312e686d5d67c3140d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652673456, "uuid": "bffeb369-e951-460d-a217-aba907ec4ef4", "comment": "Malware payload (AgentTesla)", "value": "de5c835dffa1f15c43a6725c128b2cf7d35edcf0395716e048c8bb84485783fc98c5dbcbfe72f6f9b2529f3c6ea0e941", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652673456, "uuid": "9ddf3735-7050-4933-b1de-42aebe2df002", "value": "T15225BF62A1C4D659DF2A32F2DE9E8D3122A7BDD90052D25BA17A33B54972317DC03B0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652673456, "uuid": "e27ac813-fe21-4187-a00d-80c7bbf3274d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652673456, "uuid": "fa9e6f73-043d-4a64-96ea-7eda1b2639ba", "value": "24576:uxPZKAC+6OKpLeoP0MAfkxsBwoyGKnzRLs5KAC+6OKpLeoP0MAfkxsBwoyGKnzRd:uPZKAC+6OKpLeoP0MAfkxsBwoyGKnzRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652673456, "uuid": "1ef93308-43c9-4e49-91c7-7cbd2ba0a067", "value": 1011200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652673456, "uuid": "1eb5e3dd-dc2f-4a8b-89b3-31597d4e385e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652673456, "uuid": "72241832-4ff4-47d9-876e-da0484e3798b", "value": "cmsMcqyTucZiVIs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46a498ec-d554-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652731848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652731848, "uuid": "5667fcf5-b7ac-40b7-8982-4b2cc177094a", "comment": "Malware payload", "value": "a3347cc611e2a26180aa216fe9cde4bd", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652731848, "uuid": "84131da6-290f-4354-a554-d42941551b71", "comment": "Malware payload", "value": "128abf3ecfdaf44cd54804f16502ba28903f999977d43d1ae6fdc4261d70e1df", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652731848, "uuid": "21196052-1c50-4a3e-8efd-685383ac5ec6", "comment": "Malware payload", "value": "1c72d2e6c33f7f62df79dc5eb035c01810dc7e63", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652731848, "uuid": "1ce53c79-7b2c-4330-902e-dbcbff95ca59", "comment": "Malware payload", "value": "99b01885a24f0290f9180e49874afcac148996f97382517df0382bba349a81b75defb7e4ddaaaa8728659ceedd2a230f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652731848, "uuid": "64f1ddcc-fe43-4ec3-8a19-696e30331c54", "value": "T1BAD2E097FEC3D464E26A95F8D8416C0372DA1E15B63CF63B187C88943AF562A0FC49C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652731848, "uuid": "f5041278-1e27-4683-9a0e-4d5779c5133c", "value": "768:iQtgE4Hudh7iFfaos1loq8fEKy1AARj8EyNy:TtglOPiFSzkEKy2A58EyNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652731848, "uuid": "94e724b9-323d-4b6f-80fe-86748647cc86", "value": 28907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652731848, "uuid": "fa15a16a-7276-436f-b315-b0f0cfc0e74d", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652731848, "uuid": "1095cc9a-9c23-4ff8-a0aa-3cc6b02eecb9", "value": "Rat.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0700addd-d506-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652698240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698240, "uuid": "9e6dedd6-96ca-4186-a474-0580822dea01", "comment": "Malware payload (Loki)", "value": "d8ed22091b31604a91bb7b095123e26d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698240, "uuid": "35661bb0-6aeb-45cc-ab56-efbe99191c90", "comment": "Malware payload (Loki)", "value": "12cfb9608d5c11f6f1abdaf7a6d5c7e09ffd87403d5072ad2e447beae13d148f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698240, "uuid": "07660014-98e6-4e15-adfa-12adb1845f40", "comment": "Malware payload (Loki)", "value": "6d27757780a6fa49e371e733a38db24d5e9649b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698240, "uuid": "d3af9eae-8d3f-4585-a0ce-2d1ab8b358d7", "comment": "Malware payload (Loki)", "value": "376550e7dc04e4cedad366b9af64c326a12285fd7ed5638ff564a40650efb27a2ba622684c58d11d0a896a98d963f587", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698240, "uuid": "783fab83-ef2f-44f5-b14f-b93840ac8b3d", "value": "T10CB4D0AC322472EFC857C9B6AA681C74EB6074B7430B9213A45751E9EE0DA97CF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698240, "uuid": "b52f219e-0a24-47f7-8798-c7042b9874f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698240, "uuid": "f4a341f2-2623-4188-a344-adad87b66396", "value": "12288:TxzKsdGiKGPJEmqCB+8G4Uvdr0sPDEht4CW37Z6hnGdmGY6Q:9HnKGPJEe+Bp0WD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652698240, "uuid": "a8000b09-c2ee-46fc-887c-ed8464bd1b7e", "value": 507392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652698240, "uuid": "4948506b-e68e-4780-8ed8-5b58ee011676", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698240, "uuid": "01a09f5a-da54-450c-bac4-e1ad6c2692e8", "value": "NEW-ORDER WITH DRAWING SHIT 1,2 AND 3 PAGES.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6515db63-d539-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652720302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652720302, "uuid": "4c02dc2d-f27a-4b29-9836-7d7334f8b587", "comment": "Malware payload (Heodo)", "value": "40adb08ac64559a7ed0c4a8c9acecdf7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652720302, "uuid": "90613b1e-e71e-49d4-9676-5bbc27b5c00d", "comment": "Malware payload (Heodo)", "value": "131f482ab85d4bf43daa66a802319d22298f3cc0108f6aa7df210b1ee9135a8d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652720302, "uuid": "1a6d708f-1976-449d-b44b-2089fc06285a", "comment": "Malware payload (Heodo)", "value": "a25b0a309255fe210666bead26f2836936e18826", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652720302, "uuid": "9fc8c40f-31ab-407b-9c7b-726b855d00fa", "comment": "Malware payload (Heodo)", "value": "925edc4562c748cdf15da706f365983790693f0af3045e2c86dcd769a33b40686f0f3a682a2eaee542ee2441f55be7a8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652720302, "uuid": "a283cea6-f7bf-4260-8a5a-b43c6d4e4ab5", "value": "T16C74C046B3A840BAED678338CC535647E772B45A4B70A78F13244379EF2F3915A3A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652720302, "uuid": "ecbf7923-9f1c-4872-88d7-25c33dd0c1bc", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652720302, "uuid": "4d94c31b-2f57-4a27-bc03-a4ec91f23c7f", "value": "6144:Es/2WX22TR72tKbxGeSkr2rlsy+vbEFXYvlx6xJkUjnKd:Es//Gi7/SgDvQFXTH9Kd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652720302, "uuid": "2acf2d29-67fa-4635-812d-a7f713045717", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652720302, "uuid": "b435dfaf-1976-402a-bbb9-96c0d5d9a1b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652720302, "uuid": "4b62b5ec-7794-42c4-9e57-eb8ef50b457d", "value": "40adb08ac64559a7ed0c4a8c9acecdf7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1425d9d-d510-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652702874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652702874, "uuid": "04834007-0add-4d2e-974e-ef4bfb77c928", "comment": "Malware payload (Formbook)", "value": "a505757fb36d0c2945985135b1de90cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652702874, "uuid": "0255b2bc-0463-42c1-a2ab-8eb4207ced82", "comment": "Malware payload (Formbook)", "value": "13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652702874, "uuid": "0df6e839-92b9-4b88-ab88-7252b8139bbb", "comment": "Malware payload (Formbook)", "value": "0f90b28aa225725493ef72a9915bf0c5082ff992", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652702874, "uuid": "93d2e88e-d887-4a2e-a0c2-044f7d057676", "comment": "Malware payload (Formbook)", "value": "5e560d09c1e6bd072b05ffc2945a4b502599e1e721b6a6c47de4496c316a3347c65b9320dfb1326ec03ce5c11f8f30ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652702874, "uuid": "91ee8900-e12f-4be9-99d3-84485159f6fe", "value": "T1E2C4022E7784CF11C09C58B9D1F3817953F6A08B5232D6862EDA02C65F13B949D8EBDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652702874, "uuid": "eec096f6-ba4f-4e45-919f-08f8990ef835", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652702874, "uuid": "51873384-16ec-4fc8-a1eb-35299be0db2c", "value": "12288:YzY641xAvUKSFAx4mHjJrquGWw6YKnDzhBn7d:1wDROSjJrq2jnB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652702874, "uuid": "c166c028-5fc6-468e-8acc-a8fa5538fdc8", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652702874, "uuid": "e726c9a8-0a97-49df-8601-62ae6c4eaeaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652702874, "uuid": "281ad141-21c6-4d9a-9f69-ad1594ce08f8", "value": "catzx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "873dd6fe-d4f3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652690295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690295, "uuid": "5e51cf30-5e53-4f2d-b93b-c48ee8bbea44", "comment": "Malware payload (Heodo)", "value": "5df93ce7f866ebbcf35000a15773f058", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690295, "uuid": "d86b28b2-0b70-4ad4-a970-eb609d61bddd", "comment": "Malware payload (Heodo)", "value": "147d042fd0aad81ce66e4457215e40ce5239ee1ed313fe1003701c2ae7052c2e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690295, "uuid": "f97807b8-ed6d-476e-9d44-2678cfc9dc3a", "comment": "Malware payload (Heodo)", "value": "fc3126e4f2c4a6750740660ad797011aae976907", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690295, "uuid": "3912af8e-b1a5-45a2-96f8-716e11c3d2e8", "comment": "Malware payload (Heodo)", "value": "235cbaee2146f38e44ef8ab3846b4232a3c9f2a0aa44d101a977c3782e147b02318eafe5fafce1ca42fbd8649ffa688d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690295, "uuid": "279e3a0f-60eb-4bad-9990-4a53064cbabf", "value": "T1B0055A35FB6C8492C6A3953D88A34B06EE6AFE840B6183CB1290733E9E777D45C35671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690295, "uuid": "64955b4c-85eb-4d8c-9bb5-e7858615caa0", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690295, "uuid": "96da2793-48d6-4a62-9e16-d11b09f6791d", "value": "12288:Q9983x9oz0/7aG8GkZHFT1YicDAXmvQaZsbNg:A9UHozAWGxGx16AWvVZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652690295, "uuid": "8e3a3ea8-85ac-470f-b3b3-7b4eb9c5776e", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652690295, "uuid": "a3ca150a-4567-4edb-9c24-d0193c9f797f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690295, "uuid": "8c0a7223-2873-45ce-8e54-ceb212dc9793", "value": "5df93ce7f866ebbcf35000a15773f058", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cf12d8d-d4d9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652679084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652679084, "uuid": "e6561491-6b65-46f2-8f57-9f8aa455b921", "comment": "Malware payload (Mirai)", "value": "3aefabe5e9080dc3dfcc0553cbd8d7a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652679084, "uuid": "abe5bc5e-d342-42d0-9fd4-e2272c234243", "comment": "Malware payload (Mirai)", "value": "153c74f75057425e464e709ad1237dcf043ba3a4eb35201a22b81954f2a343b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652679084, "uuid": "f4e4b04c-6bbb-4815-9958-72e050e95611", "comment": "Malware payload (Mirai)", "value": "2b2e668fe305961ca8d00c0eb57bfc23a4a6a89f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652679084, "uuid": "34ed6145-ec85-4131-8917-c08c03b0f8ca", "comment": "Malware payload (Mirai)", "value": "7dcb0fe81b7c6772a26823e86fb38c7e45a06cfe1622c1876b9dd0af505da837f042534ade0b113d42d0c28ed40a03ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652679084, "uuid": "0b20273d-fb3a-4d23-89b5-86311169442a", "value": "T16FD2D0782D048AD1CD61F6BE56F647683CB80B827C43CC8E1D58F2D75A959B23942BE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652679084, "uuid": "b2b3e9f6-01f8-48fa-9ea6-7e2bddf1f113", "value": "768:UBy/Pv6B9sLLVTP1wk1BDd2qtX8c0JgGlzDpbuR1J6:9KOVRwkjx2qfsVJu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652679084, "uuid": "9d9aeded-632c-4ac8-9360-d331216f357a", "value": 30804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652679084, "uuid": "d40929db-8fb3-485b-a21e-4694cca8051a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652679084, "uuid": "f7ff5f62-4cbb-445a-86ec-c7445b417126", "value": "3aefabe5e9080dc3dfcc0553cbd8d7a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e37b59b-d4d9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652679059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652679059, "uuid": "07b394a1-86f8-4bc5-9af2-f5948fa12416", "comment": "Malware payload (Mirai)", "value": "fd0542fbe7bf6efb4266f1916c8f9268", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652679059, "uuid": "019358a9-c80c-463f-8b8b-7e2326642fbe", "comment": "Malware payload (Mirai)", "value": "15404fd2d204ece020a72fffcfac8a9803344c2ad0d0183b006088a403dd4bad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652679059, "uuid": "439fa0d6-56d3-4175-8a5e-b9ea4b868f3d", "comment": "Malware payload (Mirai)", "value": "193a02d72720ecd236e22add91807ef79f23aadf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652679059, "uuid": "21a4ac62-4236-4860-b25b-3523b52c1e2a", "comment": "Malware payload (Mirai)", "value": "738861852a3ca224809480ce2fd9a5b149fa99bbff8b2df9f8741fcf4098ff684fba0fd6edaed8531e620cc371541986", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652679059, "uuid": "4486900a-14eb-4d31-a115-1a5f247bc68c", "value": "T1D4E2E0DDD5E1AA88CC9D9EF4999E37C289E9359021CD0F0E97040496EF1BC0F684E6BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652679059, "uuid": "5fb209d5-33f1-45c4-bc0c-300fc3f59476", "value": "768:XH+R/EMJbWItjgQaG5CKQweFc8aR4A7WCaKWHKO:ORK60njZKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652679059, "uuid": "e1db375c-d932-475c-bb27-628bb3f9c4c1", "value": 31892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652679059, "uuid": "02dcebc7-804e-4292-b852-b0d62931bbb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652679059, "uuid": "6626f4c6-623b-472d-a0ab-0cf35a744dd7", "value": "fd0542fbe7bf6efb4266f1916c8f9268", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a814dcb5-d4f9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652692927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692927, "uuid": "e533b77c-4c7a-4039-9219-fd677a6fa282", "comment": "Malware payload (Heodo)", "value": "ef2eae250e193d5f8a12f7130bb10f5a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692927, "uuid": "0cbbf1d3-c0dd-426e-95d2-e2fdb4319a69", "comment": "Malware payload (Heodo)", "value": "163eec2057236b9829fa48026c744703b300a402288c3da7e7b104e8806e05cb", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692927, "uuid": "af81bf4d-04cb-4e1a-bc0f-f2335c33737a", "comment": "Malware payload (Heodo)", "value": "2d850a1c72f96638bfc7319942592c6afaf29687", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692927, "uuid": "56e468b7-b257-4baa-9e9a-03faddbfa954", "comment": "Malware payload (Heodo)", "value": "c72c53759a7c8d387b1b1cf6e3ac488da876ff31ca648ba06157f68ebebc32fcd2a6e6f915ad8f6928c1eb3b27205e24", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692927, "uuid": "eb990723-a96a-44ce-8a95-1f6485cb39c8", "value": "T11D055A35FB6C8492C6A3953D88A34B06EE6AFE840B6183CB1290733E9E777D45C35671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692927, "uuid": "f0d9dbf3-4d48-4f01-8042-ee43155208c4", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692927, "uuid": "5a326802-6ce8-4b64-9639-71e806a9faef", "value": "12288:Q9983xDoz0/7aG8GkZHFT1YicDAXmvQaZsbNg:A9UFozAWGxGx16AWvVZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652692927, "uuid": "b1b214e5-ec1e-4289-8a27-a39d5f4bfc5a", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652692927, "uuid": "4923b1eb-40c7-4a81-abb0-c755ddf579cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692927, "uuid": "21acda94-6df8-4406-ae3f-af4e209a3495", "value": "ef2eae250e193d5f8a12f7130bb10f5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9889b9eb-d4f3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652690324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690324, "uuid": "8f052feb-9ad3-41b2-ae77-f32c7cbf01ff", "comment": "Malware payload (Mirai)", "value": "62f4eb59ef2c0167f3fe9d99dd68839b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690324, "uuid": "c748b6e8-54b9-458b-83ff-3c32278a537a", "comment": "Malware payload (Mirai)", "value": "1640ac7a84af39a4ec2719d7c3249eb9ee93d76a067f2fd5c161a2532fbd9bce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690324, "uuid": "2758d97f-789b-421d-abea-0d8ced1e10a7", "comment": "Malware payload (Mirai)", "value": "64917f1b9d2af558f8bf44cfcb8cd9bdbe5f55aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690324, "uuid": "9d303f20-553d-4432-a79e-20809282aa48", "comment": "Malware payload (Mirai)", "value": "8881e3d4b4cdfa82d05f84f9e8dc17865ef4bf8ff6d6ce70510e59c1701c003f58ec9b3d0dfcc3813ca6c41a10fd0487", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690324, "uuid": "b28d6b01-f407-407a-91ff-3c3ebbaefac9", "value": "T1CD83F79278C29A16C6E423BBFA7E018D332567A8D2DF32179C212F1577C981F0DB7691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690324, "uuid": "d66d731d-6521-4831-a179-fcb018107820", "value": "1536:MsCvlPf6NDyL9Jb0+pHXlzPhha0xTElQn6ahWNrCEKW5DnHM35DzC:MsCvlPCuTxiQn1hiGWK3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652690324, "uuid": "b54c6069-1ce7-44ae-ad0b-ca5e1a751b48", "value": 82940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652690324, "uuid": "8ed6358d-d34a-4b84-9ce7-f3c07871c5fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690324, "uuid": "50772066-2741-485c-b1ec-566cababd708", "value": "62f4eb59ef2c0167f3fe9d99dd68839b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482b930d-d523-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652710805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710805, "uuid": "2414bc67-6675-4d7d-a11a-c6d98874dcfd", "comment": "Malware payload (Mirai)", "value": "4332e66feed8c263e951d4facadd1966", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710805, "uuid": "8cb7bdcf-7794-4f38-a7af-26113790c99c", "comment": "Malware payload (Mirai)", "value": "1697ced3a3083c35b2dddc5739b3f8ba77ccc47d57883e52bac7a53fec1bbbba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710805, "uuid": "ea01bfc1-21e3-4975-be51-6e98e6dc9f6a", "comment": "Malware payload (Mirai)", "value": "0b89f4043f3300450e7dae1e22dd831b76d6fb64", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710805, "uuid": "09e60388-c5d9-4873-90a9-e1fc254ca858", "comment": "Malware payload (Mirai)", "value": "d658aadba91d5defba08c0b70a50822ea79e6929fd4637b8f9264c8c86d3e66557ed427888869019c54242f4722a4501", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652710805, "uuid": "e0c20048-30a3-4fba-a96b-dc9489487a67", "value": "T14BA2D0F081140C46CAF187BAFEB9C25FE65306F4C0B4313A1A14416CFD9524A6EBD1EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652710805, "uuid": "b656ddf4-b59c-4e24-9345-f15a7947348d", "value": "384:s9gWDPJaWp6M9UDWGKiRXGyIQgJR/3qLfowrH4CA3hymdGUop5h57:s9lFleaiRXvIEH4CWs3Uozn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652710805, "uuid": "52e6e1e7-5636-44b2-9baa-4e2525d55f79", "value": 21416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652710805, "uuid": "1726cf56-21ee-4ecc-9660-bf421a0cad68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652710805, "uuid": "ff683547-c314-4276-83ea-91164bf51240", "value": "4332e66feed8c263e951d4facadd1966", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e9b5232-d540-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652723405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723405, "uuid": "ccbbd319-5ac0-42c8-a1e7-3b57a3233aff", "comment": "Malware payload (Mirai)", "value": "6260f116c7d1ebe0471fb0884184c8e3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723405, "uuid": "f2932466-06ef-4f3b-8bc0-6c5d4e24641c", "comment": "Malware payload (Mirai)", "value": "16fa25a00d924b2ecb92c5d98fe34ce67153bfd24ef68a56e331f13b8b60f5c2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723405, "uuid": "c9925a88-8947-429a-bf96-272eb207dbfb", "comment": "Malware payload (Mirai)", "value": "52291a91e6cd79600f702d1d65a555b9e0276ede", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723405, "uuid": "34c45622-701f-4a35-bc58-453350d91344", "comment": "Malware payload (Mirai)", "value": "60bb9329280c0f36b836439a5cd0befcb00327ed320e98dc2f4c53577ae674607ad2b7bbb139ee9946c604cccdc91c25", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723405, "uuid": "05f650c5-95fa-4fe1-8070-aeff7ddbe235", "value": "T17303E784B8869A07CAD4537BFE1E42DD3B257388F2DE3313DE166F51368A92B0D6B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723405, "uuid": "ca682d0a-9723-4688-941d-0557e7d7d668", "value": "768:sSRHIa0IM5eomnovko4iBfNKR12QlU7Jo0rKVM:syHIuyacIR1ve7q0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652723405, "uuid": "9bf6f283-0605-411d-8a2d-e23c07a501a3", "value": 37884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652723405, "uuid": "0ca97ea9-5892-4de7-9ebc-366699d3946d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723405, "uuid": "503242d5-9280-492c-a3b3-a9563ed22fe1", "value": "miori.arm-20220516-1750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82762fff-d519-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652706608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706608, "uuid": "3f54ca4f-024d-4b7e-8eab-712cdef0e372", "comment": "Malware payload", "value": "9571c60cd9f6a413053565908bf69e5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706608, "uuid": "2b9068bb-1359-4fe0-976e-9e98a207b800", "comment": "Malware payload", "value": "17087ff32ce6d44adc031dccf32c5e6ecbf4f5fba70e8d33c46e565bba3554da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706608, "uuid": "537d6d64-3632-44ed-803c-a2c1a9dd8ec9", "comment": "Malware payload", "value": "d87abfcf02c0e84ad3f5b122b298a242130ec1f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706608, "uuid": "734cb40c-b27e-4e5c-8a13-1829fbadde74", "comment": "Malware payload", "value": "aee2eda30c9debda9b4ada0c3618d88531822a9c5b2625a4a901d8c4e2f26a142418a650a747ba6d1ae2134dfc078e8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706608, "uuid": "81d1ea70-516b-4f6e-99a1-bd73c9397e80", "value": "T1D97502817DD4CCB8F6711478CA746A5CE8ADBE62BFAD86CE1350890FDCF108294365AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706608, "uuid": "7551ab74-6520-4fd6-8d3f-b5e548ca5d52", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706608, "uuid": "2c47a616-62b0-4d60-8549-3dae17d8d569", "value": "24576:2TbBv5rUyXV+zXh584QQMfc6JUhFSM+UPSShgD3cuQk6trUzH54gBlqpVurZ:IBJYxi4Q5EIUheU87ZhuQjqgBlqPurZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652706608, "uuid": "03b49423-9709-4653-8e8b-7d03064fedd0", "value": 1690419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652706608, "uuid": "2208de2f-365f-4e7e-9c29-c3d19d869964", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706608, "uuid": "5229fbc3-62b7-46ef-a545-dfeb669ae7c8", "value": "search_hyperfs_310.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3871735f-d522-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652710349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710349, "uuid": "bab3772c-77ab-4788-b96b-5a7c16d46248", "comment": "Malware payload (Mirai)", "value": "04d00142768a49ba2353b6eac1df430f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710349, "uuid": "19c333fc-f5f2-4c22-8281-b3b0de02d9ec", "comment": "Malware payload (Mirai)", "value": "172ebc6b62de744dd38e5e686321245ddbb5a7a58c5f9d0e4bf107f2c7df5ec6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710349, "uuid": "f73e5ea7-f3b2-4d3e-92c0-7508aa7db36c", "comment": "Malware payload (Mirai)", "value": "6400e218c1b3d8de44ba9d48c1c1e4a634d1e3fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710349, "uuid": "de17aa01-7d2f-4e98-b9b0-c35daafcc4fe", "comment": "Malware payload (Mirai)", "value": "0a328f6ab675940b3c3ef9af3e6c6adc2d5f491c24a62a07c7943718b8252901101fc2eecd8ac14a40aeef7397bbfc97", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652710349, "uuid": "541cc6c1-ad2c-415f-8a85-e92c0a5eeba4", "value": "T136433CD5F801AD3DF957EAFE44624A0DBA21721150A30B2BA36BFDC37C332A44E16D91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652710349, "uuid": "4b928d86-ccca-4f55-91c1-f64576607251", "value": "1536:bFyTOn7IOlZFT2x+qEbYbKup7X6Y3fG8ce:bFw82xJEM/gYPt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652710349, "uuid": "ba1b9049-036d-44f8-925c-2da2391c6cae", "value": 57244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652710349, "uuid": "2c20a9b7-f2c9-408d-8866-523d126f2054", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652710349, "uuid": "63798b7c-7aa3-40d0-9fa5-cdd368417914", "value": "04d00142768a49ba2353b6eac1df430f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "878b1915-d54d-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1652728950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652728950, "uuid": "e6794349-472c-402d-95cd-b1eb86336b5e", "comment": "Malware payload (NanoCore)", "value": "08c261ade5c2d31437da373d90a2f6d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652728950, "uuid": "b48d38e0-9ca2-48c2-84ca-00ed996ec3e1", "comment": "Malware payload (NanoCore)", "value": "17952248625aaa9c25208dc4ab2d7849aa39d2c189aac5b26fe2f3d130301e1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652728950, "uuid": "aec342ff-878e-4292-8649-ca04af82ff4a", "comment": "Malware payload (NanoCore)", "value": "2a18a2cefe110cfee786afabaed53db3af3b0e4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652728950, "uuid": "aa59a2cd-8c73-43b2-9b90-6a3930199c09", "comment": "Malware payload (NanoCore)", "value": "f21287faedf1fd4d9e52ceb55567e60ad9bfff517f2672ba300d8d88530ac3e958748fada98f628e1dba31730bfd8a94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652728950, "uuid": "21b76e4b-3d22-4d57-a387-ede6b49e7efd", "value": "T12BC423582DF8DB31CAAA03BF62359924DB7A30556C71DE972DE240D82712BD18CF1E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652728950, "uuid": "9cf05dbf-6a7e-45b0-84bf-040e9002bf2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652728950, "uuid": "bf01dbc6-fe24-46d2-b32e-9f570023041f", "value": "6144:2OQIHT3dvRwms8jDkJuapaQWaR0eyrcBsW03AUWH33Z/h/aZnAqAFtz8PX2c+Vbs:2ApfjDktaiqePiR4B5aGvFtzrDcxbd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652728950, "uuid": "bfcf2b89-ee5d-409f-bf56-f0efd58a1771", "value": 565248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652728950, "uuid": "33be528d-d87a-4ea8-95d6-cbd0343b0e97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652728950, "uuid": "99b93915-da6e-4d0f-b782-4cecceb7b10e", "value": "PO #50251_House Building Project.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8425e7a-d554-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652732011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652732011, "uuid": "0f05763a-4726-4a6e-986d-c0a38eb11887", "comment": "Malware payload", "value": "7c3a01ea32ee2f3184d929599e36a4b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652732011, "uuid": "490ce9e6-78a7-4adb-9c13-b1a91d40e765", "comment": "Malware payload", "value": "17bbaf9b1693ca53d6663feb6c2632ccb15117d0fc5fceae96daad43b2c3472d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652732011, "uuid": "b8b9b0cc-e57e-44c3-8ce9-8d5e152e89cd", "comment": "Malware payload", "value": "357b922ac6fb3a5bd9201c8f90669d510440e82c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652732011, "uuid": "e13d6a06-1062-4a50-acae-75e95d86c1c9", "comment": "Malware payload", "value": "4c26c68f476c5c2c68d7a670d9f4d406d5039d4151bd070943e09af395a7fd3bf5323416b9ceef5991a7c7c423ab523a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652732011, "uuid": "f5b88062-e018-4432-a9ad-7faaef77d18a", "value": "T1A774C046B3A840BAED678338CC535647E772B45A4B70A78F13244379EF2F3915A3A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652732011, "uuid": "00a3fb47-b1cc-43ad-824a-149239a4d4c9", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652732011, "uuid": "b91bb320-c872-467c-9be7-0302271977ec", "value": "6144:Es/2WX22TR72tKbxGetkr2rlsy+vbEFXYvlx6xJkUjnKd:Es//Gi7/tgDvQFXTH9Kd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652732011, "uuid": "496ab11b-56c3-4c19-a2e2-0e29a1a4f444", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652732011, "uuid": "0cbdaf21-2358-496e-989c-ee4c34c7cf72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652732011, "uuid": "21fa7089-df32-4429-8c81-aa3209d161e8", "value": "7c3a01ea32ee2f3184d929599e36a4b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ea97080-d50d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Gafgyty)", "timestamp": 1652701420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701420, "uuid": "adf1a02b-d91c-42c7-a39c-86c8a45780df", "comment": "Malware payload (Gafgyty)", "value": "9b1d28d27fa3aceb10eeb48c36300918", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Gafgyty", "colour": "#CD1A54", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701420, "uuid": "11439195-8ce6-43af-bee0-b3bfb5db10ac", "comment": "Malware payload (Gafgyty)", "value": "183ebfeaed6f3dfcaad2f5597ab7a5d533eaab93d0ec96b8b631e123ecc2cb20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Gafgyty", "colour": "#CD1A54", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701420, "uuid": "f67b4607-8eb4-4fdf-934b-91fac785ea78", "comment": "Malware payload (Gafgyty)", "value": "b2878f13356c86ac4d58d4c55aa3a4e2e949b823", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Gafgyty", "colour": "#CD1A54", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701420, "uuid": "47b42460-a599-4a73-b3e8-6fa7737b3666", "comment": "Malware payload (Gafgyty)", "value": "e31dfb9b91be0eef1caa03c92eff0153f1cd9dae7d9c764bbc894316146aa2993a78fd01ae58207e42ee4ebc27648a47", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Gafgyty", "colour": "#CD1A54", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652701420, "uuid": "40975c9d-d359-41a0-8aed-cf7e562d7351", "value": "T1BFE32905E551471BC2D227BEFB9E429D33232F68939B33255A347BB81BE1BAC1D39121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652701420, "uuid": "5dab4965-4741-4c9e-88d7-dec10a202299", "value": "3072:RwP9OjMAj5d4IopuCaAO5CrlgBiZMMhBuswu4zzyL5IimwPQdFRCzNx:OPF878RaAiCrlJusN4zUIimwPQdFRCzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652701420, "uuid": "97019361-5bd1-4da7-9dd6-71d75ac208d4", "value": 143545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652701420, "uuid": "58a75f08-cd56-4c59-9f05-24d2ce0d5a89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652701420, "uuid": "82e0f1c9-6f30-4c59-9896-e4f640d09ab5", "value": "9b1d28d27fa3aceb10eeb48c36300918", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "587a3edf-d539-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652720281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652720281, "uuid": "8ef01430-e774-4bc9-aa3d-7885b48283bc", "comment": "Malware payload (Mirai)", "value": "9ef1046388077596a48c8998e3208524", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652720281, "uuid": "a95b4e74-7f78-426d-a6a6-c9c4af00ac1e", "comment": "Malware payload (Mirai)", "value": "19037780dcea01b1a60b4b2274a992a8c4bf54ff0f8b4b243ba35882e306313f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652720281, "uuid": "0fb092f4-6ac7-49f9-954d-dbb0ae148253", "comment": "Malware payload (Mirai)", "value": "dbf660c149edd151dc58a6b4a330d372f888f075", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652720281, "uuid": "960cf836-cdd3-4e00-ad36-530a614d30e8", "comment": "Malware payload (Mirai)", "value": "cf852fcd1bab38ebbfbd9395dab9ce5a91fd1eb3ff84390bee5b32c900d7dcc7b8c86e22234010dba60ad034c74e8acd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652720281, "uuid": "ba3ce988-1fcd-4a6c-9b5d-74614569da8c", "value": "T1A693B50ABF615EF7ECABEC3349AA1B4525CD541721983B75BD34D818F64A20F09E38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652720281, "uuid": "329bf294-1608-4755-8a11-97edbaadf81a", "value": "1536:mCY8fv8mNjCzc3VSqpQYjFitdxAi78ltCDldL:m78fv8mNuzOVj/dl+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652720281, "uuid": "0e9fe0c2-4b69-4e03-b1a6-931c40728755", "value": 92476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652720281, "uuid": "b89973db-f3cd-4200-a674-14d30ca599bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652720281, "uuid": "9b6a6778-07c0-44eb-85c8-e8f67628930a", "value": "9ef1046388077596a48c8998e3208524", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b9cc80-d505-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652697911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652697911, "uuid": "15673bbd-9beb-4684-8e0c-e2d7eefedf19", "comment": "Malware payload", "value": "b238cab516f2a496ae4bf3e89e2abb55", "object_relation": "md5", "Tag": [ { "name": "rels", "colour": "#0407C4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652697911, "uuid": "79095c4b-8c20-4fb8-b767-ea754f68e016", "comment": "Malware payload", "value": "19e967230a4072029ab66946324fd2650b75dbd26da4f1d5b54710218403a955", "object_relation": "sha256", "Tag": [ { "name": "rels", "colour": "#0407C4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652697911, "uuid": "acdfcfbb-69d8-459b-b249-89dd6145698f", "comment": "Malware payload", "value": "4821c5cad9db77c45c2e12f38dade9b9d4d47c7e", "object_relation": "sha1", "Tag": [ { "name": "rels", "colour": "#0407C4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652697911, "uuid": "fe24afd7-eac8-4069-a585-45f18b01975b", "comment": "Malware payload", "value": "003f56450f4866dfe38a25c4d2c5b4477b66d9180b2ad1777f87a36fa7f168a42f63253161ceca61d7901ba5be49b7f6", "object_relation": "sha3-384", "Tag": [ { "name": "rels", "colour": "#0407C4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652697911, "uuid": "d08bf36e-ed23-4bc4-bdd1-65213446571f", "value": "T1530126C2D4B99E13EF424361A477741376B048D243F2950FE952144AB11CCC3361B7C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652697911, "uuid": "d2862dc8-9b2b-4d43-aa9e-23dbfd8714ab", "value": "12:TMHdtWa6fmEUdzXb6flbEVUWDUDzXa6flbEpyVS0jzXV6flbE3FW4h5zXQ6flbER:2dtWa6ffa7b6flYVdgD7a6flYpgS0j74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652697911, "uuid": "7683388a-2fd6-4a6d-afac-c22ea7470b0c", "value": 759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652697911, "uuid": "c65e9ef0-758d-451c-83bd-1b0c9e8773cb", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652697911, "uuid": "19022a3c-9e8c-4865-984e-0c8dd1a79274", "value": "slide1.xml.rels", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "699d6655-d517-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1652705707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705707, "uuid": "935832bb-1362-49b4-b375-34e868ed779b", "comment": "Malware payload (SilentBuilder)", "value": "d2f7912c011a73f1f106bca358b960bb", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705707, "uuid": "8b88fa8b-92f1-4187-8cbf-c377f69fd4a2", "comment": "Malware payload (SilentBuilder)", "value": "1a0716836a050af04f005a9953c13d9d0931b99b8c4b472a0fe8d284ab8dd93e", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705707, "uuid": "3b8c636a-be8f-4b02-b7a5-e102f7a84ed2", "comment": "Malware payload (SilentBuilder)", "value": "4248e114260dfdc02dc069a64519f14511505f27", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705707, "uuid": "2fea6a0e-0608-4fee-93ae-041648cf9bbe", "comment": "Malware payload (SilentBuilder)", "value": "dee96e9727d9a1ab96520d6eba971a1ed76ebe7f798c7f38ec491566db47ed96823fbc70b4dae7f903aeb3c0fa501454", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705707, "uuid": "cfb2b9db-e271-4f38-9b3b-646eac6f26fe", "value": "T175734A4AB98AC96CF611873949D747A9B313FC110FAB0B8B3509F3627FF49A05A0751B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705707, "uuid": "bbd6bfe7-b428-4973-a234-9d198afecc8f", "value": "1536:tpKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgCAezwrMCtvJecvRtbu0D5m:zKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652705707, "uuid": "49cda41d-27d2-4254-a9be-2f64da6f301a", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652705707, "uuid": "0c6560d3-4b22-40cf-affc-5086676aa80f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705707, "uuid": "1b4c10bb-23ef-4edd-a67e-c38cfa119ccb", "value": "SCAN51747_0005.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8111aa2e-d4f3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652690284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690284, "uuid": "c1ed6ee4-804e-4fa3-b0cd-9edc8e579d8f", "comment": "Malware payload (Mirai)", "value": "fa8f16e04bf73a29a398d399d0c4f018", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690284, "uuid": "ce8e61d5-60c9-43fc-a352-920dc73f2e07", "comment": "Malware payload (Mirai)", "value": "1a9fb9a990c9e5f279b12a1c8e37032fb4ebc0f2cf8bf37007347ed655e37c71", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690284, "uuid": "34f2ff2b-a540-49a0-9051-6a38de49549f", "comment": "Malware payload (Mirai)", "value": "e232c6ee90236d7c86df5c08aa313a6c65811919", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690284, "uuid": "4e8b0474-7c33-4de4-a0ee-a3ac2a0c3347", "comment": "Malware payload (Mirai)", "value": "8abcce583dcd0e509e3a1883f2e3f453f762880ac81995bf2619dab40d23f0369eeeacd578eef47b166268c0160356e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690284, "uuid": "cd44c8e7-898c-47fc-a4a1-dcaa47cc876c", "value": "T192734B4331284A47D5924AB4253F57E083FFE99034E4BA89684FEB5A8639E771086FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690284, "uuid": "d471ea3b-3753-4dd1-a41e-4c8d35aee479", "value": "1536:tvPFs4/Cbhj118cuFf9tYjS5FESzZfjiTpIG1uft:8xaFfFgsfkpIG1C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652690284, "uuid": "013b264c-aa42-45c7-ab0e-8ef264d11dce", "value": 77048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652690284, "uuid": "54105d3c-a4f0-4dd4-b193-aa3616d9b62c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690284, "uuid": "f30d2955-504c-4858-ae85-d090319708a4", "value": "fa8f16e04bf73a29a398d399d0c4f018", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e2534bf-d564-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652738786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652738786, "uuid": "02aa3dbd-41e2-45ce-9333-895afacec8cb", "comment": "Malware payload", "value": "1464ddb040a028061365c84f4247da95", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652738786, "uuid": "66702df3-ec89-410a-a0f9-04b01044c8a0", "comment": "Malware payload", "value": "1aa83ab33913f975ddce6d788de99a71f437db108a8f41edaf87494991105339", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652738786, "uuid": "20d1c171-8f2c-4098-8902-1e546caca8a3", "comment": "Malware payload", "value": "12338a5638e61f92e35721f47405b4cfa683c6f4", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652738786, "uuid": "d6475a3a-55bd-4d78-9d4e-e1504e47513c", "comment": "Malware payload", "value": "e40b9ec9f0041ab4d95499c61a6664e8d5d4b1411616139cc610c1af924d2a1ce66889ec29d33c745d9d197c75ca4fb9", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652738786, "uuid": "04aa034e-7cc9-42e9-93cc-ce573b993e25", "value": "T1CC819F3C61A2C18D783B0E7BFEF83D54A0494F57C5CD678801E8C89D2EF8AA53518AD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652738786, "uuid": "c4a2e795-73d6-439a-b146-6cf62884f801", "value": "48:pax6weVFfGBn489/eU9dNbmuuaA9hkWML90AKnADLbzuujjZhALrgu1BykrQALrk:pacX0n1eUWopfAjBNpozEARB4m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652738786, "uuid": "f4a2180e-b0b8-4d1d-b2d5-f9ad2c0feef2", "value": 3991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652738786, "uuid": "f940b5ed-dec4-4e52-aaa5-1d6cf58c2b6d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652738786, "uuid": "d45b7045-a00b-4506-b487-5238bb884045", "value": "P0rnHub-Premium-SharingX.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3338002c-d4fb-11ec-8e58-42010a9c0032", "comment": "Malware payload (FormBook)", "timestamp": 1652693590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693590, "uuid": "d2fe9048-94a3-48f4-ad2c-173a924bb0dd", "comment": "Malware payload (FormBook)", "value": "b37e232df985736d0ae7d88da9c27e28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693590, "uuid": "a7d26795-3370-48be-940e-8a9504a7df7e", "comment": "Malware payload (FormBook)", "value": "1aedec4c789a2833e781fce06c81c709c4c8cef42f9b1fe2a2b61f9bb836cbee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693590, "uuid": "a460db2b-f4ca-42d0-829a-3be2726355f8", "comment": "Malware payload (FormBook)", "value": "3903b821853a3d80a9a63bb6a95a30ebb1b9475e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693590, "uuid": "ef6f7077-141b-47f0-b39e-e4e871af8b35", "comment": "Malware payload (FormBook)", "value": "18765df8cae092360751c1e73abc72efa2b81ded720e6de51defe1f62668a9eb9051831b43a78dc21c88fb7eb6ac057f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693590, "uuid": "cb51ffd2-67f2-49e3-abe4-618e8479c9a0", "value": "T19FB42305B3FCA316D2BB467AA67305200579F9177622F93D1ECB60D62DE3F09DA80729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693590, "uuid": "3f8e254f-bab8-453c-bbc0-17f6855a17a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693590, "uuid": "89a99358-2492-4001-9cd3-5e82d42838ea", "value": "12288:fCusbky1hqwHnMgv++8Womz5raQcKxsWc2OR:f7/yqyMgG+8k9gfWc2a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652693590, "uuid": "f9c95dfe-2564-4095-b683-1ef4e3cbac72", "value": 533504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652693590, "uuid": "bfac4649-81e1-4957-80ff-b2c186b37bb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693590, "uuid": "f92e681d-2844-465e-b9c8-d154742e50b0", "value": "PRICE REQUEST FROM TURKEY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d235dcea-d4fa-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652693427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693427, "uuid": "e17ec6b8-5601-4c3a-8f5a-4821336bc481", "comment": "Malware payload (Heodo)", "value": "691c4024c1bf0c70c8a275e97db03645", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693427, "uuid": "f0a0c008-9cd7-4b8d-b688-f5dc5a24797c", "comment": "Malware payload (Heodo)", "value": "1b7af952e7c17f794d3ee1a8c097db143a04c772f5fe52c99c7db89f7d55888e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693427, "uuid": "4da2ac68-766a-46c6-9257-3ea2b7a20378", "comment": "Malware payload (Heodo)", "value": "b2ff8bb65d0bcd70a315cd596d603a7450dfe704", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693427, "uuid": "a2952ca2-8586-4239-b75b-1b4662e7b7cf", "comment": "Malware payload (Heodo)", "value": "7ea66f6f2a90c1fad17a7de4f29d5e11f0f47bf59db8ed8df3971a75356224f0b02a849753893cb1841f96f36c9b26e9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693427, "uuid": "f9c3ce4e-2c93-4a29-b2c1-79239cf7b470", "value": "T1E3055A35FB6C8492C6A3953D88A34B06EE6AFE840B6183CB1290733E9E777D45C35671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693427, "uuid": "72f408bc-0537-4c66-9a38-7f31c28cd70f", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693427, "uuid": "4637fcdc-682b-4fa3-8090-05b8d88b4a65", "value": "12288:Q9983xBoz0/7aG8GkZHFT1YicDAXmvQaZsbNg:A9UHozAWGxGx16AWvVZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652693427, "uuid": "b954b428-bf6e-432e-b1d2-207903e802bf", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652693427, "uuid": "2da4402b-9cef-4467-a24e-e705c411dac7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693427, "uuid": "30524843-7e21-4b75-a82b-ade74ea85eba", "value": "691c4024c1bf0c70c8a275e97db03645", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67dcc4cc-d539-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652720307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652720307, "uuid": "ac0ad2a5-077f-49f7-8e00-27a2584dc300", "comment": "Malware payload (Heodo)", "value": "5e2304aae6f027792915a19b350d0120", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652720307, "uuid": "baa0b452-a6c8-43db-a95c-66570bd54bef", "comment": "Malware payload (Heodo)", "value": "1bd0c823c39a8c4362751370c0293c3d1521deb1e535fc49c252b1b4c0aeac6b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652720307, "uuid": "a1eb51b4-8d0d-44e2-b0ea-8d0894eff1c2", "comment": "Malware payload (Heodo)", "value": "abb82bc8fc5677bfd393473173958155032f7c7f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652720307, "uuid": "9add00ed-6e25-4b54-84c3-d17d3280e035", "comment": "Malware payload (Heodo)", "value": "068f710a4b2469d91fb625b7c973166d29217a9d3ccf12f6569163f8f07825119aa869fd289fa84d55ba23651ec38ce4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652720307, "uuid": "691dee92-c7df-4c98-b6f5-d94b93076298", "value": "T14374C046B3A840BAED678338CC535647E772B45A4B70A78F13244379EF2F3915A3A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652720307, "uuid": "ea3ea912-b343-4011-8f6f-e0afe2c331ca", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652720307, "uuid": "e4dbee8d-2141-4261-9047-c4d645d034db", "value": "6144:Es/2WX22TR72tKbxGerkr2rlsy+vbEFXYvlx6xJkUjnKd:Es//Gi7/rgDvQFXTH9Kd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652720307, "uuid": "470c9b16-82eb-4e5c-b146-b8d9acfb4fa8", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652720307, "uuid": "0ffdb713-53ec-4a83-8b15-18480c2634b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652720307, "uuid": "e1cb92a5-0aa7-461e-997e-d612d2fe18f8", "value": "5e2304aae6f027792915a19b350d0120", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ad040f-d506-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1652698533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698533, "uuid": "075598c2-5365-4c0f-aa75-78a75f85280c", "comment": "Malware payload (AveMariaRAT)", "value": "4804af2231d94b9b1e4c8af0cebb2b51", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698533, "uuid": "5ebd03fe-5cdd-4fc8-96df-7a97252c6509", "comment": "Malware payload (AveMariaRAT)", "value": "1c01c5a95d637bd542273db79548f463e2821fda9c82d972050754b68c0025e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698533, "uuid": "e607af92-89e5-4831-9ef0-911a4ab2d323", "comment": "Malware payload (AveMariaRAT)", "value": "5eb85567666b800a06aa68e3691611e14ad4e329", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698533, "uuid": "9a1fb614-fb13-4a15-9781-ccc09a2878c1", "comment": "Malware payload (AveMariaRAT)", "value": "236010534a44efad67513882d58645ca000009c159b574eed5ec21ba7dad500e620f0183e710794932b41df4c20d6e7a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698533, "uuid": "1c31ac25-168b-4c22-a5ee-7442d1f7d963", "value": "T1E9E42380A7BC8725E4BE57F56B2200550AF9B225D4B3FF2C1CD7909E5D73B018A44EA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698533, "uuid": "d819ea46-b7d4-48c6-94e4-b2fc088f96d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698533, "uuid": "3f11d427-91c0-403e-84c5-9dc5dec70a11", "value": "6144:N1QIGO5YQvBq/CKWN3I0E4hTaWfr1JA1rrWN7amg549I+Cq5C6CmzfRUX7JaXXH6:EaZIShWugfqAeQJOH6v0wkhcVhT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652698533, "uuid": "d7f09c64-bbeb-462c-8685-12c03d730e0a", "value": 719360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652698533, "uuid": "48466bb7-9613-4da2-970a-d9153365a1cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698533, "uuid": "e9f3ded5-a8c8-4d05-8f15-ac2c69ff74b3", "value": "4804af2231d94b9b1e4c8af0cebb2b51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d20cf2d0-d517-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652705882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705882, "uuid": "5324383b-dcb8-4610-9753-5f3bf4e47afd", "comment": "Malware payload", "value": "46fdc4b60fb66337835940cf1d1d91f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705882, "uuid": "9377dd38-07d5-4658-98f4-36405d5d5668", "comment": "Malware payload", "value": "1c60192be3d193617aadd61be5be552a5b24e46e50492b04eb889ed1f6fbd81d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705882, "uuid": "1979f8a9-1925-489b-b6b0-2e793c818f36", "comment": "Malware payload", "value": "dafeecac1988de92d55095d5c7cbe6cd8ccda7e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705882, "uuid": "490f1c68-9fce-42e0-acb9-ded530ae52ce", "comment": "Malware payload", "value": "edccaf425aff6830a43ed03c6d48eab146739a167f0667b0b2203b5df1aea5c0faec4c3315728f6e20e6bda20f09dbb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705882, "uuid": "e0bc3fa6-8e0e-487c-a4fb-53ea1160e050", "value": "T1B7162303F792C0B1E4AA00B805664A724E76BE724B69D5E3ABD07D5EAD703D0F73254B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705882, "uuid": "dc3f7509-206e-46db-b4af-160b586ddc88", "value": "1ff847646487d56f85778df99ff3728a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705882, "uuid": "95feb058-139d-401f-bee7-77a3eb638096", "value": "98304:Q06FOznLo0+Dd6uxcQnTTgWz/Z0ipvsEcCG+gp8o5nZL:Q3F6n80W6uGQnTPXhk+gph5nh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652705882, "uuid": "b6e26712-b010-4593-bfe7-272e14bc78e9", "value": 4114243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652705882, "uuid": "bf9aac5e-cc04-46e7-b13f-895f7d3bcd13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705882, "uuid": "e8aec8e4-f910-42d3-8aa5-cc3b8ce91e91", "value": "\u70b9\u51fb\u5b89\u88c5{\u7eb8\u98de\u673a}\u7b80\u4f53\u4e2d\u6587\u8bed\u8a00\u5305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "239d336a-d501-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1652696141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696141, "uuid": "9b7db1f4-fd3d-48ed-b535-1672a701a01c", "comment": "Malware payload (Quakbot)", "value": "872fa72c0b181a44edb770cb0785dfdf", "object_relation": "md5", "Tag": [ { "name": "green-a-thon-com", "colour": "#E9E599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696141, "uuid": "3bd648bc-c4cd-4104-b965-375120e5b3c1", "comment": "Malware payload (Quakbot)", "value": "1d3067be2fc116a61fedb1b2aae1bbe4b11d4ceadc2a63b578d731a818e81f52", "object_relation": "sha256", "Tag": [ { "name": "green-a-thon-com", "colour": "#E9E599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696141, "uuid": "a36c93ed-bf5e-452c-aff3-ded5f986edbf", "comment": "Malware payload (Quakbot)", "value": "5e08caf353bdfc90804b73942fcb047b75dbfc63", "object_relation": "sha1", "Tag": [ { "name": "green-a-thon-com", "colour": "#E9E599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696141, "uuid": "bb9ef151-d5d3-47a9-8fbb-ffadfff45c5f", "comment": "Malware payload (Quakbot)", "value": "198d0a7bc733c0c275f72fd21c5063bc7b6292b4aaf470ee036838cc80c0e000fbaa0d7084e56fa3e420fa918d86cf0a", "object_relation": "sha3-384", "Tag": [ { "name": "green-a-thon-com", "colour": "#E9E599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696141, "uuid": "31b6bf08-a7f9-4ac8-9879-d20c19c77ed8", "value": "T1F2018603B83CAF85F0157132ECF26312792166407751D68B1409188EAB4BFFDAEE79E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696141, "uuid": "1f6e264e-5198-4f1c-8119-929e1eddeb4a", "value": "12:5j3wuMypeg0nVHsTsTug+Bm5Nswd9qZOKlw3x6suuaA3+vZNEM8EHlcad/:9dMNgGV6M5NtdIrq3OpAOvZN7vH//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652696141, "uuid": "939c8c8f-50a4-4565-90c1-2d8d15c38821", "value": 843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652696141, "uuid": "3521f0ca-5e68-43a1-9a0b-8e82c53a79ef", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696141, "uuid": "08c50cd6-4c5c-4ada-859f-368cdf0eb74a", "value": "U4047649430.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d0d00b-d549-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652727123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652727123, "uuid": "fef57071-dc14-4785-8522-fad54af40c35", "comment": "Malware payload", "value": "66fbace11c2e7aeb6b6fba7e6af88c0f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652727123, "uuid": "9d253c46-d85c-4e76-88ae-c3062fde3b64", "comment": "Malware payload", "value": "1df16c0a1a57684769e43abe96bb4c27e8f70e61f7741350d2291d14cac5ae93", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652727123, "uuid": "ac579466-a8c2-4c9c-bafb-f3c440358ea1", "comment": "Malware payload", "value": "29b3f5cc351153dff74f11d3e9922602192c423e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652727123, "uuid": "a3bfd5fd-a624-4506-8159-f4eb8b518a95", "comment": "Malware payload", "value": "340a5cbc17520f9a8bb9aab3ce4c39d07fd8c556523d748355c2c1a5f23f81a792e3802f7345f8848690bd32f5032e39", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652727123, "uuid": "a6c334b9-c0bb-4075-9906-648608a355e0", "value": "T192145B24E59314FBF9BB08B290067A5FE8253D11D220DE7BD554CED6BF21B25910E22F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652727123, "uuid": "c9771fda-1c10-48bd-8b88-bab69da57af4", "value": "3072:goNIuK7eF99bS2o5Rt6iB0QYSx+CIsMkMV+iJltatVg7dX7sZ6MR5Mu:tgMjS2o5LYSx+COkMAi2g74hsu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652727123, "uuid": "883e29bb-3df4-4efc-89c7-6525319f4cc5", "value": 194048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652727123, "uuid": "6f39c2b4-88e4-4025-a553-d9f4b3aa3f8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652727123, "uuid": "fccc7702-6a70-4c51-b23b-68a62c0493ef", "value": "1df16c0a1a57684769e43abe96bb4c27e8f70e61f7741350d2291d14cac5ae93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cee9c58a-d4f3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652690415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690415, "uuid": "76e69d76-b79d-4528-bd40-02781557b738", "comment": "Malware payload (Heodo)", "value": "4418820dd4095e3b019d7e75f634095f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "LBGGVTHQI", "colour": "#1C53DD", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690415, "uuid": "ecfbb5e8-36f8-480f-bcd7-d21d5f084b61", "comment": "Malware payload (Heodo)", "value": "1f3fbbb23c28c14ce173d6bf2f6b86f8e4faf89a30f72a5e20dcdee0bbf791cf", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "LBGGVTHQI", "colour": "#1C53DD", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690415, "uuid": "ff0f36a7-bf28-4cfc-8c1a-93a1f6c65782", "comment": "Malware payload (Heodo)", "value": "1c87a57f8fda30db8784cc32369ae9637420c06d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "LBGGVTHQI", "colour": "#1C53DD", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690415, "uuid": "8a467df4-ec39-41da-9abf-e09cb22cb640", "comment": "Malware payload (Heodo)", "value": "3ae31381e3d77c3786010e846a9d186cdbcfddd15c049f567ca2e60a57ac6002074d551baf171f4109c2e126f8e39bce", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "LBGGVTHQI", "colour": "#1C53DD", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690415, "uuid": "587c217e-4a44-4613-a3c8-bec2c023622c", "value": "T17231B9460838ADE8E72A8D71E7508769F8000B46E5B5E5D43D4619E471606FF5700A5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690415, "uuid": "718e6996-ece8-4f8c-9e84-277c387b6a0b", "value": "24:/K9vrwzjcqQOXeJhpvfgGPPfFBsj1+YtsvLSMlxir8znWW0WLhg/:y9vrc9te9gqPbsj1+YtwSsirMWWXg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652690415, "uuid": "d378bb21-d3d1-439f-8ca5-3102c03132f9", "value": 1461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652690415, "uuid": "8000129c-7de1-4f0b-96c1-21aa49b83c6b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690415, "uuid": "23e96bef-abdd-4492-a1ba-87c2e71257ff", "value": "Xpressbees_Form_13_May_2022.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a72acfc-d523-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652710782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710782, "uuid": "4b90cb3a-27fc-448a-a809-e530f0eeada3", "comment": "Malware payload (Heodo)", "value": "0f4d7792cb1cbe6132519445d2cacd92", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710782, "uuid": "afbcfcfd-7ba5-4c45-9a44-784010632bdf", "comment": "Malware payload (Heodo)", "value": "1f5ef0801e5652d3cd88039f8ce2145dd9407af1e910bbdf598005ec1d4a9fef", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710782, "uuid": "792e8142-2f80-4b4f-a805-04ba9d8218bc", "comment": "Malware payload (Heodo)", "value": "23ba52366880044204c6d5cc808e81e5606da46d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710782, "uuid": "b2479815-f069-4c44-8483-2b07a1536d9c", "comment": "Malware payload (Heodo)", "value": "c1383a4b4035ef6e1b6005d0d8b27f89bd633e67ebd5385162cc34733db02fcc858c6f903e10a65facf187905a9b025f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652710782, "uuid": "0c58f8b0-0d5d-4a83-bce0-1301e7f9d2ce", "value": "T1EF84C04673A48079EDB79338CC574A47E376B86907B0678F1364436A9F3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652710782, "uuid": "a96601e7-d963-4891-b6f8-12263a0540fc", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652710782, "uuid": "716459d1-31c4-44c4-9159-b30f4ae53d50", "value": "6144:EbmRW/X22TR72tKbxGezkesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/zpRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652710782, "uuid": "02129001-02e9-4053-b626-0eccd04edf3f", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652710782, "uuid": "77b3b211-1da4-42cf-bb1b-2cabefd41028", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652710782, "uuid": "e94d2407-1af9-465e-8961-79d606d4c17c", "value": "0f4d7792cb1cbe6132519445d2cacd92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f795dc1-d4ec-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652687275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687275, "uuid": "7ae8994f-abcb-4e20-a9b6-a79ef82a4c35", "comment": "Malware payload (Mirai)", "value": "f438d263909255ecbc4e03d27d180028", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687275, "uuid": "9112d706-00af-4a34-9245-b33f9838e5cb", "comment": "Malware payload (Mirai)", "value": "2000777264b14d8cb2f9f7a69ef1dfffa65a8a2f0e5dac49578b1e1da4e1120f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687275, "uuid": "623802a3-b5b2-4b74-9e52-82e8661398ca", "comment": "Malware payload (Mirai)", "value": "428973fb5feeb2721c8ee5037e779ff7eda818d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687275, "uuid": "79ef8328-55cd-4ae9-b533-4d40838b6748", "comment": "Malware payload (Mirai)", "value": "af3e2d0c614ac1225122aab6c4f339d667eaf1432b8689ee114ffdb1a5f9a8a97315a2bcd21265f07f9e1b28f6db624b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687275, "uuid": "2f0f07a3-7b22-4f7c-9a79-b2fc3aa0dd57", "value": "T11792CF0867AE3130C2F08C356FAFCB8B7B6687FC90F63669469D05E46C85E4951D89D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687275, "uuid": "ae6fbdd3-bad6-401f-bb06-252e4c81bb62", "value": "384:Dwo46RQjfCzdiCfmfiS4YliUNG073Cf1wsiGL3nGwhymdGUop5hKqc:8RWbdiCfmRE0cWs/L3Ps3UozYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652687275, "uuid": "642db38b-c14c-4ac9-9d6a-242bbffe5740", "value": 20428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652687275, "uuid": "dd4781c0-6810-4e18-9940-27b16e8b36c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687275, "uuid": "f822839e-f021-47bc-9608-a723a4b7f61d", "value": "f438d263909255ecbc4e03d27d180028", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f11f69-d511-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652703149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703149, "uuid": "53e50156-8019-4a02-b082-f660710dec66", "comment": "Malware payload", "value": "55a687464fe3ec7d718676cbf86a0a45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703149, "uuid": "00a55189-0f92-48ed-ab47-49604c54713b", "comment": "Malware payload", "value": "202f74c5709f94adb5802ff2cf59d30361fb19a564f99f2327122bc4f316fb6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703149, "uuid": "c57a8eb4-53dd-40d8-a3f4-f649bab11366", "comment": "Malware payload", "value": "56ec8ff481009037635b2b79a593184135dd2b47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703149, "uuid": "ef9362b7-39c0-4d1e-97db-4c7ce67768cf", "comment": "Malware payload", "value": "89a883134959848dbb8199996e120cd93ce2d9f35142c34ab0309b2e1b45c3b23c372332d9341a3998906e1d1d6b6f04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703149, "uuid": "63b0d754-45d3-4c20-8010-01dbace9f9fe", "value": "T18F34AD1476A8AF17DA3E97F80025604687FB596F6652F3901EC370F721A1FC486B4CAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703149, "uuid": "d9ac8418-df58-46e7-b3ba-99e1b505494e", "value": "6144:+KYG+H3dY9lSSxmJpSs88qF9Ym7c1K+BmJEI8k:+KYGKqSSScseumGKGI8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703149, "uuid": "6f912c41-1c29-4b10-9e71-206c406ed3be", "value": 237568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703149, "uuid": "087a4dde-19dc-4bf0-8ebb-0cefce01d4c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703149, "uuid": "88eaca43-3f87-495e-89d1-13db7c729f76", "value": "SecuriteInfo.com.Trojan.DownLoader44.59380.3972.30979", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c3f966-d519-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652706513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706513, "uuid": "d307f40e-28d1-492c-9568-86325c1f72a6", "comment": "Malware payload (Loki)", "value": "c672b4f986448da6f293e7b23a9b0f70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706513, "uuid": "7644ea5c-4c9a-4078-bb85-90f06c274845", "comment": "Malware payload (Loki)", "value": "2035f044232be1da59fdc4b43a721faf14e2091b4655c799f3cb67a644069597", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706513, "uuid": "2584ca0d-c47c-4c7f-9497-ecb2284b610f", "comment": "Malware payload (Loki)", "value": "dee8a5634f00c9bab7eaf08c3964f8e8c06bb803", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706513, "uuid": "ae30768d-be91-4bbf-ba99-448a05e8b817", "comment": "Malware payload (Loki)", "value": "be81b24c82ee4664c84b914d0ac2aeff12cb4adcd7b9ad8dd46e022bd56287a65b9772358c59d0648cd9829a2c36bbb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706513, "uuid": "5b0ca84d-090b-4a37-8b8c-abb1770a529c", "value": "T1FC04021063A4D067DAE2AA720D794E719AFAE9322C70D35B4710387BBB76580D71FB31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706513, "uuid": "70291023-52a5-4953-bfb6-ecfd5e587297", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706513, "uuid": "b4cc7f30-bf3c-43af-800a-621a9be5b217", "value": "3072:LODZGPEounbMSzS95AShwWVZx6aYpZy2ldOFbqgrLAu4pxrrc2Kgi1Fcxt7b:LOtIOUPRZEbdOw2F4pxnhKg53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652706513, "uuid": "4e935235-3d1b-454a-b8b8-bccf6ada9f66", "value": 186751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652706513, "uuid": "ed49608c-b9fd-4636-8f44-2367d972d70a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706513, "uuid": "a589bd6f-83a2-4d3c-8180-fa6b85336f1d", "value": "c672b4f986448da6f293e7b23a9b0f70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b72a252-d4b4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652663244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652663244, "uuid": "f82f1824-3908-4906-93d9-abe814141581", "comment": "Malware payload (Mirai)", "value": "44f254f7257ca4fbbcd5d8c0b1efdba0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652663244, "uuid": "6e878823-322c-4ab1-947f-1304d687811c", "comment": "Malware payload (Mirai)", "value": "204a17729a88ae0f7519db386cc6c39a185d317a4d7d6ee5d2531067426bc481", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652663244, "uuid": "d891512d-a7f0-4ec9-84be-3d280de1797a", "comment": "Malware payload (Mirai)", "value": "9e64729d56a7b4e9557b4b358e44e03d99171b02", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652663244, "uuid": "ad39aa2c-7017-4397-9905-89464a7d6e4f", "comment": "Malware payload (Mirai)", "value": "c5c03e07ad61b15cbe7aff1a56675e7eaf09b48435cdda84bc84b41789c35dcf368b9e8e6a56bbb969d2fc4aa2536fbf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652663244, "uuid": "c30b313c-8926-4a63-b0e7-6c26424add73", "value": "T15F431925AD792E26C0D8A57E51F7C214F2E2620E25F4C65E3C720E4EFF04B5069673BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652663244, "uuid": "250716ce-e4d4-47a3-87f0-eeb2acfee654", "value": "768:PaobQ3Qfq99aCWNvzsXHJyaE36WsYP2M94ddlAv/FqO+2UrFO:PaKQ3QfS9aCWNvzopyH36vYZxF4PO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652663244, "uuid": "095deced-bb0b-46c5-bcae-6567d003ce80", "value": 59828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652663244, "uuid": "136972d0-c7df-409c-85a8-429bafa8fb35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652663244, "uuid": "36d83d7d-0c05-4fa0-aae9-fea4b80396ef", "value": "44f254f7257ca4fbbcd5d8c0b1efdba0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e911cd5d-d507-11ec-8e58-42010a9c0032", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1652699049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652699049, "uuid": "14f39bed-047d-4a4e-8538-031f939ca015", "comment": "Malware payload (YellowCockatoo)", "value": "a9f61790cf9183c9e226826a59cc1bd4", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Vespero s. r. o.", "colour": "#ED7836", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652699049, "uuid": "ecb9f6f3-f682-4a43-a6fc-bbc7bfcd3150", "comment": "Malware payload (YellowCockatoo)", "value": "208dbfa91c08f9ccb31ba5cac0037d6794a26ce0bfd57393accac18b4c63c90c", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Vespero s. r. o.", "colour": "#ED7836", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652699049, "uuid": "8f0da375-ee2c-406a-a737-556da4915962", "comment": "Malware payload (YellowCockatoo)", "value": "b3004e6818d9beb19b52a793c93f00e23b54813d", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Vespero s. r. o.", "colour": "#ED7836", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652699049, "uuid": "e25c9636-be4e-40ef-89e6-c0478c7bfb49", "comment": "Malware payload (YellowCockatoo)", "value": "c7dbf96a48d94fd09dd790991bcc0eccae5aada4cf5321bbafbb267b0aadb7a33d653146f7054b8211e2cad9e788b0be", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Vespero s. r. o.", "colour": "#ED7836", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652699049, "uuid": "4535f5f0-7308-4dfb-b6f0-900bac252827", "value": "T1AB25125EB8126F49C215D8AF1D8F89353C9B02BF6E929F17703A79539FC0ACAB01541B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652699049, "uuid": "65ff4abf-c5d6-4fde-a657-07e49d31566c", "value": "24576:i8dJjlOSi3csuGTyfjAJ4jQgkPAdd8Klco1k/2wx+Ob7S:1drOSqcfvkJSkPBKlcgXwgf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652699049, "uuid": "9f9f514a-5d51-4c0e-8708-454f027cf5d9", "value": 1043103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652699049, "uuid": "9ec8fef5-6b16-48ee-b6ed-42efc30931c3", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652699049, "uuid": "6b3e6d90-0c7f-4263-ba9c-7c6618ded9e2", "value": "b0e233140b6da4899838b5804b6e009bf7ddcf95437b452ca2bbeeff857275b4.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "008c98e2-d512-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652703383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703383, "uuid": "8086d72e-26f6-4717-9faf-0e0a43c9a09d", "comment": "Malware payload (Formbook)", "value": "9a907547b995e9c535d0aaaf0f74e778", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703383, "uuid": "d154fedb-6667-4a0b-9f03-ee1467a722b1", "comment": "Malware payload (Formbook)", "value": "20ca8b1ffd72e35c7d595101343c2ba229e52d461ae7818980d0d5b87ea20c1e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703383, "uuid": "9a6e42cf-9ace-4d94-a782-2c57bd4b8b59", "comment": "Malware payload (Formbook)", "value": "a000e662d8b7842d6162ffb3a8f8c40918139c7c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703383, "uuid": "28ff26ec-6720-40c2-a2f5-c65df11fb07a", "comment": "Malware payload (Formbook)", "value": "ba6aa61acf15b1e4bf9b7b25de23508b9b851bbbab4d0148108d5b64cfd048eff41083cf22d011d576a02441e356cc37", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703383, "uuid": "d841e4da-a686-4f9d-9c4b-04438455f153", "value": "T135241207F5BE3FF9C06949FA2279CAA63014EFC01AD6D660710076A85CB6D85E236C96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703383, "uuid": "b4b33deb-1b98-4115-8e6a-80d0f6951bf9", "value": "3072:uvx94O6FwZ2dyzGelGzw7uoxsh5flxbTFYxbIlPyoFUEcfbvmYtkafROVAaXCXFr:rOQW6yzGeMpYaCRMzqOVz/2lp60Hma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703383, "uuid": "3538513d-c15c-435b-bb17-4af0325f718d", "value": 228968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703383, "uuid": "96dacaeb-c7d5-4535-be0b-8bc5f565d9ca", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703383, "uuid": "5b558850-699f-4390-ab20-0978b1932e17", "value": "Quotation.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a9c04dd-d4f9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652692690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692690, "uuid": "b769013a-d6cd-4e45-b1e5-1fc4a6f55d6f", "comment": "Malware payload (Formbook)", "value": "4e08a65130d0aecafc18aedd82271661", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692690, "uuid": "0548dc75-a9a1-4bf0-9602-3880d9d99956", "comment": "Malware payload (Formbook)", "value": "2191a4ebf32c079a54233a65aa7bfb67e1b8824e03e9387e9c843713c6e927f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692690, "uuid": "8466bd00-a649-4410-a3af-3f1960c25de0", "comment": "Malware payload (Formbook)", "value": "34a54ca421d83295691056f83195b59bde5809b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692690, "uuid": "25b44565-8d23-4edf-9112-f4396b3843e5", "comment": "Malware payload (Formbook)", "value": "7986fc211045cbc09f74b48b3be867e944e64239ca53cfdd76c68619e0dafc84f705334815d501c349af540de950b6b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692690, "uuid": "2911906c-416a-4388-99e0-a484742632fe", "value": "T1F9158C4072D8EE99E42A52B1C975C4F00371BE0AD576D60F29997DCE38B33836266F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692690, "uuid": "7ff0ed2e-1712-4750-8b5c-3f76ff33b70d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692690, "uuid": "96729f4b-4ec9-4d94-bd08-a0162bb7fcb0", "value": "12288:4jvmIDfxt7J0kR7zKC7NyowgD0btfVNBGtgnnpWc:Y2kxKCcvgDUtf4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652692690, "uuid": "338cf98a-3cd3-4b4b-aff0-4c64ff50dfb0", "value": 923648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652692690, "uuid": "fb7ced35-22a5-46f4-b73f-7645e4edec59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692690, "uuid": "4e6532fb-e74a-4eff-a87e-ce46a022aab4", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2434506-d511-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652703252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703252, "uuid": "4056e13d-07d5-4b9a-89ed-3c6773f314e3", "comment": "Malware payload", "value": "76ebb44c107db63b153e680bb69bf206", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703252, "uuid": "0e38d777-fca4-4c99-a6dc-be28ae279585", "comment": "Malware payload", "value": "21a0f6e416f200901b3ea4258fb592c861db6e5f6d718bc637d23c430f2673b3", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703252, "uuid": "199ce914-bfc9-49b1-a51c-6ab554ac3986", "comment": "Malware payload", "value": "2203e7ec53446ed0449d9c7ddfbd2ea8828c0d64", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703252, "uuid": "bb1fcb16-ecf7-4177-a893-f604080e2428", "comment": "Malware payload", "value": "ef21377cccf6a1a9411a200c6ad3334c640ea42f9707505aeffa60186502a24dbaabe863ac6a3f0f74f71f63f3567ecc", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703252, "uuid": "07453967-c6ae-46e2-9455-8adce22b8772", "value": "T18424121036B4C3BFFD4592B634845E868B61DCB6C88560DC647E72AA36F89FC250197B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703252, "uuid": "f4f8fb8a-1b9c-4513-9830-a2403e7a6541", "value": "3072:rQFA0VuQ+M9uuyYALKY/kMGp3aaxARuige3cVq0Oh5QIw47MgrU/N4St3Rs4Yo:EdfPTALzXnuiHd0Oh5bRMXN4Iv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703252, "uuid": "5972ba41-16b1-437c-ac69-16a67c0b8d30", "value": 229080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703252, "uuid": "037f713f-7528-4384-9219-ecbef7dfce07", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703252, "uuid": "95c824b7-3b13-42dd-a2ae-8c94b29e9f35", "value": "PO M456.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c01b3d6-d4fb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652693739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693739, "uuid": "7cc4b15c-9740-4ab7-84c1-22e449b173c6", "comment": "Malware payload (Mirai)", "value": "fe297dfa9681190371d3c67fa66b1940", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693739, "uuid": "a1a577f1-8841-4407-b8e9-123746a641b7", "comment": "Malware payload (Mirai)", "value": "221e2f949c0e8684541dd22d6ad2dcecb5ad9ee6a538f5fe63c04790531729fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693739, "uuid": "d3be36a8-e3b0-4059-ab2f-2f9f67a5ab1e", "comment": "Malware payload (Mirai)", "value": "0fb90073543e6817c21b488c2d83dea06c9cf9cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693739, "uuid": "7160caa7-851d-418e-accd-82fae1341579", "comment": "Malware payload (Mirai)", "value": "7cc27f922671953f376c53da803419f4c95cdfe8e3444f1622f599a71fabf2c11137af6434e290d93078d7c5b3133dcc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693739, "uuid": "ef9c03b3-c9a5-4c31-a152-ec3c79ed0204", "value": "T13D834B31693D2A17C1D0A47E12F74758B2E22B8E25E8CA5E7D720E0FFF54A506413AF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693739, "uuid": "6301d811-fb0b-46d1-b597-ba61ee7efe47", "value": "1536:/AYX5uNKUq1et03jRI5AnZPrqPSj/sYxJmsPE3udoSc/a55F:/pRFJDsYHj83udSaZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652693739, "uuid": "1e3983fb-6fad-409d-8729-c677d693871d", "value": 80864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652693739, "uuid": "82b0a22a-3ae5-418e-8e4f-6823356c394f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693739, "uuid": "0c6177c2-23c4-4d8b-ab9a-25a0d79e0713", "value": "fe297dfa9681190371d3c67fa66b1940", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee5da39-d4ee-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652688026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688026, "uuid": "70a7a61d-3f94-4b7e-a226-2eff7df2d6bb", "comment": "Malware payload", "value": "7264d52e81a8b498fd94b20013631741", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "pixelmon-pw", "colour": "#765B0E", "exportable": true, "hide_tag": false }, { "name": "pixelmon_pw", "colour": "#378CF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688026, "uuid": "029c7d54-d6fd-4ff4-8db3-7e5853e6f2d9", "comment": "Malware payload", "value": "22fcefcbfb303ed8e5d43b78dd318852174f0317acfef49ae70f7379a402fca3", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "pixelmon-pw", "colour": "#765B0E", "exportable": true, "hide_tag": false }, { "name": "pixelmon_pw", "colour": "#378CF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688026, "uuid": "cd3411ad-381b-49b8-95a4-91c54b076435", "comment": "Malware payload", "value": "6a52143b918816f50cba3395e8687060c59b117a", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "pixelmon-pw", "colour": "#765B0E", "exportable": true, "hide_tag": false }, { "name": "pixelmon_pw", "colour": "#378CF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688026, "uuid": "43349178-1e69-4e46-879f-852c6aef765f", "comment": "Malware payload", "value": "9e7522c8e2406ef4b1e73d8f57d9bf148ddae20aa2bdd98541493466d30d5ef95eb6ab36a93c7e450f9134cc2488c72c", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "pixelmon-pw", "colour": "#765B0E", "exportable": true, "hide_tag": false }, { "name": "pixelmon_pw", "colour": "#378CF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688026, "uuid": "de7c8dd8-0a11-4c4c-b83f-7bb4318d3cc9", "value": "T155518634D7D6431AC37A8E77EBAAA3459BED7D03AF687D9F02020144446D200D9E563E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688026, "uuid": "f8f49c44-8b0c-4ff2-a52c-94f430954cf5", "value": "48:8TyYpfOIPnyWoW5rrWVePUcPPSwlX9POlKrQ4259Pc4cTMT82r:8THtnFLw4PUSPSQNPKsQ9PoTMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652688026, "uuid": "db29d5a5-5131-48cc-a2de-d06a084e6c36", "value": 2853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652688026, "uuid": "32d86e19-133f-45b5-b1bd-edb4e326b68e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688026, "uuid": "79e2a955-2aba-4aba-81f4-6e29b0e72916", "value": "22fcefcbfb303ed8e5d43b78dd318852174f0317acfef49ae70f7379a402fca3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc8984b0-d4d5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652677526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652677526, "uuid": "deec3f4d-da72-4bc3-8245-36a0c0fee43a", "comment": "Malware payload", "value": "7b6754df3f9834942056be1ad8345559", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652677526, "uuid": "5db62931-83fa-46a7-9327-dfa588c48e08", "comment": "Malware payload", "value": "23148223a4942d237bf53166b1fe8c369f692afbcc663f0047151830c3d5640b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652677526, "uuid": "3ef6dc3f-471f-475f-8a3d-f1d8d2377f3c", "comment": "Malware payload", "value": "07c8f18df8750dd3ba16a505fe0bb14864557585", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652677526, "uuid": "8aa5df2a-1f2b-49c8-9d50-816eb9ee5498", "comment": "Malware payload", "value": "2a07b12a92127e965b13d75d7aa173128fba6fa8f8490eb3d36b04bb774818c5f606f37615886fea06de337d1ef36fa8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652677526, "uuid": "f875e9a7-4871-4057-bebd-19734c45aba0", "value": "T15CF054D64BA117880D24C1560831C1007EECF22C6F4E1130B29EF0C62312745FA83010", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652677526, "uuid": "1538116e-4874-463e-9e5b-22b7a723cdb8", "value": "12:3zsg9czaPtfJ19/GFKxwQv98nfPCwqdbqi7wL2gLUJF:3p9cGVfJz/GF0wQV8fKqiULtLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652677526, "uuid": "e50f6466-2124-4c5c-b6e1-7a21e34434e4", "value": 574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652677526, "uuid": "a06bcca0-09ba-495c-99d5-1212ec92980f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652677526, "uuid": "a65b7667-5a24-4c8a-a77a-043bf21b0163", "value": "detalhe-lnk-03.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2edf91d-d550-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652730365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652730365, "uuid": "9b84e8fa-2d4c-4d7f-8332-85b8bc510b84", "comment": "Malware payload (Loki)", "value": "55b04496d5f0c19479df60da23c3a458", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652730365, "uuid": "e431ed21-2917-4287-9bc8-2e2b14497261", "comment": "Malware payload (Loki)", "value": "23fcc81a1e6959408a947a598a153414d1d01a5df6e959acab3266b8167f47ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652730365, "uuid": "2630f42a-c1ad-4008-8958-ff0cb0bc8f3b", "comment": "Malware payload (Loki)", "value": "8eac20d166121d990caca8def254b08b22687948", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652730365, "uuid": "0eeedd42-748d-4dd6-a6ae-9bc999866577", "comment": "Malware payload (Loki)", "value": "acea86e7b20277749f9efbe6fc79101c0b2f45dfc91ea7688b37e66e2c10e264d1464ab630c682e82eabd1bcdee56dbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652730365, "uuid": "1e135741-0baf-4ed1-8dce-780ac288fcdd", "value": "T135622C2533941377EB7A0F36AC638AA18335E3819D6A9B5F299C541EAD637810F92730", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652730365, "uuid": "2ff8ee7c-f7cf-4dde-9651-34a15e053d36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652730365, "uuid": "eaa3cf24-787f-4515-8f1c-613d1b4d39d9", "value": "192:67GW+WG9PIoYYXpiTt/zaXvYeYqU4VlzLhvav8t4+SA5A8x9sEwuzlmt/:MBGuA0aXvYeNLVlPZaHAFxlwuzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652730365, "uuid": "7945361a-2ef4-47d6-9239-d6d6f9887a72", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652730365, "uuid": "343fcb43-6cbb-4a09-a3c5-6b1769b13fc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652730365, "uuid": "04b2cc21-06fc-441a-8c85-0b372c4ba1c2", "value": "PO-DMMS000692021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7df3e5e2-d56b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652741819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652741819, "uuid": "1f9657f9-7713-4120-8fb0-e69180a8a062", "comment": "Malware payload", "value": "77e2c571f69b8d5ae4420f0a9587d552", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652741819, "uuid": "8753d812-de82-4232-8343-0673bc0045c3", "comment": "Malware payload", "value": "24ac830fca3beda7e177874f4f64348774772bc097ca3f5752d7942ed8053e95", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652741819, "uuid": "09126a24-0972-4967-bd68-a5a66b39139a", "comment": "Malware payload", "value": "0e968e42a24a438456cb30a26957a90750a126c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652741819, "uuid": "44305721-a83f-44f3-81bb-29b0add81b9f", "comment": "Malware payload", "value": "a262aa72b293a38ad22b750a394af4624a1561724f1280eb3e7aace733af3e33a89d5ae25cb954e2b9ddc8a63444928c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652741819, "uuid": "967cab0c-58b9-4f40-a1d9-6414620a2a3d", "value": "T13684F817EA64A419F6478872DC686676182E2C7224C4AD07FBC1BF4D34726E3B8F570B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652741819, "uuid": "8faf596f-d26a-49da-abc8-698c911d7128", "value": "100c285276fdf60de98eb5b8bdb7d95d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652741819, "uuid": "f36d7ffa-781e-4c39-abb3-97db5848bd7a", "value": "3072:anFJyxkOusy1/ML0ZP/T9pd5K9q5SpUdyvEnozZLaXIH64ejjj3kbPFooPDr:anHDZP/xpd5I/Uc8nohk3jceor", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652741819, "uuid": "3ae65f63-81c5-492c-992e-96e91cf30c22", "value": 372736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652741819, "uuid": "90cbffff-438c-442e-b8bb-9f08388a7178", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652741819, "uuid": "a4b87c61-60f8-4bce-9f88-fd1927b032e6", "value": "77e2c571f69b8d5ae4420f0a9587d552", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f4fb24e-d4d8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652678739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652678739, "uuid": "cc2e5e8f-adc7-433b-a4db-deb73dcf7bf1", "comment": "Malware payload (Formbook)", "value": "e815bfb9469d43d389cdd898576562b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652678739, "uuid": "10cf45bd-324a-49d7-a055-43fe942a9edf", "comment": "Malware payload (Formbook)", "value": "2534d307050137b4954836f24f6d43b38c0496979197c07a977336206701f44c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652678739, "uuid": "aaac1222-612b-49bd-9061-66d89ebcdd63", "comment": "Malware payload (Formbook)", "value": "8357a1843dd02ffbe7868d7b6a147f756f0c2c15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652678739, "uuid": "111cb4d7-af38-4d2e-9185-353e3465ce76", "comment": "Malware payload (Formbook)", "value": "41eb3ee5ef6664f112f572ec5552aafca9ed9be1023d4b70ad9517c15f2fbb3c5d3ef70683e6f9fa66820ca53cf04772", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652678739, "uuid": "4da1269c-b195-4a73-9aa0-0695641065c7", "value": "T113C42244B7EC4322D2FE6F32563649010776B026A512DB3F5EC684D52E33F0AA79678B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652678739, "uuid": "935f1965-7ead-48d0-a48f-759a303f1b8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652678739, "uuid": "63a13518-c0bb-41bf-a241-4bb12ffffd80", "value": "12288:q0YSUia+oNXWUMB1+AZQa8g79xU3eyAnKMNjUZIvRWpcKyDfJmfb9hW:5YSUK2i7R8gJwAnjSZAKyDhGDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652678739, "uuid": "a4068181-ee84-4ace-8244-4ee6b5cb43d8", "value": 548352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652678739, "uuid": "5701991c-d23d-4968-a9dc-84da16eddfc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652678739, "uuid": "05649cc2-7fc4-4f81-a7dc-8e04478ce704", "value": "OSL8979.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "267f6086-d4e5-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652684120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652684120, "uuid": "22a95d8b-a568-4396-a9fe-0ba0d998e5fe", "comment": "Malware payload (SnakeKeylogger)", "value": "2f05fa62aaa0f2b7ec4b51e64c3379f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652684120, "uuid": "5c1fbe30-99cc-4a14-9b5f-300d323526bf", "comment": "Malware payload (SnakeKeylogger)", "value": "2593e2789e86fde67233e3216154bb98055699e927c09129af41ef019571edbb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652684120, "uuid": "eed8758d-6373-42dc-b70a-40f481fe2939", "comment": "Malware payload (SnakeKeylogger)", "value": "f375aee819ff78d912b1528e511d17911e3bec88", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652684120, "uuid": "257d67ad-1bdf-4275-8e6d-913099b19ec8", "comment": "Malware payload (SnakeKeylogger)", "value": "77e835ce4aa5c68063a7a01e0a69f318e990f16db84cd1e8c0185fee2822326da98adb1c524999abeccf54854f19d894", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652684120, "uuid": "cb2c6e39-cd4e-4253-8f1d-199fc6329b90", "value": "T18E84D0AEE3108409E8A8777798B793317705BDA17AB7C35B51E5349B8837BEE7C401A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652684120, "uuid": "a7bb81be-c93a-4d4a-8570-f020861c928d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652684120, "uuid": "ef6e112a-632a-4c43-830a-8449214235ed", "value": "6144:Z8Kdo40ldq4vlir0oN2fFzXx0Lqrt5fHecYWZ1oOdLPliy4Ovh0dh34tqF4:Zg40ldqFrjN2BxGqrtNHjT1LTb4OveLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652684120, "uuid": "d498cff3-2b6c-445b-a6d3-d98f6402a138", "value": 387584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652684120, "uuid": "521fd75c-7003-4d59-8ab5-bfc622c4b8c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652684120, "uuid": "d6a61b24-e3d3-4f8f-a574-9f6a970717a2", "value": "2f05fa62aaa0f2b7ec4b51e64c3379f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "954d82eb-d4ed-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652687741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687741, "uuid": "72a2210c-5000-44e1-91d3-df3372ed0ddd", "comment": "Malware payload (Formbook)", "value": "b16a07225f173691dc2261eb3c4b019d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687741, "uuid": "37f70c21-3eab-4bd8-b705-9d2e274d3430", "comment": "Malware payload (Formbook)", "value": "25eeb802abf823d4836eade09779e221790692500abd83cb011f8a4b87d46c95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687741, "uuid": "26046fcf-d6b0-4799-b687-5506ecf960a4", "comment": "Malware payload (Formbook)", "value": "63186d171baea7d96fe02dc975931d9e2fea9c78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687741, "uuid": "94bfd8f8-c48c-4c5a-882e-a569415f1a09", "comment": "Malware payload (Formbook)", "value": "dad92e5295df438a50623bbc548ba0648046f30a2c6ee181a45fe39168589c252e5499d51f1f94819a2a5aa29bf56c7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687741, "uuid": "477b7eb2-c686-4e20-8ab5-67f104f2ed5b", "value": "T10B056BE3629185F3C7370237CD66A6258A317E70AA24640D3B9C3A4C5E37291FD69DE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687741, "uuid": "23581787-ee04-45dc-b6a7-f8d726097d0d", "value": "7f1e726bb60db85d5f0226a392c472c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687741, "uuid": "89542f49-941e-413f-9665-d726ab3bcca8", "value": "12288:GArA/9qa8l9JrFc6mQliFGUzLQhI/OgMbWmuXCd:GcKUl7rFmzkhMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652687741, "uuid": "a2e8c55e-6686-44a8-8bd6-6dbf3416a8e6", "value": 852992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652687741, "uuid": "214cac22-254f-4914-a9d1-0bcf29aa0e77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687741, "uuid": "ae05df1f-eed5-4aa8-af22-4ae8571458a7", "value": "FedEx.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16273de1-d53e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1652722317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722317, "uuid": "c94dae22-ada6-46a2-8ac4-f18fa8845732", "comment": "Malware payload (AsyncRAT)", "value": "a6ceb5436928a0695fc5126c24af8c5d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722317, "uuid": "854df902-ea48-447f-a290-4ff45ffc0f2d", "comment": "Malware payload (AsyncRAT)", "value": "261520e803c971d1cdbfa5ed220f634f46a211a5f69768dd8463085aa986371c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722317, "uuid": "f49f573c-857f-47ab-83b5-762b1e9295f7", "comment": "Malware payload (AsyncRAT)", "value": "3acb2e1f8921e566be034bcc64848ca58374db92", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722317, "uuid": "08fbd18b-0d7e-4275-9557-1dc864f53e74", "comment": "Malware payload (AsyncRAT)", "value": "ba2b8b65160c24ca128f9e7e0024eeabce3ee9f21f32183078300c1a41d3539c3bae770ec752fcd13e671480367efe76", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722317, "uuid": "5e8cb4e5-892e-4716-84a7-cca261549d66", "value": "T11565C01077EE4626E1AE3736DBE719402B7BF4921B10DB0F2669A2FD0C237426D5731A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722317, "uuid": "95545bb9-cc03-49f2-92fe-a5823a88b7b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722317, "uuid": "0e44b60c-7515-424e-acde-8c329ac6d31d", "value": "24576:3d1TFzH9L9K666+TSDEwWVz8DxgkF1zxnBFin9co/lzSAXaBC:3d1TFzH9M55+37alzIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652722317, "uuid": "b9c7413f-f5d9-4392-8238-bfde6ff4d653", "value": 1409992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652722317, "uuid": "478ed92d-755e-4c54-9548-2013e06bbb44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722317, "uuid": "a1e24b7a-0b88-4b51-90e4-484aac10d53e", "value": "a6ceb5436928a0695fc5126c24af8c5d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "486ae1b1-d51b-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1652707369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707369, "uuid": "9411b251-0ee6-430f-8c9c-cd984e5e5487", "comment": "Malware payload (RemcosRAT)", "value": "275e9b6756b393c890f7ef0c07cc4caa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707369, "uuid": "165cc800-0da4-46aa-9b52-e42e3149bfa8", "comment": "Malware payload (RemcosRAT)", "value": "2682222836b5d284955176401e14dba7b8af056ee4db520c1fc51305c192da81", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707369, "uuid": "8ed91ac3-e20f-4806-b867-0b9ec58450e8", "comment": "Malware payload (RemcosRAT)", "value": "f502b2c14b8faf3916f2c461305c64fa72071c4f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707369, "uuid": "d0069fe2-fbf3-4142-8ba3-ca62e7a11147", "comment": "Malware payload (RemcosRAT)", "value": "b0e4b113f959fb7de54d9944eca9258f070dea859e109409a598a2ed2e648c844cc482f5e0cf7f62f5d1c333101c0d77", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707369, "uuid": "b3dd1ed3-b864-41e3-bf3b-f0bb7bf170c3", "value": "T15705238537ECF3B9D07A19B0BA31448602F27E951DA3F79E5DD3318B0A72F062E05269", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707369, "uuid": "9641bb92-03ce-4b1e-becf-d0aa7f9c6b0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707369, "uuid": "744ccc99-3472-4b91-9515-ed4081b4bdc6", "value": "24576:kIG1kxBII3RodEaMNk57Z17Metc0xPU8DbbSTUIfU:kIKkxBII3qaMxZp1htPDbbSIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652707369, "uuid": "d0ce797e-c831-41c1-a344-1a405e89f6ec", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652707369, "uuid": "537f05cc-3468-4472-87d9-f0986b2d98fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707369, "uuid": "def77caa-769c-495c-9566-6833a9e1d0d0", "value": "275e9b6756b393c890f7ef0c07cc4caa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b89f3a-d541-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652723972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723972, "uuid": "a7101948-cfa8-42a7-a724-f8c375d2d74b", "comment": "Malware payload", "value": "33270580a55e91e846814278890aede0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723972, "uuid": "42a79aeb-5a19-4ed8-87dc-93c53c9fb4c2", "comment": "Malware payload", "value": "2717d1f9f936a4d344d27f85e14952f64368798fc462853b42e4fcb6474a994c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723972, "uuid": "a8e671ec-3f0a-4921-99ae-49aa75cca750", "comment": "Malware payload", "value": "f373bdd12d7e398fa542637e936527f79ffd3214", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723972, "uuid": "07cb6492-5d4c-43b6-be09-b063c46c56aa", "comment": "Malware payload", "value": "257c1b5df4f921d4700c61a9782fc2974c3c89b6ccc2ff8a21104788e405f873ec9b1276b7b25b7df321bce4c06c4e75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723972, "uuid": "4cf72a8d-6737-4237-b3ce-786016218a5d", "value": "T17684C04573A48079EDB79338CC574A47E376B86907B0678F1364436A9F3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723972, "uuid": "f87747fc-918d-470a-9fa7-df813c12fb9d", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723972, "uuid": "ca6d33fb-bca1-4830-aac4-7a4af9495b58", "value": "6144:EbmRW/X22TR72tKbxGeYkesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/YpRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652723972, "uuid": "4428bbf2-1a77-484e-a5c4-3edaff317625", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652723972, "uuid": "1859d15c-d54e-4b6a-b02e-13ea800bda80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723972, "uuid": "4bf167e4-74bf-4339-b192-01dd5e731459", "value": "KH53J4KejCvPLnpys5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78591df8-d527-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652712604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652712604, "uuid": "93aac604-fc41-4795-a974-4d242ccafa0b", "comment": "Malware payload (Mirai)", "value": "2c1f96365cc9b478d1102dec0d1431c7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652712604, "uuid": "343138a8-e4f5-4f35-ac93-706b41cc8808", "comment": "Malware payload (Mirai)", "value": "27783e223c593be220bcdcc63cef23c8678f37c250ab920e5e4a6ea8400470e2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652712604, "uuid": "083442e2-dfe6-4c9f-97e1-4307baa7872b", "comment": "Malware payload (Mirai)", "value": "8956a316ff04a79ee69ad1949596331fa5f45732", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652712604, "uuid": "fcdee874-5126-424c-9707-f5aa31296f26", "comment": "Malware payload (Mirai)", "value": "1c3c36d42b72d2c656b78c6448e9c9ae4a51642aeddf3a5d7c96049ce6c14ca16c4752fa9733aefef0099c7ad8f6beed", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652712604, "uuid": "325a315d-8f92-44d5-abec-947e6346d868", "value": "T129737DC0A643D9F6DD0246B430B7FF329A36E1BB215AD9D7E3E99633AC41142D10764E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652712604, "uuid": "648fae59-c42b-4551-87a2-54334efa2b77", "value": "1536:l4N3Z7UN0cuLisEogeAPIfu1CQuyUUH9cdET6ciSLkg:AAN0cuLiseeAPhCQAUHCiTLkg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652712604, "uuid": "2055c43c-7af8-4f67-bede-88e99a78cd54", "value": 76404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652712604, "uuid": "c2d8b91d-094e-4bec-83fe-72a84c881c30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652712604, "uuid": "44e9820c-4234-4685-b256-51082809658b", "value": "bin.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a8f7c9b-d542-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652724016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652724016, "uuid": "fb016458-1acd-4b11-902f-f0f3b5b62851", "comment": "Malware payload", "value": "0576d3f85c010c62238bdb3d30825dd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652724016, "uuid": "eccc6b41-c8b0-4bb9-a73a-181fea381e51", "comment": "Malware payload", "value": "2779dbeff72d95abd2f569e19bde7ec40438dc84a7becd751e277489b592a345", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652724016, "uuid": "93270635-c6d0-4846-bebf-554a6ec8f0ca", "comment": "Malware payload", "value": "e14bd16be2adf5f1e949aba8f4c8fa84edb8af2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652724016, "uuid": "925c8e36-f35d-4d8c-acad-23d15abb7555", "comment": "Malware payload", "value": "ef795adfd1ac2c2f3edce2480ad0f496f20ff3adb22162a8cf00b3479891e1b72d4a3c96ab703aea0b88d47b92b1f06e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652724016, "uuid": "7e7eb566-08c4-4178-96e2-771b0e88ed64", "value": "T16684C04573A48079EDB79338CC574A47E376B86907B0678F1364436A9F3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652724016, "uuid": "13e28149-fccc-4e9e-82c5-5a5d04a5f03f", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652724016, "uuid": "c6fb4b4e-a772-4e6e-b779-8d027b5a8326", "value": "6144:EbmRW/X22TR72tKbxGeHkesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/HpRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652724016, "uuid": "c6b3dd70-2ab1-4b82-a0fd-833675ff7e06", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652724016, "uuid": "a7179577-0c5d-4b62-8646-7e971123dabf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652724016, "uuid": "c6398754-0a14-4f5e-a850-e340d4431100", "value": "ulhkhemlC.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79f1fcfb-d527-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652712606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652712606, "uuid": "c970e6fe-7070-4583-ae17-32dd222d1520", "comment": "Malware payload (Mirai)", "value": "2f05aba3721489ddc129e93c1ce981cf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652712606, "uuid": "781e54c1-9399-44ef-a2d7-2fe6a08f4d39", "comment": "Malware payload (Mirai)", "value": "279b4e8af382ae05e66e267fd19dc2ae19c74a68ac145d34e6658d068a0b8307", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652712606, "uuid": "1075e5b6-bc6c-439f-88c8-e0d3d723917c", "comment": "Malware payload (Mirai)", "value": "4d4686d61b58ff304dc38e15f51cf464f9bb3082", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652712606, "uuid": "93a208d5-9f8f-4ade-af2b-2e8d38903901", "comment": "Malware payload (Mirai)", "value": "19406041fdfcace2d3a9a95b43f3e0c17f274a934130ae0912ea68bbe45d3959ae4c0b3d4516c0515ea3b2c811a30f65", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652712606, "uuid": "1f7ee89a-3b08-41e5-9f4c-687d891b054d", "value": "T1E9833A56BD958A23C5C422FBF62E528C372553E8D2DB3103AE211F653ACA42F1E37A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652712606, "uuid": "c70ebca9-38db-4d2a-8c90-577fbeda1d8b", "value": "1536:8r0zNDJAC+scTtKUZwrlnre0OD0r9Jj5LXDJLn2GBTiWaAc1AKdg6cika10Wf:8r0YXsEcUZwrKDALTx2czEndgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652712606, "uuid": "0f7b0f24-60ea-4d83-be64-46da5b1a457b", "value": 88672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652712606, "uuid": "fa36e99b-8165-4ccf-aaa9-ce2478ee46eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652712606, "uuid": "17c11980-1c3e-45b6-9fc9-bc881c96b7d8", "value": "bin.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78099624-d53b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652721193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652721193, "uuid": "06c89903-5823-42eb-852d-1af473bd79a9", "comment": "Malware payload", "value": "a7de72f549e7e03bd454988c8bb0a902", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652721193, "uuid": "fdee19a0-0f93-420b-98cc-f89646b7bf31", "comment": "Malware payload", "value": "27ada021a3b354c1c21ea75ee4e8a48669515a2912185c451f14794e346467d7", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652721193, "uuid": "22ce2055-24fd-4ca9-84d4-5803907652b4", "comment": "Malware payload", "value": "c7e13b91676dfe9e210e434a93e97560f6a60eed", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652721193, "uuid": "34e09863-67af-44fb-887b-0a4791111c90", "comment": "Malware payload", "value": "1afea122a293e5c2f6e5b2eeb4b9ee3346e27cafa0e0048859f84c5094e53964da4f5966492213c0e00af2d68082ae5e", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652721193, "uuid": "1aa68bc7-1b94-4aeb-ab48-9f66fbf3a9d2", "value": "T17C553A2B486A4B4DD401CD7425383D73DAF6EB835FA49198F575B887CE3E7A900BAB40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652721193, "uuid": "38f76247-117f-4f01-ab3e-07f04a34c750", "value": "24576:FcXOgAWOI04Y4cNackMfRqksDmPukzH1r1CzfBcv:TIbY4cNackMfRqTDaukjx1YfBcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652721193, "uuid": "42ad60cb-bfc2-4d29-a240-8293d2aa2a3a", "value": 1366016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652721193, "uuid": "4c4b048f-a039-4d7b-846d-d94174c86fa9", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652721193, "uuid": "e609cc5d-cbce-45bd-b35a-2740cc698bc0", "value": "RFP_Wolseley Industrial.Project53.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11bd5a43-d51c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652707707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707707, "uuid": "a7145fbb-a977-4fb9-a203-4c0ffc9fc253", "comment": "Malware payload", "value": "1811892fcd6fb94dd64163b50b9de234", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707707, "uuid": "5f414b58-18dd-4bcf-81ca-1838ba92a551", "comment": "Malware payload", "value": "27ae47b49d0946b6537d5337a0eb4bd84fd2ea318fb0bed6fb19bf24cc3e8827", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707707, "uuid": "95e50fc0-148e-4d06-87af-97091ba018bf", "comment": "Malware payload", "value": "922aae0e8dfd57dcd180cd9311d5e84e319955ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707707, "uuid": "4de1a5dc-d488-4e37-8c06-8d2e4ff7a5cc", "comment": "Malware payload", "value": "845667b99235a7a00964d27695d9a567bd4a8ea3d201e8ad7cbfa606f581d10959b2d35fd619434fb477e908ce709c2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707707, "uuid": "c623c509-9251-4969-a142-e7b43d38f717", "value": "T1CD755B992B582F39F849D43C9822D989B7BE36BB76E1659D3E8D76803B170105CF0F06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707707, "uuid": "aec2aaa5-6c1c-4a31-8284-1bd7e570eead", "value": "2825da6b9db172cef0e74a8aa7f2ad95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707707, "uuid": "3fb0901c-517c-4b18-b5b0-41335fa0de6e", "value": "24576:RdRNlWok6o6G+WcK0T0g2sO1RmEwjNf6kgG3H6pR8nga+wQyVEv+Z6r4ZYPP:RTN0H6G+Wkd2sMIxN13HF/wvRw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652707707, "uuid": "04019836-60fa-446a-9386-0e754cd61ba9", "value": 1566208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652707707, "uuid": "3a508df1-857f-4230-8516-8ffed541c49c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707707, "uuid": "127eb538-705e-40c5-a867-7996f0846ab9", "value": "\u70b9\u51fb\u5b89\u88c5-\u7b80\u4f53\u4e2d\u6587\u8bed\u8a00\u5305!MTI=_1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f59dab18-d537-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652719686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719686, "uuid": "11f6a26b-dd96-438e-a050-d3c11ccc28a9", "comment": "Malware payload (Heodo)", "value": "a2f0a57a01b4b7c2be4148244674bf67", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719686, "uuid": "8eae721a-1740-417e-b8b1-48fa7f6e1d1f", "comment": "Malware payload (Heodo)", "value": "2826aca4524ddacbeb78b8e655f1f51f54aa0a3fd25c5880e34cf41a36488eac", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719686, "uuid": "da13ea92-dd8b-43da-acb9-5050d58edac3", "comment": "Malware payload (Heodo)", "value": "4ee6140cc1b7474b268a6a7e83a2a5a3642db227", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719686, "uuid": "6eef9239-06b1-448e-8576-d3f1ae631a13", "comment": "Malware payload (Heodo)", "value": "802763c8f969d2d5dceee3fae632a8ad707ef6b895c0115c13968ffb26397849a6e981ec68da746280848644820afb69", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719686, "uuid": "60e4127c-0d8f-4d5e-adda-bae8dcae9b17", "value": "T1D484C04673A48079EDB79338CC574A47E376B86907B0678F1364436A9F3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719686, "uuid": "31529d76-6ac3-473c-9952-d54f3d1d24d2", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719686, "uuid": "91824b2d-baf8-441b-8780-149a81d0fd30", "value": "6144:EbmRW/X22TR72tKbxGebkesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/bpRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652719686, "uuid": "bba404bd-8a5e-41c5-9c13-de7dc9e2c2bf", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652719686, "uuid": "581e1270-0407-40bb-bb62-32ecb621f276", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719686, "uuid": "ea44f027-b2ff-45fb-b9dd-e3b545d424c7", "value": "a2f0a57a01b4b7c2be4148244674bf67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "185aa23d-d4f9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652692686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692686, "uuid": "09a95091-e0de-4b17-8348-c4e3be967a75", "comment": "Malware payload (Formbook)", "value": "25cafbaf2e4c1a1f3099ecda73ec6514", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692686, "uuid": "447793e9-66d3-447b-aef9-0ea28dfa02bc", "comment": "Malware payload (Formbook)", "value": "287701159ec59c886b9b4e0482730816d24a603d78fc355799ab105f8480b760", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692686, "uuid": "2d37da07-cbcc-4e09-beb5-d5f0647cb1d1", "comment": "Malware payload (Formbook)", "value": "eb246533b94a43a3c5cabb2245ad883d8590dc7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692686, "uuid": "6b0795ab-9812-440b-ae18-4cf9b7045a91", "comment": "Malware payload (Formbook)", "value": "da90a54376994d6b284df66c148f7eadf93b608a249bc2d25399f7b7dce30c70aba269a813763d64315038f336ed9d9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692686, "uuid": "7b2e7f9e-d10b-4ed5-9d6a-f1ddacd7635e", "value": "T119C40218A777DD27C2BA23B6D1D0508403B16607F113E7972ED636DAAA123DB0AD1F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692686, "uuid": "0f3cf3db-885a-4078-a9c4-f41204e53246", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692686, "uuid": "08e6001f-72ed-40a0-8419-e7d051f88174", "value": "12288:vEVNc2L2Ikz6A8W61ON80uSpPXgjrsMYLfJhTh4rNwZC/YO:YNc2O+A8W807JwfxYLf3hQe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652692686, "uuid": "1ca6aef9-4625-47bf-b8bd-1a7b277df645", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652692686, "uuid": "cb9ea30e-3d61-430c-9216-703fac362a45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692686, "uuid": "259c8466-552d-44bd-9883-6cb7c60d1346", "value": "SCANNED ORIGINAL PCO - 6492 - A1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9834a896-d4ad-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1652660258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652660258, "uuid": "2af396e8-dbee-44c9-b37d-d4cc5ad90cb0", "comment": "Malware payload (RemcosRAT)", "value": "39405bf5cd157858f25ccb94cfe2dcbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652660258, "uuid": "5cb84575-af29-4aec-9788-5519ed2e6228", "comment": "Malware payload (RemcosRAT)", "value": "288b1eab3026050ee178211ace5bf2e8cad9d85773ffc056929cd7b6fd3bd029", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652660258, "uuid": "141e4111-16d7-4cef-a7a2-71dc0586dcaa", "comment": "Malware payload (RemcosRAT)", "value": "0b6214ca217f05082de7c059489e1885e9a9830a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652660258, "uuid": "e0d83f25-b479-41db-8913-5b33a039b5ca", "comment": "Malware payload (RemcosRAT)", "value": "b429ed53bf4bdb02549607ee78fb62acf513cc0c7c34e79e3bb5dcb08e781f2aa36f98606aaaf7d48306ce5c9a8119e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652660258, "uuid": "9fe3d835-64ab-4633-ba73-4d573b69a861", "value": "T1C9F412907E54E80BE761093689D2FE298BF8BAD519F24747BF28555E3D387C88E0E704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652660258, "uuid": "447a5f41-492f-4c6d-9cae-a1d7784d5465", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652660258, "uuid": "1a174ca7-93f3-4f00-be10-c4c5478ff3d9", "value": "12288:OOjOvadI5Ke8YvX6PJ+MbQuD+J1mWkoM0geV25SW5viIN1xO0dzJU2jBygE2nq+:OOSi1+PKG0WkoMCVI7viSlJfFs2nq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652660258, "uuid": "4615b320-3a25-4cb0-8137-7315797096fc", "value": 783485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652660258, "uuid": "575b991e-79cf-4ad9-9b47-db42d3ee5a58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652660258, "uuid": "bd3a3875-e62c-4c3f-895d-a9ad3f020213", "value": "6901324.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02017c3c-d53d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1652721854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652721854, "uuid": "f37e5bb3-5e05-4745-8fab-37bca9776ae1", "comment": "Malware payload (Quakbot)", "value": "8a56eb21fe347dede3932571976bd824", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652721854, "uuid": "979cc77e-373e-40f8-a01a-eeb2ec495de9", "comment": "Malware payload (Quakbot)", "value": "28b57b028cdb6556ee8d180ae990022f887f3194a749b1948c522e48d3e06fec", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652721854, "uuid": "509adb19-42d9-494b-b3b5-5313ec67f782", "comment": "Malware payload (Quakbot)", "value": "b494e2b72e5c013c4eed2aae7cdc549e9de284a1", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652721854, "uuid": "3a9220ec-0923-4b4e-b449-5de702b48c4d", "comment": "Malware payload (Quakbot)", "value": "b4c2f926759e41eabd309833c6c99b314ad3688456b1346c80e80bd14bfd23a9081ac306175ab1ffdd7e9bbfe94176a4", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652721854, "uuid": "232327cc-a1fc-4c1c-83e8-6cb47d0508f2", "value": "T1E8E4AE22E3D04C77C1772A799C2B7768A839BE112D7899C72BE42D4C4F3568136362B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652721854, "uuid": "4e710a49-2b67-4db2-8688-149985104ea0", "value": "df2c97204ed982b8b3e7393fd2a71059", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652721854, "uuid": "e588e66a-fbec-44b4-941f-73d903c1360f", "value": "12288:ED25c7bMl3XyN6VqX1bFJf44pnlG2LniES2DY0HZyHHsPNQsifQu8:G8Aw3CowXrJf44pnw2Ln1jY0HwHHsPNK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652721854, "uuid": "60fc625d-378c-48d2-ba34-35930a317e0f", "value": 711801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652721854, "uuid": "8922cba2-7ff1-478c-beab-2d6acb2cf66a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652721854, "uuid": "936c7e74-9601-49ae-a274-2c622d79974f", "value": "28b57b028cdb6556ee8d180ae990022f887f3194a749b1948c522e48d3e06fec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc768d53-d53d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652722274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722274, "uuid": "4c29411b-72dd-4355-853a-7ca8cdef034e", "comment": "Malware payload (Heodo)", "value": "93082df5dabebeac32d290435948fde8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722274, "uuid": "389cac01-0c7e-4202-9cc3-358494e7e24c", "comment": "Malware payload (Heodo)", "value": "2926f440fdc70715bcb5be366e1960068a7e149a2ed7161fbb4def95ab2d175b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722274, "uuid": "550f0b59-233f-4b8c-985d-50cb8ca223c2", "comment": "Malware payload (Heodo)", "value": "fbe2c15f9a3ab66ff426392728d16d67fa4ea35e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722274, "uuid": "0cc6754e-9603-4d5f-97f3-3f80f73d14f4", "comment": "Malware payload (Heodo)", "value": "094fa13ba76af0c66646b0594b902788e30773835ef813f3a6104f6cbbeb4990193a10b2f3eea2e4e0ba46e7ff2f3874", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722274, "uuid": "3cf0d067-7aee-4dec-9e13-1776fc4632c5", "value": "T1CC84C04573A48079EDB79338CC574A47E376B86907B0678F1364436AAF3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722274, "uuid": "f67930d9-63ec-4ae6-bfc7-57a6245d079a", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722274, "uuid": "bce32376-1ed6-4c80-9ad0-71d8e1cf5942", "value": "6144:EbmRW/X22TR72tKbxGeFkesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/FpRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652722274, "uuid": "cc6cd9e0-b0fb-48c6-9a29-26ed2faf670a", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652722274, "uuid": "c4b2ed22-e46f-4bae-af2b-c43b9b7cec23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722274, "uuid": "a13a315c-f30e-4db7-9b9a-1f4d181e71f0", "value": "93082df5dabebeac32d290435948fde8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "347139b5-d4e8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652685431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652685431, "uuid": "7385f967-8fab-4ea8-a2fa-cef820917aa0", "comment": "Malware payload (Loki)", "value": "6b652bdcd4da5e522480b3175938b26c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652685431, "uuid": "a51ea52b-b9e6-49b0-9b2b-dabebc5e870b", "comment": "Malware payload (Loki)", "value": "295c7dda6e10a88f9600251ee00494baab8703bd86f064298ab150feb49c3b15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652685431, "uuid": "34c0b87a-7bdd-4574-aa14-c5bf197ab8be", "comment": "Malware payload (Loki)", "value": "ac2580682511d1b7b22791764412e57cbc8bfcb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652685431, "uuid": "90c98d56-77eb-4d81-a22c-e30fc4ff83dd", "comment": "Malware payload (Loki)", "value": "bbfd84f0726bbc4ca9d0e0b17d9d317c540d19f5dd9de13026f7d56fc3a90f85ca1bf0e0cc8e694f3d7f5b80b9187e0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652685431, "uuid": "633c4078-f2bd-4736-acfc-488fc6d46f4b", "value": "T198040200F7F0C2BBF0A267325D7B97371FAA8D120568961B1B9466947E32742DA1E3D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652685431, "uuid": "3ed9d5b3-3a92-4929-8103-b2565bc7c879", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652685431, "uuid": "87fea2b6-6540-4af9-9cc7-7d3f9d920c1b", "value": "3072:LODZGPEounbaMtN0b3Zx2OlDbToxnTBiiLwbDsoLVAFHM+IknjsMDv+uV:LOtIOP3Azv1UxTBBqDsowHXNgMbb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652685431, "uuid": "144304b2-ab0d-4862-bfd0-ba285c98d421", "value": 186898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652685431, "uuid": "174aad6a-67f4-4eb3-be18-a12edb8d0cf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652685431, "uuid": "f8b5baa8-20bd-4473-a9f7-96a650fd8907", "value": "Swift0022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56f49fba-d4d9-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652679047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652679047, "uuid": "6375d9f8-5766-4ca9-87b5-909cb3cdaf16", "comment": "Malware payload (AgentTesla)", "value": "0a06ac098ab448323f130184e744ceab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652679047, "uuid": "b303c99d-4e7b-406d-ad9d-f020c39572a3", "comment": "Malware payload (AgentTesla)", "value": "2a0767471616464cd417aca763961cb7cb7ed22ec096931afae4af1adcb1f700", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652679047, "uuid": "576863fa-687f-458f-8800-0894ef80273f", "comment": "Malware payload (AgentTesla)", "value": "7bfa0b2e934b90d53b8408cbd34812cec71b4209", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652679047, "uuid": "86183559-4050-4b1f-8d54-596158fec724", "comment": "Malware payload (AgentTesla)", "value": "c51ce92c21ddddff5bf40e2232e006b23612e6d340b005e60a2c315eb46cbb0c5792247252b201b2ab37e7025c7cd279", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652679047, "uuid": "6f198fe9-2406-4f05-a591-e5e7eb1d075f", "value": "T154B2648D5F44825FFBB39EF9B9AB921333B6AD8A5371A3174498186D582F10718B3D0C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652679047, "uuid": "791d4adf-4ae8-420c-b8a5-12acc0dd927a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652679047, "uuid": "9646c003-2c73-4fe3-8817-c20d5db7d29b", "value": "384:LeGIKbakU3eZcWwL4lWkVDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDyd3:5Ig04lWkVDDDDDDDDDDDDDDDDDDDDDDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652679047, "uuid": "e03f66ed-126d-4180-b5b2-3989450ae85e", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652679047, "uuid": "070ee656-d147-4402-a520-259708f9fc86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652679047, "uuid": "c3dc0c03-f417-4853-84d4-d04d6a42e8ac", "value": "TransactionAdviceReport 20220516-9910.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82e67830-d4ec-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652687281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687281, "uuid": "c11df81e-30c6-453a-9c6b-fe8cc007d6ad", "comment": "Malware payload (Mirai)", "value": "ce664494ad74e3580e36e34bbcfc0b85", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687281, "uuid": "617a40fa-1da9-482a-86f0-6cacd46234dc", "comment": "Malware payload (Mirai)", "value": "2a87e1c78db87d283f79adff2d5e4c29e085dd7e931fbb91326af22e8ef7ff0d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687281, "uuid": "680e235f-72ca-40fb-9508-caa5913e6aac", "comment": "Malware payload (Mirai)", "value": "d196a74e3c331cedd70f526c848b1b883b292bbc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687281, "uuid": "cac1fd58-c1cf-4331-8ffb-82002a2444e2", "comment": "Malware payload (Mirai)", "value": "32256befac21f3d7c0509535eed3ff6f2e14289bc28f63a4b8101232590920a6b8c72c77553a6e9414936b0fef49abda", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687281, "uuid": "be5e75b0-29eb-4c8e-be20-ea3fb87a16d4", "value": "T171338D7685B89E58C6208574B516CE399322F004866B3EFB9785C785E00BEFCF1987F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687281, "uuid": "f4522a7b-2b8e-42d0-bc0c-867bc7e5d0e4", "value": "768:7aD+seHehneywPmOluN15dBGWIYbzofs3IG+/8MZpCEAoVqb8ICbQ:7a32knFwP27BGWI8ofs33+/vvV7ICb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652687281, "uuid": "83afb1c8-a099-4261-a079-3fcee6174c7a", "value": 52708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652687281, "uuid": "e13d201a-150d-480a-af3c-843b03cdfb92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687281, "uuid": "cdd3b6d8-f023-4afd-bc12-d93ae121dc1b", "value": "ce664494ad74e3580e36e34bbcfc0b85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e996ba1-d50e-11ec-8e58-42010a9c0032", "comment": "Malware payload (STRRAT)", "timestamp": 1652701904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701904, "uuid": "5221878a-f32c-40f1-9559-c150c1fb8c0d", "comment": "Malware payload (STRRAT)", "value": "5533ee981783efa7a5ab7c8812d8a0c2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701904, "uuid": "f15ed78e-7f7b-4d44-b541-00f8af5e41af", "comment": "Malware payload (STRRAT)", "value": "2a8adf70bd23802e4df9a58f4f42567266abb923aa9e35c16473c9b657ca44cc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701904, "uuid": "2166c5d5-2de7-46e6-9241-01b3a7a90eb9", "comment": "Malware payload (STRRAT)", "value": "d566e05842c7d0468b5dc031202b5d2bb720105e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701904, "uuid": "1d46431d-76ed-43fd-ae86-5e0f305a2815", "comment": "Malware payload (STRRAT)", "value": "d73e3f051c9ca05e097f8eeec882715179348f9968bc04ec880dc320359421ce3368a7209afcd7fdb06ab339fa27d6d0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652701904, "uuid": "49909481-99d6-4eac-902b-b9f77e0cd524", "value": "T161653BBC5740FC435ECD9A42BF06BFB500335A57866D258BC66BBAC808B49938875DCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652701904, "uuid": "352101cc-3e45-4504-874b-ec263563e64f", "value": "24576:ll0+auJ+iRBcFRkaqjAKWuj+91cnsBp7tyy2Wp0ymBRcWz38w+TVeierSt588xA2:a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652701904, "uuid": "7bdd2f0b-9192-4706-9e41-d228bc732fb3", "value": 1482790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652701904, "uuid": "34099a67-fdf1-40b9-b335-89723c2509df", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652701904, "uuid": "dcb93b62-fab3-420d-a79e-e6196b9f76c9", "value": "Statement_0219.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb980e40-d52f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652716179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716179, "uuid": "15b1a672-f889-484e-b273-dede13047fe7", "comment": "Malware payload", "value": "58be3771325a88581dd782a44766d6ce", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716179, "uuid": "0fd640a9-7be3-4c52-8a0c-bdd603baf411", "comment": "Malware payload", "value": "2a95dd8d6f73b0dc1a1a6b28ab0e314e7e3d83ee16ff249602066cda80a21d8b", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716179, "uuid": "a094356c-02b4-4500-a7b1-2f94f01dc3eb", "comment": "Malware payload", "value": "72c97d2e00b4af43efcacb83626c924074913836", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716179, "uuid": "fb56b30c-6b93-428c-8040-5bdca767ed04", "comment": "Malware payload", "value": "ead8d9e892d56614cea965d8235f979956fff8d5271ed63880d7ed6d9b08bfbd7bbfff62d88b8908b3feab082c59b5c5", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716179, "uuid": "15f13310-1e11-4123-9d30-6f42a8767548", "value": "T1E051AD282EDA6128F5B3DF71B9E876DADD667AB369015D5F0081030B4812E40ED92D3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716179, "uuid": "5182239f-5bcf-47bb-a1cb-5b567dcaae8e", "value": "48:8m/WSc7B8KTSukPNx4sedNk96BLdKzvnAjk2dt6B/vuoWN04ab:8m/WScd8MuNxp96/Kzvv2Hy/N34", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652716179, "uuid": "6140da4c-1f5a-44d5-aed0-0c84e63d41fc", "value": 2632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652716179, "uuid": "967104aa-8f42-4cf4-b3c9-79984d54f0f7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716179, "uuid": "d0f27be4-ef5e-4c30-a2fc-2f60a20770ee", "value": "list-35840031160.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "966418ad-d4e9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652686025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652686025, "uuid": "2bd5f8d1-c367-4818-ad01-945cffa836f2", "comment": "Malware payload (Loki)", "value": "94632752d7b58b4d2235b59506d33eb8", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652686025, "uuid": "d8c905d8-772b-4bcb-9aec-9f71e7b548d6", "comment": "Malware payload (Loki)", "value": "2b2b6594a3f765eade918e4aa085c51bf721c44a19703431c8de24ad2105784d", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652686025, "uuid": "24f72b8a-85e2-47f5-9619-2ecbe04a5ef8", "comment": "Malware payload (Loki)", "value": "187e79a54a00ce3015d9349b631d2e565ab2663b", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652686025, "uuid": "31666deb-46a1-477d-abc3-abccab627cc8", "comment": "Malware payload (Loki)", "value": "2fbd86388dc1dfd7e0fef4ba142187dfeaf83655cafe4de64718effa714314aae35e9ca2c0f005730823b49514d11e57", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652686025, "uuid": "f0a6aab2-f0f2-4d69-b773-930c81c9c157", "value": "T198241214684188C1C3BC87FA42C7047E2B16FD25FE296B056C75B6394136EF8E17AAB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652686025, "uuid": "1841a0a6-3f1d-4dbe-8dae-918e4304f5e4", "value": "6144:za0XfkATloSYdbzydHDeaKNN7o+P7JcSKeVdE:e0vkAG3bWdHWea+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652686025, "uuid": "0e74195a-c52c-4237-bdec-aa25b7a3d3b4", "value": 229592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652686025, "uuid": "a16cbfbc-cbfe-4651-a174-eb73e579152e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652686025, "uuid": "a34d742d-1978-4ce5-9f82-c5e2ed979776", "value": "Q 052-SDF-REPAIR.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5362c1cd-d4cf-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652674746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652674746, "uuid": "8331f921-afac-4fe5-9419-e95cb50f863a", "comment": "Malware payload (SnakeKeylogger)", "value": "4717d8984198f56be46d09f64f4596bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652674746, "uuid": "c78267ae-a731-41dc-8eaa-18cdee44ee0e", "comment": "Malware payload (SnakeKeylogger)", "value": "2b317db474aaa5798fa907d94e7d1cd8a284386c988c924c9f5dd156f21ebc54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652674746, "uuid": "1f0c8fca-59d2-421e-9d30-cccfb10b7e51", "comment": "Malware payload (SnakeKeylogger)", "value": "caafedb4e72e032d980c421ae24abc8e70fbb60b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652674746, "uuid": "43febc46-e3e8-4bcd-b2ee-219971a4e92b", "comment": "Malware payload (SnakeKeylogger)", "value": "b55f421b5114adac0182a98bb956e5f98cb8f4314c3941d3a1d6a8e0aac839fa395c75e4970ba3b4fc6bcc323ce80fc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652674746, "uuid": "6d20d674-d57f-4445-b6a6-e2d84ea1aea8", "value": "T18EB44B9C365C71DFC85BC572CAA85C64EA60787F671B910790272A9DAE1CB97CF200F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652674746, "uuid": "a1b880a8-f2c7-4902-ae74-7833111383ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652674746, "uuid": "8c39e483-3fbd-4390-bb4e-627c531c63d4", "value": "12288:QyxmeKu9ROT4EuGtb40l4Hrcb4ARWtX41F3FlkEQ2iAmEH/D8OnA5ASMnTBuigxJ:Q2Qu9RUTuWdlUrcbGtX4bH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652674746, "uuid": "0c43c37e-8b4a-4afc-a65f-3c14516037bf", "value": 535552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652674746, "uuid": "956a9bf1-109e-4fbd-8eb2-52a0e5e035cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652674746, "uuid": "ed7a88c8-d370-422a-bfab-772dc134329f", "value": "LSSBQUOPG102.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f7a929-d501-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652696468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696468, "uuid": "4933b20c-e97f-48d4-a16a-d12607d2450a", "comment": "Malware payload (Heodo)", "value": "0a8a640b29dcab7e5d94fc2d7645c9d5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696468, "uuid": "b5849b41-5eea-4b31-a6b8-d11283227694", "comment": "Malware payload (Heodo)", "value": "2ca3b4150202167be7f9e3e64a25bf097deea8a9b2b0daade26da5774f393964", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696468, "uuid": "bfd43732-34c0-446f-b754-5b5561ea966d", "comment": "Malware payload (Heodo)", "value": "41bf7bfd040e5c8d21d4bb3a1ec3888b54f6e9aa", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696468, "uuid": "aa78e0e4-0a4c-42f9-8b67-e73f5abed33d", "comment": "Malware payload (Heodo)", "value": "31836b2e390ee4c778333912e604725e2785a5400c930cc0d9fd04bdf2627fc33061ea2b91eb2419e1d26baf7df50254", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696468, "uuid": "ebb92be1-090d-432c-b674-a21798abeefe", "value": "T11B055A35FB6C8492C6A3953D88A34B06EE6AFE840B6183CB1290733E9E777D45C35671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696468, "uuid": "cac86657-589f-4d8b-ba22-600e986fe26d", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696468, "uuid": "9fee6e4e-b3fc-4e26-95ed-34780b409c18", "value": "12288:Q9983xKoz0/7aG8GkZHFT1YicDAXmvQaZsbNg:A9UIozAWGxGx16AWvVZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652696468, "uuid": "33718ff5-a7e8-413d-a589-32697189cd1d", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652696468, "uuid": "77c21fb3-caf8-454a-94af-3aee4d8708f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696468, "uuid": "4643daba-2a4b-414b-a50f-37798ab50609", "value": "0a8a640b29dcab7e5d94fc2d7645c9d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a074d4-d4b4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652663257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652663257, "uuid": "53df7271-bc70-4e74-9f7f-dc2c13bb2abc", "comment": "Malware payload (Mirai)", "value": "02588a354ecfa72f1b24a254983f46f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652663257, "uuid": "14b5a3e7-1239-4b9b-8be0-11814be1d8a9", "comment": "Malware payload (Mirai)", "value": "2ccacdea70b0a5918cda541946f18d55def8c16f59696f7a35b777b3c65f65b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652663257, "uuid": "af45f8c0-0f13-43b0-820f-19effb020577", "comment": "Malware payload (Mirai)", "value": "a84b0cea1e410fbd105a157e1c9c7bdc2e566041", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652663257, "uuid": "5d7ec0fa-7a4c-4e51-9341-3e3a4de8df77", "comment": "Malware payload (Mirai)", "value": "762f01bc5bfba6ebd994f795c8b1089788d7e6d213ccc6338524e199c08893801a72ad7ed57642b3807d91078153a089", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652663257, "uuid": "d85b7812-6b9e-4330-abc3-e4761e419631", "value": "T17433290272280A4BF5E65EF0393F0FE097BFF99024E0B584695EEB458536F761486F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652663257, "uuid": "f3351361-45ad-47ae-920c-55498d5a6a5b", "value": "768:JTHz+ANmmo1oRze7TPRItebzyhXsIn3Z6BU8VbOkhA5Llv:R4mo1oRzkjHfyhH3Z6wKAxt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652663257, "uuid": "40fc56d8-00d0-4e67-8645-c994903f6b63", "value": 50964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652663257, "uuid": "ab9f1711-a50a-4b25-8522-7a3a538a1cfb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652663257, "uuid": "d9743e83-a398-4e04-810f-405b8cfe222a", "value": "02588a354ecfa72f1b24a254983f46f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b047d222-d555-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652732454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652732454, "uuid": "47157369-66eb-4848-b1e7-91e50685c1ed", "comment": "Malware payload", "value": "6c91c9a7cb2d95980d588a8809334a60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652732454, "uuid": "e38096c5-6096-4a78-a982-acb6345b0948", "comment": "Malware payload", "value": "2cf4efbd969206e216d4ea001a3dbb54dc84c54dc47472a615abb41e125368ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652732454, "uuid": "9bb0944e-fe60-4bd1-b1bc-46cc0c3f5e0d", "comment": "Malware payload", "value": "50e32edd688cea61e9f82515bb8a2a8a0256de58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652732454, "uuid": "9ba7c1ec-bbd3-4f58-85fb-09bd68352997", "comment": "Malware payload", "value": "2da571721085434858df8d532be2b05d0971edb9ef1105b04fe693a4898d9aff9c8aeaa6ee60eb34309d2a919c991c91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652732454, "uuid": "722fa0e9-0d4b-4083-876c-eacc4967a31c", "value": "T15074C046B3A840BAED678338CC535647E772B45A4B70A78F13244379EF2F3915A3A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652732454, "uuid": "7bba8180-d8b1-46d0-8d99-e347c664e4e0", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652732454, "uuid": "5959f3d6-67f1-4672-a396-33062f909683", "value": "6144:Es/2WX22TR72tKbxGe8kr2rlsy+vbEFXYvlx6xJkUjnKd:Es//Gi7/8gDvQFXTH9Kd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652732454, "uuid": "52dadce9-e449-44ba-ae48-2289e6ab10c7", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652732454, "uuid": "720ab01e-1db1-49fb-8931-a4a32414410a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652732454, "uuid": "cb9e6b66-e038-4622-bdb8-aba91196476c", "value": "6c91c9a7cb2d95980d588a8809334a60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d5236ff-d538-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652719806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719806, "uuid": "7c99292e-a950-4e14-bed9-63253c13029c", "comment": "Malware payload (Mirai)", "value": "f3132064ad0b691d0a1fbb4af97c9783", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719806, "uuid": "3de00062-9a35-404e-b562-5a9811115b70", "comment": "Malware payload (Mirai)", "value": "2d2d40647d3475d5787d75235ca2898e1a77d99f846ca2e22533c677e9417948", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719806, "uuid": "63e98693-615f-4bf6-8a85-28d5bbd0c5cc", "comment": "Malware payload (Mirai)", "value": "ad747466aa2224f3a26f253d2e0bb62b6992fe7e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719806, "uuid": "b2e9cb29-b25a-4bed-9e2d-6192508f73cc", "comment": "Malware payload (Mirai)", "value": "a4b0c776da4bb15a774ab80162aeca1d37a9327f0d9710f6e9c367e31a319a7b3356c64e05b17cbf964749c6b2fd52dd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719806, "uuid": "675908d3-0f7e-4eb5-ac5f-a2bdc072678a", "value": "T1D2D2E14AC04AF462D7B00E39F8368E8537FA8FF7C67568751A094575768230317FA2C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719806, "uuid": "e5641153-8783-4801-a998-79145344f22f", "value": "768:jrz3Fpcoy68+UgIwcTkpGLi8/v7eJxDRUcQLIYNs3Uoza:jrZLhdZqgp8/vSzueza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652719806, "uuid": "8a9504ec-e263-427a-a736-dec3cb3502a6", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652719806, "uuid": "9d614b7e-1695-4513-ab9d-7824ce3c8512", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719806, "uuid": "b410bc0c-f81d-4fb5-af04-5ff9aa52e18e", "value": "arm-20220516-1650", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a92f694d-d4f3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652690352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690352, "uuid": "f771508e-add5-4a93-bc7b-db57556017bd", "comment": "Malware payload (Mirai)", "value": "279e4c5f72a6a5fb391d2d899d69e11e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690352, "uuid": "c4eed953-31da-48da-b3a3-0dee72f50f3d", "comment": "Malware payload (Mirai)", "value": "2d6007bc79daeb2201b392a304109979435cdb0b6767e5ab17c2005d31e51ebb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690352, "uuid": "199c9623-b8c2-4680-9629-483b08287aa5", "comment": "Malware payload (Mirai)", "value": "479c969902fc0df85661bb9fbca23f8a85203f98", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690352, "uuid": "b027384c-264b-41ca-a02e-715fa1344468", "comment": "Malware payload (Mirai)", "value": "d6152954d01950301de5e98d387ec15664e760c8b6ef457616a7db5fec35f78230bfc42c41564e5a89692ce5ccbd749c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690352, "uuid": "0e08eb46-d78b-45f2-83be-4ce766b82d76", "value": "T111A3B516BF310FF7E8ABCC3719A51705198C650A22F97B35BA34D818F64B25F1AE3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690352, "uuid": "0eaa2823-a0a3-481f-b6d6-42403bfcdc8b", "value": "1536:RvMKs9oRHbfZT7EQYQWeSxCvBOy1Cs2ooKfALVZPpzKAz:RvMKs9oRHbfJ7rW5xsBXVILV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652690352, "uuid": "1a97ac4c-2450-44f9-ade0-e290fb24c0bc", "value": 105116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652690352, "uuid": "cc779f72-2bb2-4e99-ac89-56a1c9373139", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690352, "uuid": "db0913b7-50bd-4985-9902-dccf596ff24d", "value": "279e4c5f72a6a5fb391d2d899d69e11e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0efa0a-d51e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652708637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708637, "uuid": "f937dd5c-28f1-41cd-acb6-1c19c2a04988", "comment": "Malware payload", "value": "d0147116e6cfcff1624143a247edba09", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708637, "uuid": "627289e3-0337-44c7-8afe-bde6a5fd26b4", "comment": "Malware payload", "value": "2e749468e71782c24c188c81e04db3cdd5ee0db7a31f55799665e57bf1f24002", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708637, "uuid": "05a50052-5d77-4868-8822-285b9f7df993", "comment": "Malware payload", "value": "030426b91f2631812e49bc584eadb006e1324777", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708637, "uuid": "270dc6a2-f993-4c38-af31-87444d00fe0f", "comment": "Malware payload", "value": "166890d3bd36a2a65a195b23d97e9ff4ac44f588031cd6866d86c2cbef8b8fb5d5a3892216a8b8e0ff07eee497c112d1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708637, "uuid": "3765adef-d93b-44d6-8de8-21733d970e77", "value": "T13FF4BC243B9CD99D8FED5FE9609BD374F72421ABC602B747289070F4CA9AA135B052CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708637, "uuid": "aca8abb8-5942-4e58-9c03-d78fe7500b10", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708637, "uuid": "8921ad20-30cb-480d-91af-889fb08c9b98", "value": "12288:dd1KT6aCd+P6P7LlN2fyFKKP9xbm9JenYlkQzwc9lNfK4T8kGh1KjQ8EnCnqVM:dLKTwdpPlN42aJenYScwcD/DGL8ECqV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652708637, "uuid": "b98204a1-a660-4a0f-a9e8-a857ad75c193", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652708637, "uuid": "871869cc-9ff8-4857-9be8-f2594afb2a24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708637, "uuid": "73b44c2d-3488-43c5-946a-22080a24f1e0", "value": "solarmarker05162022.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ee03698-d50d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652701474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701474, "uuid": "1d828782-c6dd-4bb7-baec-292dcea1a976", "comment": "Malware payload", "value": "d1d1da1639a57a7ef935b5c2d224a52e", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701474, "uuid": "53c0a303-b0f7-4bc6-a75f-653ac222ef1f", "comment": "Malware payload", "value": "2e7edfc7489b19dc8aff1e69cee272dde2cd6f7385adbf70bc283aa43329c802", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701474, "uuid": "de2f9ab3-c506-4f33-bbd9-a654923ecef3", "comment": "Malware payload", "value": "60a65967324c20c5a9cb6ea236e3758b409f4764", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701474, "uuid": "ade196d5-744e-42cb-ac6f-ca46e44e2322", "comment": "Malware payload", "value": "7a984cf0042c2a8090684b66fba0ea65f6d4a8a05bdf64b07816b63d9c6a6cab4d4784e66d669db5cf80e1e2571d62de", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652701474, "uuid": "d24ddab2-2b0a-4781-9715-d0e34ffd9728", "value": "T198F433784345E0CDC5ABC1714AFE0772984AE25AA7BCFC2A4874E007F67005BB3769CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652701474, "uuid": "f5530cd8-6acf-4e32-82a6-de52e4e55e88", "value": "12288:7kXkODV2QM0LOMT1O7667CxQVLCWZzYA7YacuVg9+BdaOLb46V/uZy/wddVsXbGW:h8Z/AmsCxI+JA0acuVZBdJvV/CQw4WkD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652701474, "uuid": "e8d96b09-740a-4f07-b5ca-fc278f1e222e", "value": 775432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652701474, "uuid": "fffcb216-ce44-491c-bfda-aadc164aef5a", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652701474, "uuid": "e4441a97-e9e4-4ae7-acc4-c0b8ea1c2dec", "value": "#Farfli.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c8d9b3-d51e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1652708603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708603, "uuid": "0cb6a96e-6b25-4b7a-bfb0-560541e3e0de", "comment": "Malware payload (AveMariaRAT)", "value": "5bb74b272fa5a52cd23c383541b063b1", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708603, "uuid": "1598fc51-b790-49f9-8e26-2f2c9861da33", "comment": "Malware payload (AveMariaRAT)", "value": "2e987e3a9b9acf4b39c0ed11956481818d7bd758e58d171acb7ed22ef6dfed9e", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708603, "uuid": "0a4fbbf7-78f8-4c11-8a9c-7c23cfa91ab2", "comment": "Malware payload (AveMariaRAT)", "value": "a20ece2e6cbc13902e6df9d0518aba1a8eef5e2a", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708603, "uuid": "d606dea9-c150-4927-b503-7a354d3c10a3", "comment": "Malware payload (AveMariaRAT)", "value": "850a20aaed0ab042d344fb48672d8c42b92f3609abc1982463de9347e18d5120d5a33aae12b29bc3b452c295aad83dfe", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708603, "uuid": "7b8f8b4f-f50f-435d-9bd4-06dff3779419", "value": "T1ECA4237FC69B7A8A6207072DE21B7729AC486A49B9DF2437C27417C54D66EFB8F5000C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708603, "uuid": "fe543844-f369-41f1-b49d-f3d5e0159f06", "value": "12288:ePMQSxlx7bRr7p6j8BxyK4WJIrq+dzmGC:wMQSxlxHp7kj8XdR+dqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652708603, "uuid": "baef7d61-efe8-4361-b0fb-80595b3db364", "value": 454781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652708603, "uuid": "1be9302c-63e5-4583-82f9-0decbe3681bb", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708603, "uuid": "688ac072-bf3c-4419-b1a1-47ea2e3eaeff", "value": "P.O CCJSC10052033_160522TQO.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f395d218-d501-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652696490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696490, "uuid": "9349f136-2138-4627-bd78-c1a14a8ec1cc", "comment": "Malware payload (Heodo)", "value": "6d3ccf6f5ccad8f7438cdd0203fb2b45", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696490, "uuid": "4c3bac2a-e130-4720-872a-6830c37a0acf", "comment": "Malware payload (Heodo)", "value": "2ec24720b407d1ad3140c37754a511b21d6b89b97448ec79e432cd54728d92b2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696490, "uuid": "81790131-bc74-4de8-8ea2-31f8a514f6b8", "comment": "Malware payload (Heodo)", "value": "33a8a153993c9aa4c0933aa0009b4def90923073", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696490, "uuid": "5c941264-32fa-4f2c-9c60-20e021bf7dca", "comment": "Malware payload (Heodo)", "value": "641191ee7933554e9939ed138b0dcaeeb3cedd7494774f541e2c5ea9ac8092807f29ea3b448c36fa77e7b11f5fed65fc", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696490, "uuid": "05ee2ba9-f1ed-4a7d-ae32-f463d545adae", "value": "T120055A35FB6C8492C6A3953D88A34B06EE6AFE840B6183CB1290733E9E777D45C35671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696490, "uuid": "e77ccca3-30b4-428c-a39f-bd463f644375", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696490, "uuid": "552f0873-268d-40d5-8413-e03b1b677714", "value": "12288:Q9983x2oz0/7aG8GkZHFT1YicDAXmvQaZsbNg:A9UUozAWGxGx16AWvVZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652696490, "uuid": "e82aee4b-5db3-47c1-82ec-0b6557d85094", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652696490, "uuid": "0458eab7-0eb9-437c-a9d4-b74ef8a81fb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696490, "uuid": "d4038291-eba9-4f84-9029-4a4904235702", "value": "6d3ccf6f5ccad8f7438cdd0203fb2b45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16fbdf20-d518-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652705998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705998, "uuid": "d6e68a06-6e2f-4632-8529-98a3b530a08b", "comment": "Malware payload", "value": "704b4b6cd2feb9293eacc37a29c4f097", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705998, "uuid": "14c642c9-fa7b-4b0a-b6e0-d3ac80879df4", "comment": "Malware payload", "value": "2eec20801f103b6de003bdf33ccec76c07a2ce73d9f94553a934243c6aaca240", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705998, "uuid": "e65a43b3-4773-4e85-ab55-94640f3eede5", "comment": "Malware payload", "value": "b7c90437ea8ef57fa7834ff48ca94e94835415d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705998, "uuid": "c5061569-9d6f-4a26-91a1-d14edd479204", "comment": "Malware payload", "value": "e06d6d1ee4b36c55fef81c7b6fbc9a4079ccf98d3f9ea4b1adb64f738edbde23d37032366ea89dafe8b2b73cc0fb03fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705998, "uuid": "584aa45d-3ef9-4be1-83a3-23231477dde5", "value": "T1B1758CA8A378FFB8F0DA843494229945E672ED1D06E0C25A72DD76402F7A4119BFDB07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705998, "uuid": "ce5836f9-71c1-4ddb-b8c7-c768dd9cc2b1", "value": "f011a675b78c2cd118f97f4f1b7eaca8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705998, "uuid": "fb06f010-6da1-467b-80d7-fdebde1122d8", "value": "24576:liL+eJyw8xZYcKI9YeqJ8XAAOEvSr18fn1fCbKBiUQkPWThC5vEHRoFA:tZr3NXBFu18P1cKB9ChgvEHRAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652705998, "uuid": "a333e261-df61-4ddc-bd89-872713a3b555", "value": 1678744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652705998, "uuid": "6a22223f-95aa-4fa9-bda6-30aa874262bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705998, "uuid": "eb2436ce-0f65-43ab-947d-867832ec93e5", "value": "\u70b9\u51fb\u5b89\u88c5-\u7b80\u4f53\u4e2d\u6587\u8bed\u8a00\u5305_z12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c8c1c5e-d56b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652741843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652741843, "uuid": "59b9fa4a-fcde-49ac-b928-40f0b4a677c8", "comment": "Malware payload", "value": "f0764f79c05ed114d24ab2b1fb39ec5b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652741843, "uuid": "3da51ec1-0296-464e-b29b-3051c6b9aa9c", "comment": "Malware payload", "value": "2fb54f97136dfbb25a80cc31578d7567a648f5630b2c763b33b4262b545ca1d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652741843, "uuid": "24ea2110-f1c4-4a64-83f6-45af8912a35f", "comment": "Malware payload", "value": "358fe285b08e6f9072894c6587027ad6abfb268b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652741843, "uuid": "f532421e-b666-4a25-acd5-be392ea68a04", "comment": "Malware payload", "value": "790f70a4f42dabdd89a7e5fceb026010e66dc4a656fe0e650550e9052040c84cf6dc2a2f8377aaebcd48622718ff2140", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652741843, "uuid": "b957087d-6996-4e56-9713-53ce244a7a25", "value": "T14D84E717F660A41DF6078872DC696676182A2C7664C89D07FB81BF4D38726E3B8F470B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652741843, "uuid": "1746dfa4-df88-4b05-ab69-9bdd0c84faa2", "value": "5bf79ee07d6deeaabedee0b793ebe960", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652741843, "uuid": "9ab10c2f-4e96-4c55-b1fa-9d1d6f26c3f0", "value": "6144:mJX5bJNZ2e1UpYF/Gvc8aQEQZkEAL/bfX+:mXbJj2e1hVaMP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652741843, "uuid": "b0be6a91-4fb6-4aa9-8905-4287ee809984", "value": 372736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652741843, "uuid": "0ee4e2ed-a797-4066-b7c1-70748348afdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652741843, "uuid": "3787297c-c4b3-4881-ba5d-74c02c71b2f4", "value": "f0764f79c05ed114d24ab2b1fb39ec5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b342fa01-d507-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652698959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698959, "uuid": "dc64097e-a565-4a18-b74c-dfd85a2ad0d8", "comment": "Malware payload (SnakeKeylogger)", "value": "b65007dd03583e7e7e39a3f49f8bdfb4", "object_relation": "md5", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698959, "uuid": "6e90406e-09a9-44a1-b522-9753958aef03", "comment": "Malware payload (SnakeKeylogger)", "value": "305430bdff7037ba0b8f99ba6c2aa5518c0d27b7d691b4a0d335a4e3a30a14e9", "object_relation": "sha256", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698959, "uuid": "7aa3391c-1891-43ad-9ab6-493b175ce08c", "comment": "Malware payload (SnakeKeylogger)", "value": "a8e1fe9ca644f27c3cd37b87f0908d12e4d2c215", "object_relation": "sha1", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698959, "uuid": "02d77976-90b1-423b-a640-fa22f8c4127b", "comment": "Malware payload (SnakeKeylogger)", "value": "9335ed247d2fe2d14fac3584452afd853ee649cf30aa96eef8837a668d4c9fb7ca1457c8a24fd42de24f8ad2ba37f56b", "object_relation": "sha3-384", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698959, "uuid": "6315e4b3-a673-4610-84d6-ec95dcf272de", "value": "T18AA423CB4B2DB8DB395CF7EDD1AD875D7C271E8333EB9008A83103A55809E9201AB665", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698959, "uuid": "3db738d4-7c0a-4820-8152-74f5f1a52e5b", "value": "12288:H1TkbfqVEyeNn5kIK3Z89vnEHxkFgaco78CvyKr4:VTtVEyEn503EvEHIcovds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652698959, "uuid": "55f95274-8ee4-4ff5-89e0-ee925dedc233", "value": 470106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652698959, "uuid": "396cb56f-edce-4352-81e6-25320af94fa5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698959, "uuid": "c18fe3c8-3af6-410b-b8fb-1562c7383631", "value": "RFQ#1952022(BOQ-IT-Equipment.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35ba2586-d4fb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652693594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693594, "uuid": "972d995c-8055-449f-9b4c-008953d021e9", "comment": "Malware payload (Heodo)", "value": "cb33acde67cb14372927df570d1860c3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693594, "uuid": "64de4308-b0d9-4b68-bf85-5798a15af577", "comment": "Malware payload (Heodo)", "value": "316fbe1e18863b549b936b862a046ac585d090bff7011702b7654ef10583d8f2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693594, "uuid": "2597e350-a4fc-43a2-98e2-8ebfe54855db", "comment": "Malware payload (Heodo)", "value": "183dbe2c6d6696adc035295ac017b62cf0899c2b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693594, "uuid": "637ee0b9-2ba2-445f-8117-1afca9db4abb", "comment": "Malware payload (Heodo)", "value": "7191c74e550c3965f20b7836e8d29bd751e7c34ade9aeb8cc05ae5f72819332b2d11816397d1700aa90eface8b393f48", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693594, "uuid": "51a0e77b-42fc-4cbe-bdf5-de76d5a9c272", "value": "T1C9519E282EDA2128F5F3DF7179E976D6CD6ABAA26D025D5F00C5030B4C11E40ED9693F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693594, "uuid": "49ef77a5-296d-4eac-bcc2-9999e637480b", "value": "48:8mOnc3f7B8KTSukPNx4sedNk96BLdKzvnAjk2dt6B/vuoWN04ab:8mOnGfd8MuNxp96/Kzvv2Hy/N34", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652693594, "uuid": "f10b43be-45bb-4a22-bfd2-a1e9bc0a6978", "value": 2632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652693594, "uuid": "61a8b231-d416-4e08-afcd-2cf60d448ba9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693594, "uuid": "31430f7d-f63f-4be9-a130-15110ff96ebc", "value": "report 1679561.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab17e68f-d4d3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652676611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652676611, "uuid": "08c0c9b8-6ca4-4b21-8adf-c350c07bddfc", "comment": "Malware payload (Mirai)", "value": "c746ce1019fc37ae9658d0f77e736650", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652676611, "uuid": "69c7713c-2e96-409f-a27f-8b3d17c868a4", "comment": "Malware payload (Mirai)", "value": "320006a028e996fcad8c2e24b53bb54444f5c617d698cea97af4ac4850d160d3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652676611, "uuid": "efdd09d9-6995-4139-8ae6-c095661ed92e", "comment": "Malware payload (Mirai)", "value": "174bbac0888d5ff18bbeb77d5e1a0acb1a08aec8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652676611, "uuid": "28e3c62a-96ba-484e-9e96-682b6d664d22", "comment": "Malware payload (Mirai)", "value": "06c0b7d969612d2d3e673ec6758b35e318b7d6b13862ec5b5291ac71c9db005e8236d8c856b1fad725a9ea9141acc0e2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652676611, "uuid": "d8998595-1da3-47c9-8fd0-b61a37b52617", "value": "T167330277361360B0CBF11D6BE6EECCC15216AFF05B974E6641308738BDC621929E9395", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652676611, "uuid": "b0c2c8b6-ad12-4422-a13c-7c066cba8e7b", "value": "1536:4WZJ4Ag5CXHT143bnvEgBQK8gsPaL64WX3ati:4BVIH6wgmKLsPaL8Kti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652676611, "uuid": "b510c664-8054-438f-9e6c-649ae2f56fe9", "value": 53544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652676611, "uuid": "16089603-d377-4603-8403-077bd819ce37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652676611, "uuid": "4e99f26e-5eef-426a-a442-ff3fb1d626c7", "value": "z3hir.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b183c54-d531-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652716930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716930, "uuid": "0553f38a-58e0-45b0-9112-13b761b22c7c", "comment": "Malware payload", "value": "abbfffb2744dace581eb1d5b25b36791", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716930, "uuid": "bbf0d5f8-90f9-4bf6-a69b-851c2e59fe4f", "comment": "Malware payload", "value": "3235d07ff7e6560cc220e854ff5f7650f5961cf76850a89b982e4f2300db1ba1", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716930, "uuid": "bce8540f-82bd-4960-9a32-cdbe95e75a29", "comment": "Malware payload", "value": "7f2dd4e312f50450c77ea9616fb5582a41cd78c4", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716930, "uuid": "b9245722-6d8e-4760-8317-436e9baab193", "comment": "Malware payload", "value": "33b9fe2c299d92d446a9f0313b347ac58c852548a82c65ff0fc7ca6cc6e2f57d180e41511d23540a190a1552e5893a6e", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716930, "uuid": "7c7f69f1-058b-41ec-a94e-bf53a6cf7e8a", "value": "T1A001525328DF9108F180B1BEA6BA1C04E12956B2371A40064D447E6121B3C5EAEAF258", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716930, "uuid": "edc81376-0849-4940-80f8-f23b72bdc123", "value": "24:9JyEn8GqQbNhK3ofFuZRESJGWiqKk8jMFXenO2TG/qkl:9P89QDK3ofFuZwl62yt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652716930, "uuid": "0eb4b9a2-b3ce-4228-993a-9ef4c4d9c744", "value": 853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652716930, "uuid": "3c7cf446-c7b0-4c84-b694-3ed20ca97814", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716930, "uuid": "8fc8de7a-ec28-4890-950e-811930ce290a", "value": "3235d07ff7e6560cc220e854ff5f7650f5961cf76850a89b982e4f2300db1ba1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3baaa9b8-d538-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652719803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719803, "uuid": "d0c85a0e-5b58-48ff-b2a6-47acb1d9d792", "comment": "Malware payload (Mirai)", "value": "00ddbf2398b1ada8c6b95520661b8609", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719803, "uuid": "55dd27a9-c53d-4165-a8fb-004eb45cf7ae", "comment": "Malware payload (Mirai)", "value": "32b3712fa30d8e53e9d8711e1e3564d87f9e4d3dd29f64fa1251e68024ac464e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719803, "uuid": "a14a65df-bd3c-4e66-8a85-c9353a853301", "comment": "Malware payload (Mirai)", "value": "46818c2c9ec7ef426dfef85255f1a54655cc1d7c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719803, "uuid": "97188bf0-0e7c-4c92-bdc0-23c3b2260664", "comment": "Malware payload (Mirai)", "value": "bdae31cca8b207afa229515a189894fabf3802f5bdc1dae6531e074d4af11b961cfbf79fbdd9df762f0143d1e59bb2cc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719803, "uuid": "c77bc657-cdb2-4664-b3bb-6f58f0c9ae06", "value": "T1EA33F165E22620E9A3E02A733DB88DC521F1AAB95F7C36176050DF5085B6145277BE83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719803, "uuid": "e49d7f89-1bbe-448d-8980-a58ab30b46b4", "value": "1536:Mvp+sQIB4R4NeaRnAkK7RUSVBpzU7JLmaJPwhf8/gY:Mvp+3Q4CNedkaU0BpzU7JLhmh0/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652719803, "uuid": "c39282c5-fa2b-4e9b-83f7-7a3c9f90ab38", "value": 53844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652719803, "uuid": "70281d46-a5a5-436b-bc02-ba2782ad5282", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719803, "uuid": "064fae7f-ec1f-4c1c-b64a-c06e7eca1edf", "value": "arm7-20220516-1650", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fdd6ecf-d539-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652720293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652720293, "uuid": "d5d4447f-6133-436d-b3bd-19d4e77f6a3c", "comment": "Malware payload (Heodo)", "value": "c16e3edeebf3e0a59dba6a83bd8b2ae3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652720293, "uuid": "243a98b4-f7d4-47f7-9b00-dd74adcdf38c", "comment": "Malware payload (Heodo)", "value": "32e159f61564eaa7a0a6af339008e9bc054448942897e074f4d7b837d8a9ce03", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652720293, "uuid": "3e8e65f9-fbd2-4f3f-9b36-3546154f052b", "comment": "Malware payload (Heodo)", "value": "e4ecf7f8d561ab2d2c5855c8ce72dc7b6c4973c6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652720293, "uuid": "5cb8ec08-e5e7-4633-bb80-69b442e0ac92", "comment": "Malware payload (Heodo)", "value": "e2279b9391530250a1e043bb7f554c70571da7d238fead011b379367bc3d3e1662205218a5d733503dd54fc47d45507f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652720293, "uuid": "9555672d-9574-4b94-964a-39cfa89fe0ec", "value": "T10174C046B3A840BAED678338CC535647E772B45A4B70A78F13244379EF2F3915A3A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652720293, "uuid": "59618225-51e3-473b-b393-5a6fd5f1c747", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652720293, "uuid": "e3e973fb-850e-4061-8ad3-5c426945c24e", "value": "6144:Es/2WX22TR72tKbxGeFkr2rlsy+vbEFXYvlx6xJkUjnKd:Es//Gi7/FgDvQFXTH9Kd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652720293, "uuid": "8972b157-cee3-4e0e-8955-7ebd516501cb", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652720293, "uuid": "8eb703b9-573c-4a29-91f1-28cf1d448ece", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652720293, "uuid": "f81df51d-338a-40b1-8faa-e21fbf625c51", "value": "c16e3edeebf3e0a59dba6a83bd8b2ae3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "955008bb-d4f3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652690318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690318, "uuid": "3b908fe7-5407-4e97-9c77-a59cadfc59ed", "comment": "Malware payload (Mirai)", "value": "4a487c7163440bab3b5c76af306b6799", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690318, "uuid": "624ca69b-5d6b-4a86-baff-1fd3364b9d51", "comment": "Malware payload (Mirai)", "value": "33196db587c2259d10df2734abdf2fda6b78c4128af542dd5dda8661b071c923", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690318, "uuid": "60a08fc5-93a0-4f2b-9507-58c65ac931ca", "comment": "Malware payload (Mirai)", "value": "c2bf695c0ec197ad37aa000ad9847d291978a8da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690318, "uuid": "cb9ad8aa-dfe7-4383-bd0b-d274a4d45f88", "comment": "Malware payload (Mirai)", "value": "ddfdc71f5beffef4b0fd8e6d1355e4aaafdcdbec336d407bc549df5dbc56bceaf7f1483606a39139a26f438e97806844", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690318, "uuid": "39d7a115-0b57-4724-bbb1-4bab97291624", "value": "T188735DD9A8025E3CF95BE5BD94220F49E920231557D30F2FA19AFDD3BDB31589E02D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690318, "uuid": "f19ff64b-c518-4e96-90b3-63060676144d", "value": "1536:maC7WiylhyuspSdi3qw+aQKX4zvK9YNa8k0:mTWiyOrRawvTXT9a/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652690318, "uuid": "21ea6a59-2d4e-4216-873f-69ed2ca14692", "value": 78796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652690318, "uuid": "9a6636bc-a986-42ea-8ec4-f929a9d35627", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690318, "uuid": "3fe187f8-94e0-4247-b3ca-783945fba2fe", "value": "4a487c7163440bab3b5c76af306b6799", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "311bf6d7-d4fb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652693586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693586, "uuid": "ee387ea5-f4f9-4d09-a01c-b4d773cbc71c", "comment": "Malware payload (Heodo)", "value": "7b7350e93607f79f8b55340f11d6a3d8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693586, "uuid": "1e82fb0c-507e-48c7-b0b7-9e3a8ae4eefd", "comment": "Malware payload (Heodo)", "value": "33d32c0e35814e585510031351ca2a7577ceb28079a4e16082aef79f93db9380", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693586, "uuid": "92c11224-e629-4ede-9185-f64f8e986919", "comment": "Malware payload (Heodo)", "value": "ddc85e058a35f1e9321896003c9c1050ee79fbb5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693586, "uuid": "1ca1fdd1-4390-41e3-97c7-507df40e25ca", "comment": "Malware payload (Heodo)", "value": "2c6b16ce85163c01d90206cb21ab56d232f6c17d6cce557e52d3c22a21710569b97bcd71094831d47c09f82c061c8906", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693586, "uuid": "e602fce3-bd02-467a-b095-7db800136f69", "value": "T1FA519C283EDA6118F5B3DF7179ED76D6CE6ABAA269016D5F0081030B4811E40ED92D3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693586, "uuid": "30a76217-3e83-4bf3-9129-9cfcd06458bc", "value": "48:8mbKrbn7B8KTSukPNx4sedNk96BLdKzvnAjk2dt6B/vuoWN04ab:8mbK3nd8MuNxp96/Kzvv2Hy/N34", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652693586, "uuid": "b7d3a9e2-a594-4c0a-9b17-0d9ade5d203b", "value": 2632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652693586, "uuid": "e2784917-1160-43ab-85c0-fece0938f71c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693586, "uuid": "907e66ff-80e2-41db-aadb-e8be3594d3fb", "value": "DOCUMENT 522.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11cccd39-d512-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652703412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703412, "uuid": "69b69d97-97d9-4bab-8aab-68f13734789b", "comment": "Malware payload (Loki)", "value": "6650fa4245f8ffa31a00be6624e6e3cf", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703412, "uuid": "574c32b8-d00a-4afd-84d6-32783e41377a", "comment": "Malware payload (Loki)", "value": "34156a6decbdd61e8a6d39b9b64073f6ad5b8a08c7e66094334e19fdba4550b2", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703412, "uuid": "580bd996-10fe-4a7f-96e5-d6419ad82293", "comment": "Malware payload (Loki)", "value": "d31b71a0878755060fe764ca74cd2969f233d2a7", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703412, "uuid": "2ad5b4dd-d94e-47b2-a790-f8dd6acf5aa1", "comment": "Malware payload (Loki)", "value": "c8b3344e4b78d519ac9f3d99343b5d57d2b0208671be3123612207c3e831425ef41732dce47ff57edd15505e26c38371", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703412, "uuid": "58d4c5a9-9127-4b0d-b37b-acb40517f28d", "value": "T1EC93F12C221E5E3ECB1E067A1651F7BCB550DD223F0E83C95E1039AF157BEAA895063C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703412, "uuid": "6621dd94-b503-4295-9cc6-eedfada80602", "value": "1536:sKtKr468wt9DdLnYDGx+EbBbItufkvJy7oyfMdXsU9YVp82Wzlr:sKoCyDdVhfk4qXsTlkl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703412, "uuid": "e6b14564-cc14-4d5f-a03f-cb015479253c", "value": 96256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703412, "uuid": "dad53105-f93f-4d6a-a3c3-a0709ffab3ee", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703412, "uuid": "897bd6fa-0c6c-413b-a72f-4ef7a5c39ce2", "value": "Payment Advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3265f8a0-d539-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1652720217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652720217, "uuid": "867947f3-b6b2-4f0f-8459-6a0ccf2095f5", "comment": "Malware payload (njrat)", "value": "36369afa80e77990acaecd4a995112a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652720217, "uuid": "d0993bc9-9f9c-4f40-80ab-b52bdbf67af6", "comment": "Malware payload (njrat)", "value": "3434441f773ee5123b242705f95ce6cd367bdc5a19a751884d7b664346252225", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652720217, "uuid": "2adee6e0-0a70-4dc5-aa7c-5b5e2b1b0a94", "comment": "Malware payload (njrat)", "value": "a94b4b3c1c31b57fa16b94221c045f7321214393", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652720217, "uuid": "9910b255-63de-4204-9c5e-67efd53869de", "comment": "Malware payload (njrat)", "value": "45183a13d34909945f385f0159eae27cab4a989d3fba136629dbfc5344fda7ed9e867d3b886f0ffac4b062fa5f7afe4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652720217, "uuid": "de4521b4-9e65-42c2-a1af-2df7f1c36281", "value": "T19DB4F140B2D8D9A5E4BF6BB0583EA4101671BD5FF472D71D19C47E2E69B338300A2B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652720217, "uuid": "4d8f47d5-3274-4f61-8699-7047e1044e75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652720217, "uuid": "34291a51-ce21-4284-87e1-dfb61fbe7625", "value": "12288:lpjpS4FaosVzmKnjuS4GHS9kyrN9SZqJpSAJEdI:lJnFVsVaKnl4GH8nDKA2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652720217, "uuid": "c468eb20-3d95-4dda-bc10-d27cc1dcac2c", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652720217, "uuid": "a239c67d-b785-45ed-a0ed-1b13c297d0bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652720217, "uuid": "24dbee14-d15c-46dd-9f81-dd8a52f2a76e", "value": "36369afa80e77990acaecd4a995112a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad3a9cb0-d515-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652704961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652704961, "uuid": "622e4e96-00c8-4da5-b0e2-d4aed6bb0544", "comment": "Malware payload", "value": "0a412585330f0dd02acc464d80b637ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652704961, "uuid": "e4a74ab3-8ec6-46a1-be96-0d3f032990ba", "comment": "Malware payload", "value": "34780db137a84afc3d8957def954127c724fba4187055e49b875481203b68163", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652704961, "uuid": "5a487f5a-c10b-42c6-bb6a-f8e38a992263", "comment": "Malware payload", "value": "2b3ea614982c5d575e0e48e977652da5e3025085", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652704961, "uuid": "85a0e5a5-8618-41b9-8072-70370cf5115b", "comment": "Malware payload", "value": "81e3fc30e78ac46b5334121e7d0615a10dd9a63dd6e2d7ecba8f14fe61237eb3b0a998a69daabe2e0b248a170ef636d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652704961, "uuid": "7494d0bf-ef1e-4b9e-9724-a066a947e872", "value": "T1CE06CF9D722072DFC85BD472DEA85C78EB5078BB431B4213A06719AEAE4D897DF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652704961, "uuid": "82a65c07-23e4-4a6e-8193-3f86c9b27198", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652704961, "uuid": "e39731f1-7991-41ae-b6f9-18f31498fc29", "value": "98304:eirdpzkZfd4LVEXZFRiK+K87D+AGnkXjr:kl4LMPRi37fBGnWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652704961, "uuid": "2db91d72-8673-4fba-937c-d879575cd8a8", "value": 3819008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652704961, "uuid": "caddf41c-0d22-4630-bf2e-c8e100c8f0dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652704961, "uuid": "f25e6f4c-51ca-4926-bf1f-722bc421aea5", "value": "0a412585330f0dd02acc464d80b637ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4052dc32-d4ac-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652659682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652659682, "uuid": "edd629cb-6817-4e8a-9cf7-3f1032510f6d", "comment": "Malware payload (RedLineStealer)", "value": "959dae3e6c609a62a60b57baa26608b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652659682, "uuid": "81935a7a-4556-4005-b8b9-482e349e3877", "comment": "Malware payload (RedLineStealer)", "value": "348f724a18befe64fae7989cc3ee74c6c763a6c939198313ed394b3bc94e473f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652659682, "uuid": "46236b70-e715-4cb3-977f-44ed78edc4c4", "comment": "Malware payload (RedLineStealer)", "value": "3c9eba0c23e3f8e8b597dbcf23b109196a7c716d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652659682, "uuid": "96680455-1a22-4885-853a-a8f9cb51aa32", "comment": "Malware payload (RedLineStealer)", "value": "e1ef11f8b0e853c78390ff1e1a1457391c248deda7ae05d3a3f8e4ef684be12d8c4339dd23c7f3b588c9e1c7b1bfa172", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652659682, "uuid": "8633f793-1951-40ed-8936-53267439d9e1", "value": "T149C4F10F1FCA6566C1A99A70DBBC64A581F093DF20A4A3EF684152F4DF6178A37421F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652659682, "uuid": "2c14ed6d-2498-4314-9b25-fcc5f10dace7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652659682, "uuid": "856ef9fe-afb5-4ec5-9fd4-422fb8c22691", "value": "12288:3n78LLCgzaucw9KVHOYg696nkArtpVItftO85G:XQLLCgtc4D6mpVIFtOL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652659682, "uuid": "5fadf517-f3d6-49ac-b38c-39b36e246d41", "value": 569216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652659682, "uuid": "5d5a8cee-1339-4807-a043-867bee4046d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652659682, "uuid": "8dfa7b31-c856-4e5e-9873-a91f0fe7af09", "value": "959dae3e6c609a62a60b57baa26608b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dd58ada-d513-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652703942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703942, "uuid": "58b7a203-93e9-4dc7-8fd5-d7629cc5c7ff", "comment": "Malware payload", "value": "c996546c098053627f51a24cc39e513f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703942, "uuid": "a271afb5-f692-4a64-b698-2a09239f8779", "comment": "Malware payload", "value": "34d59c8b0e405d04c0b007680cc8ccd7cdb48594ebbccdd7c6fb037f14060ace", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703942, "uuid": "9b7e5731-bd34-4d5e-a1f3-bda439b6c432", "comment": "Malware payload", "value": "07c68f3621ad4ab2de6856ba06437714afffe665", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703942, "uuid": "e490f5c2-2976-4d30-a120-308d1decda41", "comment": "Malware payload", "value": "9aa89bf05713ad363951e6828299c85474d0eb11294b0fc4a97f37636bf3384414eec30f1812800d34c84d3b13116b08", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703942, "uuid": "f1f5e14b-742b-4db3-8de6-b526ba9dc944", "value": "T1BED37D3CE291B4A6DD9A01334643CBC977722D5B6595826EF2253B0C7E30AB8DF21F15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703942, "uuid": "c2ff2afe-8182-487e-a9c5-ef0e5b0f3c76", "value": "1536:MfIyeVq3zaIeg32Cf2iJ8qDMNtY4g0w9Q+DFIx3c22v7Ic4re6ismIOEQ18P+a9v:gIzVXID32D0Me9kxMFvZUe6ohEQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703942, "uuid": "81216f71-c76c-4e0d-ba2e-1d53fff9241a", "value": 136192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703942, "uuid": "cd5d6798-4322-4688-b456-fa7e23587425", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703942, "uuid": "97f8a33d-3f40-4488-9a1b-947ae744cede", "value": "Invoice IVN 734345204.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eef000b-d4e0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652682094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682094, "uuid": "1c6e79a1-1d26-4697-abef-e10843c31782", "comment": "Malware payload (Mirai)", "value": "27cb1fe98549756089a0edb788394463", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682094, "uuid": "9cd16254-38fc-4a99-8390-7674eac79b37", "comment": "Malware payload (Mirai)", "value": "34eccdc942997817f653f66e88669e8a48fe722eaaeb92c82beee88f6ac16897", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682094, "uuid": "c918463e-b482-436b-9cfb-f75517b00768", "comment": "Malware payload (Mirai)", "value": "2dc0fc4b6b33aebf34617e7054c12aec5d5be1f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682094, "uuid": "cdf1f76b-fe49-4175-8af7-ff0ad33fa61d", "comment": "Malware payload (Mirai)", "value": "14bf289c6c58790a2e28d3b11a6f9c7f8ac76b7a330aa40dfd9aa9e0a1d88faa7e605c1eed342d34cc3929088312e38f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682094, "uuid": "6ef5beb9-969c-4fd8-b069-2a49e421ef97", "value": "T15EF2E05D670485EECC1EC0F92BE51BE02C640F11AC22DE4B70B9AE9BDD429947A078DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682094, "uuid": "836f7835-7083-4b06-9ec7-6ab5d10c7910", "value": "768:8y913qDz3t3/hvUg6N2bXmthWM3iB2zkl9aB/8D1jJgGlzDpbuR1JH:8yeDR3/hJ0252zW08DnVJuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652682094, "uuid": "5a8b8ae9-4fb6-443b-a3d5-91e068776629", "value": 34900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652682094, "uuid": "439b8ac9-7316-435a-932f-ad97d6f55102", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682094, "uuid": "89f391ae-c042-482a-ba59-72fcbb200e93", "value": "27cb1fe98549756089a0edb788394463", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ca192a-d505-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652698100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698100, "uuid": "72341ed2-ae84-4138-8ca4-ab03460935b1", "comment": "Malware payload", "value": "ccd8fae380c699735cdd7def1ee96fc4", "object_relation": "md5", "Tag": [ { "name": "vml", "colour": "#BE8560", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698100, "uuid": "133da2a6-7b57-4449-b87e-b253f69e58aa", "comment": "Malware payload", "value": "34fa914c50e69e5e3605ee3e9eb123713deeb0203ea0ce2de147b9fe2ebccdc0", "object_relation": "sha256", "Tag": [ { "name": "vml", "colour": "#BE8560", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698100, "uuid": "17174734-28c3-4683-a0c9-0bcc0302c4f3", "comment": "Malware payload", "value": "561832cc30871c6d9b9c11e398f30acf379f21f9", "object_relation": "sha1", "Tag": [ { "name": "vml", "colour": "#BE8560", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698100, "uuid": "b11211a8-1cc9-4c17-8927-23d842484e2a", "comment": "Malware payload", "value": "20a1138b08e298a45c07e48fc7499e57149dd06ad6c44f7d870ea65cbef0a355c7713991495ccfd59149a0d61ee87695", "object_relation": "sha3-384", "Tag": [ { "name": "vml", "colour": "#BE8560", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698100, "uuid": "33cf4aba-e729-4086-aaf9-c9d701ff8953", "value": "T1F4F08B92C660945EF62BE22592901C854C28EFE702AC9478B1922E7F2097AC9EC8B5D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698100, "uuid": "401ad3a0-8cc0-454c-af18-4d5f121594a3", "value": "12:wopNqQLqQOXlzCuqQS/SuXN7lfLOWSL+HWq:nDBLBO1GuBgNNlTz4+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652698100, "uuid": "7b04ff11-273b-4934-8bc8-9ff0f5b79712", "value": 564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652698100, "uuid": "57466ee3-9aff-4087-9289-8b1bc231f804", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698100, "uuid": "b4d5e6db-d6cf-4041-a799-bb4dab5469c0", "value": "vmlDrawing1.vml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a7de27b-d518-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652706031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706031, "uuid": "ef58e591-ce59-4c48-904a-6b2062259aba", "comment": "Malware payload (Loki)", "value": "74b20961b35b6f51777f2dc71fc0473f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706031, "uuid": "e30e9cbb-3026-46ae-b317-c3c1a30f89fa", "comment": "Malware payload (Loki)", "value": "35a257377623515dc39bf034c8b7c42990aa33bfbe1622c5c8c6e51698621daf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706031, "uuid": "75b203d3-01f9-42ff-ad5f-00ab61b2f7f5", "comment": "Malware payload (Loki)", "value": "11fd171f02d279457640444c0802b01ae380e917", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706031, "uuid": "f873d792-21b4-4858-8362-14f857cfce28", "comment": "Malware payload (Loki)", "value": "6442ccd6475fe1273d22d8173e5d301dbc3bff872c56a010b860dee057fddbba05bde794297f3e9c4de058d6c13d7836", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706031, "uuid": "a23c165a-2ae5-4c90-bf48-9c2d5d1674ac", "value": "T19DB4012DB799DF12C5A4287682E3852143F2984B7232C38B7F4C52C61D837968DDE79E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706031, "uuid": "339ebdb7-bf28-4fdd-a59e-876f27d2677b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706031, "uuid": "1a1da328-3ff9-4173-8439-29a963e4fd2f", "value": "12288:UbsJV6yxz70vlJMugbsGlMrzRrBejR5YAcR:U4fNxz7mOsGlMHRs2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652706031, "uuid": "d2b0a175-73b1-4e33-9675-9a9d22076ef0", "value": 505344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652706031, "uuid": "7b395fd3-6871-449b-b7bc-e83c72166b69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706031, "uuid": "8a27e3e9-5fad-47de-85c3-3b5a13476432", "value": "227867432.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d56ad673-d53c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652721779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652721779, "uuid": "b91ab05f-c17c-4de9-b7d6-3e3081dc704d", "comment": "Malware payload", "value": "867aa07dd614380e5943bccd70fee675", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652721779, "uuid": "b7a3a62f-8932-4000-8917-0e1b8f136a84", "comment": "Malware payload", "value": "35d11d86e996833469ee713fce6ba52dbcdcf3211e36985182f47040c2166ac9", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652721779, "uuid": "ec228366-9a8b-43bb-a10f-a178acdcaf22", "comment": "Malware payload", "value": "b97d664bc1f9f8f3ba2819f17154e4d32618734c", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652721779, "uuid": "cf017b01-2426-4882-ad89-d8840a9a1242", "comment": "Malware payload", "value": "747de20cb95790b3c529be06080fc96bb23d7b57bb1e0806b0cba80e38c6bbe1adec85e83c51b407aac7aebe85a0b7a8", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652721779, "uuid": "def370b7-a601-42e0-a41e-bc0f32fad3b8", "value": "T19F13B750D9E237AEF08CDDFA985EC42BC2C454E1FED74EAC885DAE7198116B49B4804F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652721779, "uuid": "49abb14c-d704-4d22-b8bc-db68ed42dd4e", "value": "192:YQOyzLyFyT/COPgoiyhPj/2PjSc0XyoG6B0uKGP/ciIQuNEYMhH:PzesT/CQiE/sMGyJYNEnhH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652721779, "uuid": "bdd4d787-8808-4642-9c88-e5e3d234526b", "value": 43700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652721779, "uuid": "348f5685-e6d0-40ee-8c7a-9a7c34f3ffa6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652721779, "uuid": "37062fd9-58ed-4d82-946a-6066434b25b7", "value": "Re-RFQ - PN List.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3372d699-d4ee-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652688007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688007, "uuid": "2d8aa890-a6c7-426a-98cf-27d7dffca824", "comment": "Malware payload (Mirai)", "value": "b8dea2cb6e9c7073dddddd6d5aaaa370", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688007, "uuid": "ea8caf91-7b11-41a6-8d7f-7083c4ea3b72", "comment": "Malware payload (Mirai)", "value": "362e53cffdef5dfd8329104b634e2e60c9c5b2441917b555d73c82ff98590694", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688007, "uuid": "9205b21c-b20d-46a6-90a7-dbfe1dc7818f", "comment": "Malware payload (Mirai)", "value": "0576d4ae6d1333e5e70d7c4e70460d21d0bc60c2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688007, "uuid": "bc92a8a1-9381-4e2d-bb38-67d48e8c8a77", "comment": "Malware payload (Mirai)", "value": "6a06770dec585abc1e0b511d602c360b37ee1d6e522acade1064ffbd0621f3927ab3d03f074f88ae492be04bfaba5c6f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688007, "uuid": "c57ea69f-ba30-4d2b-be32-6511af7bac82", "value": "T1ADE34D46EA818E13C4D527BAB9AF01893332A75593DB730689185FB43FC6B6F0E77601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688007, "uuid": "00f14c09-1da4-44ba-8e47-a01b03448643", "value": "3072:cgxYi2gojQeTWKrsRdxEK3+w/PCCaYdG7u+bn52xK1DXnu/IM/9xhqh:XxYi2gojvTWK4REKlnG7u+bn0xyXnIIj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652688007, "uuid": "76e3d15e-3060-4837-9376-214447053342", "value": 156877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652688007, "uuid": "dd5a6800-2a26-4230-987e-215f09d934f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688007, "uuid": "9ae92eab-36ea-476d-9841-a5a4bc759860", "value": "UnHAnaAW.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdf994c5-d511-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652703298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703298, "uuid": "367f4f79-6805-49d7-9c1c-460f36e12875", "comment": "Malware payload", "value": "02f3ca9bf5bb0bbde799bb5b1ff4063b", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703298, "uuid": "047a85e9-651f-4c3e-adc6-762333093ab4", "comment": "Malware payload", "value": "3663a4b3df22600c71f4b7dad4ac532ca74936c7c4d9dee0e249c17d07192c2e", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703298, "uuid": "93e96eba-5916-4820-ae38-a1e1a066582c", "comment": "Malware payload", "value": "da7bc814a5a781d96b47fcc0d8e5ddd517cab894", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703298, "uuid": "9741b19d-af95-4be3-a354-b8857231add9", "comment": "Malware payload", "value": "ae03157ff34ff3ebadbaec0305cde794d6b9165f41cd79cefe20e9171945f5551845ce9946701bc813aee34615eb8f62", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703298, "uuid": "8944fd72-5ca7-41dc-b3e6-370b4b868e32", "value": "T1DC24121EB72C4F85EFF9B83A881E2E3D5E42DC5B1DEE52BB1C3532190939992435142B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703298, "uuid": "4c62006c-180f-44b8-8f90-219474f78a45", "value": "6144:uPeiTdcE+JiuSWBkYTrTz+yZBCQr6/wRbc64GSJ1LtkIs+:uPeiTdQJiSlT50Qe/U464G+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703298, "uuid": "1020fe16-a0c3-4ea1-9da3-486917175e4d", "value": 211736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703298, "uuid": "f1eee838-ee18-42fa-a53d-929c62afab2d", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703298, "uuid": "fd78a600-fffd-4fcc-bfa2-0059912685d4", "value": "TT Copy.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b7f11ed-d537-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652719293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719293, "uuid": "95259239-ca66-4c0f-851b-0f25193b8c0a", "comment": "Malware payload (Loki)", "value": "b65aeec99a2ce9d3c1ec692d69887339", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719293, "uuid": "ffb6f6a0-4f97-445c-a5e2-9a13e88e7593", "comment": "Malware payload (Loki)", "value": "36b8f03e2423f95fe1eae9a2e54ecdf48bacf2ea19e4c1c5bf5268edff71b784", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719293, "uuid": "e2f2493b-9698-4a31-b072-04b8a6f5a298", "comment": "Malware payload (Loki)", "value": "8580fd8bd85597618229aa5b20db6fcbd5a558af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719293, "uuid": "49b8b002-9c7f-4983-a717-5187f2834040", "comment": "Malware payload (Loki)", "value": "53168717de8a2137821d7f62d3a5b8d11ad14e01a68f35e402b89d849336d162606996f2e07d5b22d9ef4eb7e5a7b6c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719293, "uuid": "8987a6fb-7cac-4704-8156-aa060bd073fa", "value": "T13EA4120923BC636CE7FB59B1973309100EF6B610A461E77C1EEA40A90DF2F599618B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719293, "uuid": "5dcf30a9-7b8e-478c-9675-f90b28ac7025", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719293, "uuid": "086862a0-add2-43d3-ba8a-43e6b53e7577", "value": "12288:yjkPgUI2FbPUkg1+qQQqaPNB5Kfjr2ZPrtNUy:a+Y9BU7QqaPNXWjo5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652719293, "uuid": "212ecbac-5dc4-4227-9e39-96d006750038", "value": 453632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652719293, "uuid": "e9e9aae3-e35f-43fb-927c-7498d0b8308a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719293, "uuid": "ae329b0d-546f-4f07-b5aa-2eb5baafad64", "value": "b65aeec99a2ce9d3c1ec692d69887339", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87229d5d-d549-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652727231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652727231, "uuid": "3c685014-4017-4d52-9ef7-2950124350d4", "comment": "Malware payload", "value": "d5f4c4aa1f69443b52bb1b1d7d864b34", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652727231, "uuid": "392354ef-3469-4268-bbfa-c32410e5fd9e", "comment": "Malware payload", "value": "36e61e793cfc97f342b391a915ab99fdeb1800fd6c051a94b796d7225dc39d5d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652727231, "uuid": "50549ccd-8210-4b81-b945-48fe8f23e84c", "comment": "Malware payload", "value": "b414dfcf7d165b6c897d5878a7a1e64bb1f8724e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652727231, "uuid": "16e93a41-9241-4c93-9143-dd0c7dc28865", "comment": "Malware payload", "value": "3323a453047ffd7f50ab118cf4a9cf149cc2c57ff9acc983d0c3eb44737eb3d9555e21628aa32f31a436093444af9d97", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652727231, "uuid": "ebf33b67-7613-4f35-8639-947b33c57a26", "value": "T16621DB07B200A252D8D8E5BB9F1357D840B2DC88D5A0D3F2A48F73DA6950BD879D159F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652727231, "uuid": "ece63b32-ac10-4722-9bca-ed62a385053f", "value": "24:9KpGxV8Fb4rwWkhWhdzLCep0ccACKXiPBFMRYgfQMy9snbyR5ZgsCPCG4:9K8rlwBhMZr0jKSP4mjMy9seR4RT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652727231, "uuid": "5f5d0fa8-07ed-478c-83fd-66243ece9bee", "value": 1423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652727231, "uuid": "304d6958-73ee-4994-bda6-51e61af6e930", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652727231, "uuid": "34354c2c-6c3f-447e-ac5d-b51c5c439621", "value": "AZYQ562713810 invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2393b65-d4d2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652676220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652676220, "uuid": "5278e9ee-c7f7-456d-99be-a8ff6a09f691", "comment": "Malware payload (Mirai)", "value": "67ad593542ba91f75ecff961d693a9b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652676220, "uuid": "7f2ccfa0-92fb-4511-bf17-49f936454015", "comment": "Malware payload (Mirai)", "value": "37f6816831b43d23bdefb7d07dcfa683c83be5b2df40f1057ae94e3c1fae5f28", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652676220, "uuid": "1225762c-f5a4-47e7-8c22-a0884e2f8091", "comment": "Malware payload (Mirai)", "value": "229ecfed145800881ed7344b5d411ad3e34f80af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652676220, "uuid": "e3a40837-744f-4abb-86d6-16c4cc348ff4", "comment": "Malware payload (Mirai)", "value": "e6e8f2f9a2ea487065765ad9f7c55734ca377c20121c0cfc3b05a07092cb51de3dc41739d61e54e6277a4db6fdb95581", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652676220, "uuid": "7996646d-5175-41a5-a0fc-947ef04f4507", "value": "T11EA3944ABF215FB7E89FEC3745E92706288D611720A93B79B934D904F21B31F19E7860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652676220, "uuid": "aa379c7b-3b9f-4dfa-8c10-7a26969d2ea5", "value": "1536:a2fsCDpMtQagM6PkH406j5Tb06wnDQhPqf/Jc+n7bdEgvchzp/:a2UCDpMtQagM6PHj5P0tfJEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652676220, "uuid": "2324b4d9-0483-4c1e-8f5c-324bfb0f44a5", "value": 101676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652676220, "uuid": "6a8cb274-a4fe-461b-bb0e-27f99a6b1382", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652676220, "uuid": "54cc9a74-8690-4a9d-96c9-e53b52ce263f", "value": "67ad593542ba91f75ecff961d693a9b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e405a1f-d512-11ec-8e58-42010a9c0032", "comment": "Malware payload (AZORult)", "timestamp": 1652703540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703540, "uuid": "7b5a2931-5fb2-4960-aa62-1a36f233dc53", "comment": "Malware payload (AZORult)", "value": "1110eca19c2168af0f48b86a91ff8548", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703540, "uuid": "e0faa8cb-29d6-4d48-b28e-a4595e9ce213", "comment": "Malware payload (AZORult)", "value": "383f832947919f6fd9a512ffd689a03c8f7cef4a328398038fe8df6a6d2bc6b1", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703540, "uuid": "f850b197-4c1b-4d50-b3c6-b328217ac3d8", "comment": "Malware payload (AZORult)", "value": "0dec58a4377ffd917efad69d6bc2e08f35ef8fce", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703540, "uuid": "1b7f3779-3c86-459d-ae3a-fe777f45121c", "comment": "Malware payload (AZORult)", "value": "5a4ae281ed313cc830bad73ab74fd7475c700a23db215e0279852f7da68a4e44332a8d63fc0b541dd86988eb0c93e392", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703540, "uuid": "b9f8cec7-32d5-4bc5-9e23-2327e7d73bf9", "value": "T164A4220577FCA376D63603B9DB37486116B6B1118813FF2C0EC790ED0D73A86A985AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703540, "uuid": "43abedc9-855e-4733-a9a5-cf62bdd7bef9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703540, "uuid": "86c94811-05e3-4d7a-ad2d-6862df5420ac", "value": "12288:VqfUgab0zD5tcg3uqGUAiOJ5dn65n7qBMD6:Vq2bIDUSdGgao7qB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703540, "uuid": "56efc312-bedc-4486-a5d0-53b8bdc60f1e", "value": 465408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703540, "uuid": "faea0e63-f493-482a-9de5-2ee4e67fc424", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703540, "uuid": "391ffb64-3b81-4bce-b7cd-d62337c392c1", "value": "EUR \u00d6deme Plani.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3603ef37-d51c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652707768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707768, "uuid": "f86be5c4-2a92-43c2-94ec-5e1385aa7c0f", "comment": "Malware payload (Loki)", "value": "2d4739ab2d34eec849d903e05e8e0eb4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707768, "uuid": "1e6d4a59-1627-4b99-a6d1-46a1c29573de", "comment": "Malware payload (Loki)", "value": "38b534ed7fb1964cca533cc8ec1de553fd218dcf7f06075e4247e746d4f651ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707768, "uuid": "4527966a-9d6c-473e-aa2e-5d1587d666e8", "comment": "Malware payload (Loki)", "value": "21d5924416185bda921095a55dcec6d80bae4d33", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707768, "uuid": "8ac8fa54-55b4-4db3-ae28-1d4f28d704a8", "comment": "Malware payload (Loki)", "value": "8012ac5618566a77ed74f00b7aed06ed363bf1ca929d03d2dbbdcee60ef13fb83c9203255c2fb4ef16d13a57ecf1b27a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707768, "uuid": "956457f3-6cff-4981-a548-995e758f93de", "value": "T119F3016137E4C0A7EDA307712F395B6A2AF3D42524692B1B23909F9C7C32251DA1F376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707768, "uuid": "e3bfe1a4-f229-4e17-a18a-621e0ac5edf9", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707768, "uuid": "55b56d7a-ac4d-4d2e-906d-53c9d98c8b28", "value": "3072:VfY/TU9fE9PEtunbtkV1N+C4oNf6UchjUNZKnyUQjE05EyBd9050FUFF9Zxw37vD:ZYa6Vq/N+Ctf6UchjUNZaQA0SGdVqFFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652707768, "uuid": "3b9e0f11-f3c6-4da7-8a34-e129563a5e83", "value": 159137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652707768, "uuid": "6fc8df20-3ca2-4326-9d13-d48f1e4030e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707768, "uuid": "f3911a77-27c5-4969-b3b5-9a0af1f0fee9", "value": "2d4739ab2d34eec849d903e05e8e0eb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46bec463-d519-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652706507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706507, "uuid": "c24b838a-2e9d-4123-96af-15c12dffeb28", "comment": "Malware payload (Loki)", "value": "0b9ad26b6565bdcdcffa310df4944096", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706507, "uuid": "46c48086-2d3f-4d76-86b3-7ca83dc0072e", "comment": "Malware payload (Loki)", "value": "39cefe8dd528b6b8efc18753c0ee70e4c712f1cc5137e25564e2bb5cd3ff64d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706507, "uuid": "e741f6d3-546d-4c84-be19-e7d6789e39c6", "comment": "Malware payload (Loki)", "value": "28909e382df3f0853737d5961e9d7d8341bb1a84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706507, "uuid": "27ec9d1e-2e75-44b1-86e8-805ea1bf1640", "comment": "Malware payload (Loki)", "value": "3f17a42430afe3bf1c9c599f0d5d3413926131866c3872162b868f5f839060dc147edef2452d9ccdb81e342e0a67027a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706507, "uuid": "506f94a9-3920-4f69-8d0c-dd3774ab0719", "value": "T1DDF30110BEE4C527D8E217321C7E26BAEBF99D1001F49B4B77605F193AA7240AF1E752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706507, "uuid": "98707189-b1c8-4a95-9300-741ff437655a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706507, "uuid": "3cbc2777-9c55-4a37-82fe-76208e1419ee", "value": "3072:VfY/TU9fE9PEtunbTAc/tbP7VtSGEGYx9PHowWhFgVlXEllzMVUxKR:ZYa6Vnb55kx9PHowWXElQMVUKR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652706507, "uuid": "92e1f4c6-4258-48de-a541-4a0ccc99fd95", "value": 159771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652706507, "uuid": "6f2d156e-bb1a-448e-b061-abb79aafb97c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706507, "uuid": "ba237899-5ee8-41e0-becc-84c3185c08e5", "value": "0b9ad26b6565bdcdcffa310df4944096.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9befd85-d541-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652723988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723988, "uuid": "4a31dc47-bfae-4b14-bd66-4b20c28a0de0", "comment": "Malware payload", "value": "01a04d94404aadcaf4ca50843f061da0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723988, "uuid": "a5a5b0b3-908d-42fe-bf89-161060eff41c", "comment": "Malware payload", "value": "3a1813d0503785847e94f7040da933aecded1c9512ae980de24620dcea6a1e6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723988, "uuid": "1cb94087-376f-4f80-b38d-3ca7adced9d5", "comment": "Malware payload", "value": "e749aea192d7b2a495e3b4d58e3b3a95ec578f98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723988, "uuid": "19d89399-d2a0-4864-9e47-c0077f4de17a", "comment": "Malware payload", "value": "c706e92df0785072522cbb2b525376547cd79f1108cd233c838558e8d5aa356a7eb819b922182c333b5572c19dbeed57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723988, "uuid": "17f0a1c7-8dee-441f-8f68-57495d08a792", "value": "T14174C046B3A840BAED678338CC535647E772B45A4B70A78F13244379EF2F3915A3A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723988, "uuid": "73a1d106-aeb2-4948-9299-91936686a1b0", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723988, "uuid": "2ea435f6-9650-4981-b52f-362cffdafb24", "value": "6144:Es/2WX22TR72tKbxGeekr2rlsy+vbEFXYvlx6xJkUjnKd:Es//Gi7/egDvQFXTH9Kd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652723988, "uuid": "b546cec0-8f16-484c-98bb-4924920e7b50", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652723988, "uuid": "107fee05-b6a4-4c83-92cb-af4b3999d309", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723988, "uuid": "8b7fb3b6-c907-4f5b-86f7-4b59409cbebe", "value": "3Bbk0rSi7RVopH1jUt3N6m5r36CAFkuV.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b736c3f-d529-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652713522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652713522, "uuid": "7dcaf367-f043-405c-9b76-3bb3dd21f534", "comment": "Malware payload", "value": "ddc48a9fdef3693f252aa38abf122aad", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652713522, "uuid": "ac573dd4-bede-4d8c-b861-6880eae0107d", "comment": "Malware payload", "value": "3a268cdb5a5f0364a73407b1608e7f43e73c99eb26c41e4bf7ead8d1674daef4", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652713522, "uuid": "e97fc881-365a-4aec-ab1d-bf1ae5293834", "comment": "Malware payload", "value": "51d59c278e225aa6fa94af78b43e646d136ca54e", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652713522, "uuid": "35326709-85bb-4928-91e2-baff58144fe9", "comment": "Malware payload", "value": "780e7647da937e9471ea06813abe79d0596a961287a069e0c9ab862747dcbf16bdcacb21e81e45cdaad21ac8bd90e4f0", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652713522, "uuid": "1628501e-52b7-46db-98f5-6059748f4216", "value": "T12461DA9D227CFA5DA204D186EFC1E40C6E9C12AFC2A8363F362680954615BC6E17F1F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652713522, "uuid": "744772be-c432-406e-98f8-9aef7f9db315", "value": "48:Ybzml1RGWYnEuR8aFr++gCFoBAqgWALCuseNx2nPNVeHjiNk/WSQyPGfUtTjTKio:+nb6MPnlsgeSQfmbTiHHiDVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652713522, "uuid": "a768f6be-ff3d-490c-9c4e-c1dbece79be1", "value": 3384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652713522, "uuid": "a87b40fa-b3a7-44b2-9c06-64d720c47b92", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652713522, "uuid": "1ff28655-5689-4f4b-818c-acdf4ca17c38", "value": "XVPUHUXIISL_#615430.VBS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4094fc93-d518-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652706068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706068, "uuid": "7a133894-f183-4c34-8ecc-b49047f36543", "comment": "Malware payload (RedLineStealer)", "value": "1648114b333d2d91b58d9c450550d4b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706068, "uuid": "bfebe2d6-0a27-40d4-8800-11f8ba073a7b", "comment": "Malware payload (RedLineStealer)", "value": "3a46933c7d6d74d19ab811a5ec5c675ff1458d63c455005e327a60ba25ae442d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706068, "uuid": "cb99215d-db23-46bd-86f6-6fac5370db0c", "comment": "Malware payload (RedLineStealer)", "value": "df4eea60c4adb6ce8127230a50978a853a011975", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706068, "uuid": "282f243d-168c-4792-95bc-fd0caedbb0ff", "comment": "Malware payload (RedLineStealer)", "value": "033e2b43c2c2121f4554459a1100627ed0d8ef4cbcb44f6640caa78aab1cc35e64652ca098c15ec5712293591932953c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706068, "uuid": "38283155-9b89-4f32-86d8-68be6f216300", "value": "T1287401227390C432E4923A708D35DB619EBAB9320671784F27A0337E1F717D29BB5766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706068, "uuid": "68ef3dce-545c-48ee-b3cb-24bc64d4faab", "value": "4556af061fe2abccc21c2f8048d4d531", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706068, "uuid": "8b52da65-3b05-4ca1-a9fb-42343f232789", "value": "6144:4WmPj9bIFX6P/RJEWZbjNHk7fbUMNs0NozTHDO2:5mPj9bweJJEWIUusMY7DO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652706068, "uuid": "1a2373eb-50d2-4ac9-9562-2c0989cea6e7", "value": 363520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652706068, "uuid": "0feb6445-74a5-4a0e-84c8-bf633d650fa2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706068, "uuid": "55aa18b1-c47c-4be5-b416-75719b8db022", "value": "3a46933c7d6d74d19ab811a5ec5c675ff1458d63c4550.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb4093e-d555-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652732477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652732477, "uuid": "03006ede-038c-4a74-8037-700c99768db5", "comment": "Malware payload", "value": "0cf061ff391f467a683d11884d2ad520", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652732477, "uuid": "52dc3f9f-b889-40c3-a3ca-d118e778575d", "comment": "Malware payload", "value": "3ac8a1a80b1aea1542a42ac25b0b4d730cc9f3cebd9b2661686177a083e98c03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652732477, "uuid": "0df4941c-b36e-4ad7-af34-6063967ada02", "comment": "Malware payload", "value": "ed6212e71335f3707303da91c84993c149520d01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652732477, "uuid": "23912014-59ea-4e8b-85bf-73d65fae979a", "comment": "Malware payload", "value": "1b380005b7a4f34b112d8e66c2e16f1b56d4ea01804c1e42e90383c36a05514146ec7efd07b59cedec55fde40e91898f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652732477, "uuid": "94e4f16b-e211-48e7-b6ab-259d361b9ae7", "value": "T1A6358C93F14149A4CE5E4E388827BB2792323C117F1A879732C4765A2FB32D15F7A792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652732477, "uuid": "3f4c19d5-1b79-44d4-a1c2-9d13eeaac715", "value": "a08599a345be82fd3b030fa5c3b87d5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652732477, "uuid": "7af6c578-0a13-47a1-a499-882af5193209", "value": "24576:Yx4er0brd7gWwDj8pL3KXypmEgMjgWBzUnD4:eArd7gNSTBYWGnD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652732477, "uuid": "0e5835a5-0314-4816-b6e0-216f521e93a9", "value": 1114624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652732477, "uuid": "d6876c09-a850-4a81-8464-bb2e57d1ee5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652732477, "uuid": "235edb79-b2a0-4bdd-95da-2910b0751452", "value": "epic.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ab5fc0a-d4fa-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652693146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693146, "uuid": "ceae0f0f-8444-490d-a2bf-7e649ef855d8", "comment": "Malware payload (Loki)", "value": "bb0952103fa8bd55ac625c8693f321c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693146, "uuid": "7349b4ad-8980-46ac-9f6a-c339c64ba6fe", "comment": "Malware payload (Loki)", "value": "3b2ddf48b3fd12f2bb56b19070c83a0b082903da86c3f5477ea4c7d374f93556", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693146, "uuid": "55b2934c-a54a-4a93-b210-499ee43dd42c", "comment": "Malware payload (Loki)", "value": "d2afb792c6ab39cde1fb728590c25e7f9d6b4c86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693146, "uuid": "3aeafea7-cc71-4ebe-8ec6-16c9bab6663b", "comment": "Malware payload (Loki)", "value": "fc354156d7ab3c705f147f8192522615bc4cca133b32806accef611398a75fa9782bffaff646f4461b17560a32ac3528", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693146, "uuid": "edb9c434-f789-44b0-95dd-10c2a09842c4", "value": "T102F301A2D6E1C477DA670B710D3E66BB9FF6831814E5864F2360078DB962791CA0F723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693146, "uuid": "776d6b69-b66b-4c95-a20c-da8716e49c3f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693146, "uuid": "5d62b08f-51b3-466b-84c3-7851f3230c42", "value": "3072:VfY/TU9fE9PEtunbS8bOH2nRB+tgMW9pGWxHOf7+gwnAc5N6uiaWDIL/k:ZYa6VVbBBTfjGWMD+jL568Ls", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652693146, "uuid": "2d27efbe-837f-4dd2-bae5-da29c9254732", "value": 159185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652693146, "uuid": "ae07a858-63ce-4887-b6e1-19678340d95b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693146, "uuid": "36f6a032-bfa9-442b-a819-515a51bf868f", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edcb6eaf-d4ac-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652659973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652659973, "uuid": "141107b4-5b4b-48ce-80b5-eb813178ff23", "comment": "Malware payload (Mirai)", "value": "228be5b5f348ba3ca288c34837391dda", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652659973, "uuid": "29f53c52-7025-4f6b-806a-a3f4efef1ef1", "comment": "Malware payload (Mirai)", "value": "3b499a841f7d8ff1ea7ce02740c0209c64b97a5d817a1d26691ed5a90843d193", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652659973, "uuid": "b3363ebe-c18f-4179-bf0d-16da413936cf", "comment": "Malware payload (Mirai)", "value": "e70ce5571b2a32aa6745102670766f2eeffdaa36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652659973, "uuid": "70dda4c0-9969-4d39-ab0f-d91c2525507b", "comment": "Malware payload (Mirai)", "value": "44db21632f4e19e98b204d69519accd9ef13a95dfe43ee750329530fd8d25b605a45dab0b15c76c264d53a616ec4a615", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652659973, "uuid": "6f9cf8fe-6d1c-49e5-8302-71ac18468f30", "value": "T115E31A56EA818F07C4D62776B6DF424533239B64D3E773069928ABF43F8279E0E23605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652659973, "uuid": "101e1975-d9ce-45a6-92c0-7bbb8c10f10c", "value": "3072:9hOObPTh3ybTnxalTVItzfYFRGcmRISAoYV/Wk0hgM/9FOwM/BSl:9hOODlg7xalTVItzf4GASQV/WkOgM/9Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652659973, "uuid": "2cce0504-528e-4b20-9813-3838a2cdef6e", "value": 148129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652659973, "uuid": "941289c8-729e-4489-b2b4-48ac2e034c19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652659973, "uuid": "fc4cee27-1bcf-47d8-9d57-62ac0cd043a0", "value": "228be5b5f348ba3ca288c34837391dda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b80538a-d507-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652698758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698758, "uuid": "0acce67f-fb46-4135-9ae1-c3d7c2ec5510", "comment": "Malware payload (AgentTesla)", "value": "be93eacc05550b184a59fc6a22123983", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r19", "colour": "#084C95", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698758, "uuid": "5e861275-4a62-457c-9542-783a6db6d911", "comment": "Malware payload (AgentTesla)", "value": "3b7c019d0318958227828b851787f303cafae9eff6a58d221c36c75418c2ab07", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r19", "colour": "#084C95", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698758, "uuid": "6ad61067-f4a9-4581-8eb2-e0997e473b62", "comment": "Malware payload (AgentTesla)", "value": "3cc7ec62753389ae7dcda1569b761dbc85c6e454", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r19", "colour": "#084C95", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698758, "uuid": "a19e08d9-41ec-4358-8f7a-51455be554f6", "comment": "Malware payload (AgentTesla)", "value": "58d7de983551574aadecb1cdb4bf36e08229b21a68ca269d1ff082ba28802b2fe0257aae118359ce5db9ca5ac2db9b8e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r19", "colour": "#084C95", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698758, "uuid": "0b8989f8-0c3a-4e86-a117-ce919df70e01", "value": "T1DEC423E460D867CAB81234A999CA40D65A1371F5EA95BFFD19001933EE37C06B93FB84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698758, "uuid": "e07ce6e2-e968-4a4a-bb12-27e038280b9b", "value": "12288:rdgmhNJtH1PwQveyYWY1QzjEQlSEQc2J1sWEuwAD:OmgK1zjb61sMwy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652698758, "uuid": "64fab431-71f9-41ed-a7c0-6ae661a5c460", "value": 578015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652698758, "uuid": "85feb698-1fdc-441f-93c8-4d0f7e04937b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698758, "uuid": "7b86eb1e-4ff2-4847-a002-f5a2ef87f0aa", "value": "Inquiry.r19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4314143-d4f3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652690343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690343, "uuid": "b72522df-f52d-4ede-85d0-d5e47147adf5", "comment": "Malware payload (Heodo)", "value": "bb1d6a48247b577310bd2c31c02180fd", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690343, "uuid": "63dc0c1c-6638-438f-a8b8-e7c2028ce227", "comment": "Malware payload (Heodo)", "value": "3cdcd763fa243210867f6ede1c41c4b6c7cd01abb4821e4e17e1e3ccb45f2dee", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690343, "uuid": "7467bdc1-2a14-4b3b-ac59-7e355fe7fd25", "comment": "Malware payload (Heodo)", "value": "6f4c4f1f8408cfff7e851bee6fcbed12cebbc9fd", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690343, "uuid": "7a0d8c22-8012-4d09-80d8-c0df16d25032", "comment": "Malware payload (Heodo)", "value": "ca9a1c92db755e06d98159aee51c05651d0ee77310c28ceba73974143b3197fd5ab2994adfa47ae5a45b7e18cb8d0237", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690343, "uuid": "402f2ad5-c2e9-4785-a314-c2643f3edd9c", "value": "T1CA055A35FB6C8492C6A3953D88A34B06EE6AFE840B6183CB1290733E9E777D45C35671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690343, "uuid": "900b63b9-9559-4c3b-8c43-f6f4cb3fbd1f", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690343, "uuid": "2e1cd0bc-641b-42a0-8a44-954ea1a42441", "value": "12288:Q9983xRoz0/7aG8GkZHFT1YicDAXmvQaZsbNg:A9U/ozAWGxGx16AWvVZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652690343, "uuid": "f094311d-f00a-42f3-ae1d-19fcca4567c9", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652690343, "uuid": "6ba0a7e0-e3f2-4be9-b9ad-156303db55ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690343, "uuid": "60753187-55ed-4481-beb9-a55e05350e96", "value": "bb1d6a48247b577310bd2c31c02180fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b910a09-d539-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652720286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652720286, "uuid": "55613e7f-b9bd-4617-9515-ede51fc13d03", "comment": "Malware payload (Heodo)", "value": "ab20a652a814fb1e85781dad69f1e6a2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652720286, "uuid": "4f3ac55d-cf7f-417b-85d3-ad861cdac140", "comment": "Malware payload (Heodo)", "value": "3d94864944cf41c799b44571754a164ac02b539e2b9141cba9b91a8b92268eb7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652720286, "uuid": "2d40f89e-eb46-48e3-ac91-0134f36e7e01", "comment": "Malware payload (Heodo)", "value": "53cf28e375a6fa5497c11fa52b20c1b8a89ea9ee", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652720286, "uuid": "1c63bddb-6b55-40c2-8f23-715cdfd5bf88", "comment": "Malware payload (Heodo)", "value": "862eb5a823a0f8b7f2154cb126f77e0345664781e3ba65812ca544703c580d9dff742d3b79fa5ee7414ab266584e0aa2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652720286, "uuid": "15e96a3e-72ed-40b1-9924-9b95d3dffd1a", "value": "T1B184C04673A48079EDB79338CC574A47E376B86907B0678F1364436A9F3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652720286, "uuid": "2ff7dccc-9506-4f39-bbe1-a1c6a8f84664", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652720286, "uuid": "e8e8fc5d-e4d3-4f96-beb7-467ef802f216", "value": "6144:EbmRW/X22TR72tKbxGeekesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/epRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652720286, "uuid": "dd44b495-b62b-4059-89d0-45504f6b9ab7", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652720286, "uuid": "13169d3e-70d7-4690-a45b-259f27d9b4bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652720286, "uuid": "a96a958f-cea8-477d-9c2a-63596f7d5dc4", "value": "ab20a652a814fb1e85781dad69f1e6a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd389850-d4f4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652690842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690842, "uuid": "e84adce5-d4a3-4dca-afbe-fe3e0eec1080", "comment": "Malware payload (Heodo)", "value": "9edc5e3f599cd0987e19dd721352ee35", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690842, "uuid": "2a5acb6b-c437-4d26-8401-8e120021b213", "comment": "Malware payload (Heodo)", "value": "3dd80ea48ae08af6ff5afe88e0aa0a9b5a9c38f4d0fa86ab4cb269af47719855", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690842, "uuid": "3c9e8227-d0e6-42bd-8049-9fc3793ac976", "comment": "Malware payload (Heodo)", "value": "b7987b688f34ff0114dde25a947bd5760db77b1d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690842, "uuid": "158813de-7d7f-4924-b8f9-cd3d790786c8", "comment": "Malware payload (Heodo)", "value": "7cf4f8f4443b9bd2d33da2e22e654c61e2192d5754fccfc3b31d17a1c310c008d5f49dcbddb5f8d216305fc6aca399df", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690842, "uuid": "5853f66d-7edc-4b38-95af-e7241aca8422", "value": "T130055A35FB6C8492C6A3953D88A34B06EE6AFE840B6183CB1290733E9E777D45C35671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690842, "uuid": "d51e1b3b-f9ad-4ad3-84e6-5c812a8570ac", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690842, "uuid": "f44bcd62-42a7-48ec-b33c-ca520b5ee511", "value": "12288:Q9983xxoz0/7aG8GkZHFT1YicDAXmvQaZsbNg:A9UTozAWGxGx16AWvVZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652690842, "uuid": "9f469873-a22e-481c-902e-0f798491160f", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652690842, "uuid": "9838423a-03aa-4933-8f90-a9c590b55236", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690842, "uuid": "155b1903-7fb3-4da8-aa89-bb31cd4d27bf", "value": "9edc5e3f599cd0987e19dd721352ee35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d50578-d52e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652715631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652715631, "uuid": "6c5e3e49-6a04-4fd3-bbe5-e64de5fd33bf", "comment": "Malware payload", "value": "7dd8db585e06a98d6a092bd9542663c4", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652715631, "uuid": "bd131c5f-aad8-41ee-be6b-66ea0eaa7d83", "comment": "Malware payload", "value": "3e3845801b6ab4e5e61b44d1694a21dbb025dde84bce9b8847b41e25fcb62f39", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652715631, "uuid": "35d5e498-5f80-4938-971b-5f1f7bb3ffaa", "comment": "Malware payload", "value": "9f22aab94cbbfbf71efd49f4a01041caf551816f", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652715631, "uuid": "ac2e67c0-f212-4727-831f-2872b68374a9", "comment": "Malware payload", "value": "8e893f175be0ec4b368183c501b857aa04cfaec956b6928d4662d6603e50c18cb9da37a2b96e0e2b37d1afb5f62d56cc", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652715631, "uuid": "3dd840fb-3909-421d-a7d1-1f654121678c", "value": "T1E84496A0E665F8AEE429883A8979D5211A57A72CE0F4053F319C71197AB738350FFD0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652715631, "uuid": "4d4f5b5c-aed1-4fd9-81ca-149c40584136", "value": "6144:Y9biAEHbORGSalRPfLSs+e3Vby3SmtfnVgLyB:dDORGSalRHLSs+e3Vby3SmtfnVgO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652715631, "uuid": "542f8400-7e34-4125-8291-b2c577931f70", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652715631, "uuid": "180ab613-9abb-4c63-8565-1f2cd8fb568d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652715631, "uuid": "7f91de50-895a-4aca-9cf1-0affc9368e30", "value": "Orden de compra - PO02349.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6702fc51-d4d9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652679074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652679074, "uuid": "69637372-f010-4e36-b057-792423059f35", "comment": "Malware payload (Mirai)", "value": "e5d241c8adb0e72110be50595233cbde", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652679074, "uuid": "65922222-f192-4bac-a25f-5e482eb8bfe2", "comment": "Malware payload (Mirai)", "value": "3ee40656fb39d72f0dae006b75f65a94971b5852e8a2345e8b33bd0f4ab5bae3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652679074, "uuid": "5b341de8-7d58-420c-92c5-fd144c68bb9d", "comment": "Malware payload (Mirai)", "value": "d5e8ce447a22978f369859e929fd998a10697679", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652679074, "uuid": "acd11466-b023-4db9-b525-4f46d6446e10", "comment": "Malware payload (Mirai)", "value": "cc49a439ad7b485eb9d3c72191a6373fd7ff7c1680c1f4bf172e3265565143853955b0e3cc2fe22a4202376d1262fb98", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652679074, "uuid": "d1c921cd-ee8b-4d2e-a2b5-a8822936a438", "value": "T157C2E1F916AB0D6087B0D83FA649874F560B06BFF27E35B340492A384E8B54E60B45DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652679074, "uuid": "3a85b08e-e559-42a4-8d42-5f272e7aa80a", "value": "384:SrLipwQbBHAB/gJn8o2tCynqJx34hWaxHOpqnoFD4WzledZybChChymdGUop5hj8:SCrHrJ8TCyG3/qOpCdil4AuYs3Uozl8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652679074, "uuid": "2e5f1292-3683-4302-b9be-115e48aa8702", "value": 26192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652679074, "uuid": "6bacc7fb-71a1-48ad-a125-a5044eedc192", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652679074, "uuid": "3338bd95-15ff-4ac1-8373-25394c4501f3", "value": "e5d241c8adb0e72110be50595233cbde", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81f327a5-d4f0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652688997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688997, "uuid": "41a9c02d-b144-4481-872c-5d7315383e16", "comment": "Malware payload (Heodo)", "value": "4ec627ff1961ceeabe8fa19ca1ea7241", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688997, "uuid": "347bdc25-2fd7-43bc-80e5-534bd88c8437", "comment": "Malware payload (Heodo)", "value": "3f036f6d3054983ffec4d241e603cc97068339f6b8cfe403365003bc32ad7b38", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688997, "uuid": "50276393-070d-4da9-a35a-2ec9987ba850", "comment": "Malware payload (Heodo)", "value": "588d170a81fb792ad39837f6b9e2cdebfe1148ca", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688997, "uuid": "60543481-346c-45be-9982-6402449ad740", "comment": "Malware payload (Heodo)", "value": "4dd5127d57e93bc3ae5dc976f1deb1158eb29778063a5e8c7c43c43c95ef021cb9a5ed12d1f9e79611e8f3313a1772c4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688997, "uuid": "12ff86d8-5100-46f6-9e59-933d68e52f0b", "value": "T123055A35FB6C8492C6A3953D88A34B06EE6AFE840B6183CB1290733E9E777D45C35671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688997, "uuid": "942116ef-05e7-474c-8934-5e56517bcaf2", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688997, "uuid": "31b55a62-a218-46f5-b9db-1ecd40a90b9a", "value": "12288:Q9983xCoz0/7aG8GkZHFT1YicDAXmvQaZsbNg:A9UcozAWGxGx16AWvVZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652688997, "uuid": "cd88cd71-8829-4083-a7d2-81fe881c1b48", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652688997, "uuid": "43298c00-ce79-450e-9aad-804ad3c933c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688997, "uuid": "b6dba706-aebd-4d5a-aac7-9cac2649ec8c", "value": "oLQ8REA3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "165189e8-d51f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652709003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652709003, "uuid": "c2964209-2562-4f3b-b540-fd36fdec3106", "comment": "Malware payload (Mirai)", "value": "de135e0d2bdb13827e087434a34cbb49", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652709003, "uuid": "79144121-8a09-4a02-9197-fc9628290749", "comment": "Malware payload (Mirai)", "value": "3feec4f8a10ba1f444aa4bf64f7219efba2ee425a63dd194f42fdc50d80fff98", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652709003, "uuid": "72abef77-a2e5-42de-97d0-a15669654b54", "comment": "Malware payload (Mirai)", "value": "bd5e2531e52f9435da92c81440121f06c1abfda8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652709003, "uuid": "a9ffcdd1-e904-4bc0-adcd-44bca49fa1a6", "comment": "Malware payload (Mirai)", "value": "e8bbe88d15fec8ae6e54d6db8c4f6aa9351f81073bc696297c5d4ce9dd5366bd49437ba26efe30903129dc741559fa52", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652709003, "uuid": "aa45fde5-6749-4431-b337-8b37ae4d77f2", "value": "T1F3E33A46EA818F03C4D6277ABADF425533239B55D3D773069928ABF43F8279E0E23605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652709003, "uuid": "1476c4b2-4f05-4a58-83cd-f2449b72ac79", "value": "3072:41CnQjTZYE3WOahEolLXXTnPdhgyA44xrpWHwOM/9Dzz8WBSl:41CncYPOahEolLXDnEygxVWHVM/9AWIl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652709003, "uuid": "da03d95f-dd61-4798-8690-514b9c2fdb4d", "value": 148033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652709003, "uuid": "42d20fb6-9409-4edf-b315-01d4c2d899d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652709003, "uuid": "d5b6ebc8-f1ec-45e1-a466-177cc9148a74", "value": "ZG9zarm7-20220516-1350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7084c5b0-d512-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1652703571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703571, "uuid": "01ca8268-1d39-446b-a357-dcd2f9d887a1", "comment": "Malware payload (AveMariaRAT)", "value": "fe24503eb81fabf579481d5054b74753", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703571, "uuid": "b509bcd2-24f1-43bf-890d-175eb34a5055", "comment": "Malware payload (AveMariaRAT)", "value": "404a176d0455a3e99b16c589caf58fcfec84d453d8ff0984222ecbc4ad0fefb1", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703571, "uuid": "4f04e089-eadf-4229-9bde-08d445ff5e9d", "comment": "Malware payload (AveMariaRAT)", "value": "f279d3f02a1aed9da188e8bfcb41c3a0bd43fba1", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703571, "uuid": "415050e4-51c9-4bb6-82f5-f336e9e02731", "comment": "Malware payload (AveMariaRAT)", "value": "9166ae2a8bd6828fdb545675fd0963661c941459c478932d48bd03328743d3be9535de402f2ee26aaf70ce9451e3c7be", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703571, "uuid": "93f3b3b6-de19-4657-973b-59bb5d66b7d6", "value": "T1A8A45E6C7B420A72EC0D81308B098A05BB660FC3634CF9A6579BE5CB975F1672D45EF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703571, "uuid": "1917cd81-cf0e-4062-8f7c-0be1494bb0cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703571, "uuid": "8496a272-b28a-4bc7-99a0-1529af282562", "value": "6144:ZTvIrqin80B3jwt05tBFGVEeOPPapTlg81t2/ceUwEt+O7rbeqE612J93Bj:oqix9wt0tNeOPwTlNt2/cKfu+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703571, "uuid": "9072582c-33fd-49bf-8a16-c33680c50779", "value": 481280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703571, "uuid": "030f3a41-b5ee-4dc4-8257-710901fb539a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703571, "uuid": "6b090c7f-9596-4229-ac3c-b2bcd6b83eb0", "value": "Yeni sipari\u015f _WJO-001, pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4093589-d517-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652705912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705912, "uuid": "bae9230d-b435-48cd-9a41-9a648fe82a8e", "comment": "Malware payload", "value": "a7b0b39ee127396eea06659d2fcbfcf1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705912, "uuid": "48dfed75-f3d7-42b2-a14c-1d3a5ede5506", "comment": "Malware payload", "value": "40b8358dbee536378a4f6779927737aa9a480bf7b129efc7acf6dfb4aadabef3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705912, "uuid": "783878c0-498d-4d07-8e09-a2846e50ee7e", "comment": "Malware payload", "value": "27bd60b46888c86d153f7eadb406d4bf14936287", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705912, "uuid": "d64cebfa-d508-47b4-bf98-b7127f094e9a", "comment": "Malware payload", "value": "e0f8638dc64ef0967f9cbc5f3b478175dcf7e1824a87bd4ce525491ad5130b19df799ac21a0c98303638d843b4fb11e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705912, "uuid": "24e8c09e-517f-4100-94b6-0370f634eef8", "value": "T137B5AE313690D8BAC9232570854EA7BCA3EDBF305ABA52C356503F393B75592482C77B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705912, "uuid": "1227a314-13fd-49d1-aa9e-744ecef8fac5", "value": "493871f0784d0d733e68b5dfb4b3e7a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705912, "uuid": "2a395457-eef3-41aa-b8eb-6784c07a0a93", "value": "49152:S/jOk5qm6hQ6zit2qaIwQtv7DMcMAtKDi+oxE4eSRWAcR76yROJaxOgVg8pHJXSo:Nk5qm6VG3aIwQtDDMcMAtKDi+YRWAK66", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652705912, "uuid": "5ce02a08-06b9-42f6-bcfc-15feba0b5b75", "value": 2430464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652705912, "uuid": "cfd46d7d-ec6a-4dff-b1d9-37f41e0ebd92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705912, "uuid": "0dd651a9-db3b-43cc-ad35-b812f5764b4d", "value": "\u70b9\u200d\u51fb\u5b89\u200d\u88c5\u7eb8\u200d\u98de\u200d\u673a-\u7b80\u200d\u4f53\u4e2d\u6587\u8bed\u8a00\u5305 (12).com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e03d3a-d52f-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1652716166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716166, "uuid": "5de53297-610b-4229-808f-92aa64b1d380", "comment": "Malware payload (SilentBuilder)", "value": "dabaa45166f46a1d331a39b60586a50e", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716166, "uuid": "94d2dfc6-ccb7-4cdd-8890-e623eef504a1", "comment": "Malware payload (SilentBuilder)", "value": "41218535f912b97de84a85978b502e175891af9aa6ca202f2a2b784b37b42a54", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716166, "uuid": "3aad274c-49a9-48bb-81b9-c2594bb2cb6c", "comment": "Malware payload (SilentBuilder)", "value": "a4fef39c4aa26a89733594b09d055c6db8dfe7d8", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716166, "uuid": "02979a9a-3624-4a2f-8ed9-1142755d06fe", "comment": "Malware payload (SilentBuilder)", "value": "bae90ba042f40b31af8a9edc94fa28fff018909944140f90aa8bcf52f806fdea91795b74b1909fe122874dc732006855", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716166, "uuid": "8a78510e-7881-405d-a662-4202e689073c", "value": "T198734A4AB98AC96CE615C739499743A9B313FC114FAB078B3109F3727FF49A05A0761B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716166, "uuid": "69116cc5-c13d-4788-9672-aaae064cf8d2", "value": "1536:tpKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg5AezwrMCtvJecvRtbTNF8:zKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652716166, "uuid": "3cde9fa1-641b-4985-a7ea-3de87d7c412e", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652716166, "uuid": "acca7c44-1220-4695-97a1-e0975b767bd6", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716166, "uuid": "1c8a8bc9-91ad-4153-bd30-24bc294f4987", "value": "commenti 1605.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99f39029-d507-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652698916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698916, "uuid": "16db1603-3a3d-4353-ac00-445f6214ab42", "comment": "Malware payload (Heodo)", "value": "7869fc1369916b5c292c37d893368394", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698916, "uuid": "4e2a890e-b7fd-4b21-86d7-ef95d5d750f9", "comment": "Malware payload (Heodo)", "value": "414f64b3da5c3d2ba2d11e535065a07fd8746dfac8a4070d54ff4d2dbc405d51", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698916, "uuid": "6b5a8909-2f28-4eaa-86fc-8b0696c32d44", "comment": "Malware payload (Heodo)", "value": "347d69d6d935346a46d92c33e47c7375a854881c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698916, "uuid": "dbe3985c-ae57-47e5-bb4c-2c4c1c3afdb4", "comment": "Malware payload (Heodo)", "value": "2ea2b427d4932d3b3079d8db468afefca4d954d3576bae3fde526ea10f04024779b72aa35c7fae56f7e38becab04d982", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698916, "uuid": "326a6925-7538-4308-be9f-0b6f60fbc84d", "value": "T153055A31EB6C8492C6A3553D88A34B06EE7AFE940B6183CB12A0733E9E777D45C35671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698916, "uuid": "aaffa576-aeb9-4baf-9cc1-04c668b7da57", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698916, "uuid": "d3a06e4a-df13-41f2-9b1a-5359708f2683", "value": "12288:BeI3xkoz0/7aG8GkZHFT1Yi5a8kL37eGfv37:cY+ozAWGxGx1Na8kLqGff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652698916, "uuid": "0d4d0dd2-77e3-44c2-a78a-76375e18d1d8", "value": 800256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652698916, "uuid": "5b04106a-feec-45b8-89c8-a7a111843bb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698916, "uuid": "b090368f-85aa-47b4-b9ab-206503862234", "value": "7869fc1369916b5c292c37d893368394", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db567c5e-d50c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652701173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701173, "uuid": "be825772-fa11-49e7-86ff-b38b9c9a5486", "comment": "Malware payload (Formbook)", "value": "a2b28bb0f51ceb78ab75bbe083e9f90f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701173, "uuid": "d570153d-bd24-4f0e-84cf-262909d53ee1", "comment": "Malware payload (Formbook)", "value": "419127a78f8b1a361cab37011662b2ce411af7f4ad59d0f35ce5ca98eca1b92a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701173, "uuid": "90fb04d9-033c-4f4b-907f-2993e9d336ae", "comment": "Malware payload (Formbook)", "value": "6ceb9b4915b5c2024fc1b8622c57145350e4b398", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701173, "uuid": "963b4455-067f-4ce1-ab43-1c92801d3aa1", "comment": "Malware payload (Formbook)", "value": "8cbe379edc03018e408b43f56cda22daab97a797f961e986f7a6384d0b844d5720bab8cf13033dbcb79f7d38bed619f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652701173, "uuid": "8e232d3b-9438-4029-afd3-06aa8ce50f86", "value": "T1FE341269ADB0C863E8E59B324F788A11AFE9B8122534450B63505B0DF5B2193FD1F3B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652701173, "uuid": "750a1475-7bc6-4a27-aada-f408c3c19fce", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652701173, "uuid": "80161769-1562-41da-b0c0-eea29f8b1ba1", "value": "6144:ZYa6VvNsjpdnDG3h8TQUOTamw8wo5IPlpLSa4JgUPfrFG:ZYDvN06yQEmw8w02pSRpG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652701173, "uuid": "bbd7152d-f69c-4a15-8c4a-abe21e791bff", "value": 252021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652701173, "uuid": "2b6bc667-3900-475b-a63f-520d8ef0ce5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652701173, "uuid": "d6de474a-3278-4b6c-a7f2-2b84e87806b6", "value": "FATURA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e62c29d-d522-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652710332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710332, "uuid": "18de165c-d05a-46e3-b686-effd622ed354", "comment": "Malware payload (Mirai)", "value": "ca82d13405ccbf263435f8a45bd21bf0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710332, "uuid": "8921b7bf-1f77-4fff-bb2b-ebe49b777ff0", "comment": "Malware payload (Mirai)", "value": "41929c100a23b8eb8a2fbaf8bc7c484cafa9cffd66ff9eb7321ba16a8a723ce9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710332, "uuid": "dccb04d4-cd9d-4939-9b1f-81291e2e25d1", "comment": "Malware payload (Mirai)", "value": "49209bc2ae2f10cbd02f8918b76988c9a11303e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710332, "uuid": "c15564a2-4e5a-4190-8dcd-467d36b9c8cc", "comment": "Malware payload (Mirai)", "value": "e493539c51ad67c8ca6948bd50c5acb1097f31a15a9867e2bf5f6d0614a2a44f964b361ccd34b295233917ce1cacfed0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652710332, "uuid": "2c4c408d-b36d-40f9-810c-c68ed72769f1", "value": "T1BFD2E15CB02021E0C1513C36B8985B957FE41FFAA5F97E221AD8C1798CC24ABEF73645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652710332, "uuid": "5d01cb84-d781-4a34-bb30-9c0b49b85c07", "value": "768:2Z43GNvMDpo3nTp7ywwKb7StLnaa7zcKi/bk69q3UELW2J:2Z3FMDynhyRlaaTiEL9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652710332, "uuid": "b1269b33-13c6-4ac3-a271-62899672f16f", "value": 29164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652710332, "uuid": "a7d1276b-76f1-46e2-931b-69c0c20bf151", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652710332, "uuid": "1bdf4dfe-1136-4549-a0c0-b88dd40c2195", "value": "ca82d13405ccbf263435f8a45bd21bf0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a0388c3-d4df-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652681548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652681548, "uuid": "0142640c-2b7b-4d12-a14b-4ea18bb55a5a", "comment": "Malware payload", "value": "c1b99cb9c9cf56fe0355737e4e5df1fa", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652681548, "uuid": "ee87f9bd-a506-4f50-a4c1-b8b480de2275", "comment": "Malware payload", "value": "425e84ac9fe60970bd317ede9d84555b1f994e9c2c102e44d6ed71e7f47797c6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652681548, "uuid": "b679c21e-e604-49b5-a80f-3f52a7d2154d", "comment": "Malware payload", "value": "c02627c990717d30ff577c6fbd6381393ade7bb1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652681548, "uuid": "479ac314-6817-41f8-b651-f127a43cf0b7", "comment": "Malware payload", "value": "e7d952af28891921f42e1b42930415d1b037014f84b2b51af9ffef8b8279c0c1245d9ba9c94df07c2a95bcb7716c5c40", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652681548, "uuid": "751ee4a6-3b21-4f7b-ab75-9f4c3e11964e", "value": "T1BBA13A247B146943FE84A9F0C804BEA70D11F1A2D6CFAAD8379CFC610B76338496B081", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652681548, "uuid": "8b656466-2386-4100-8b51-a6ef9482313c", "value": "96:2xOgZzsrCdZrnAMZOFEQWQ9xeYvpgBIre5qH4zHemQv31GdJqnL:2ggZzKCbrAp1FcD5qfZ3YdJqL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652681548, "uuid": "21cfd68b-39fc-4ed8-b78d-39e55393693a", "value": 4697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652681548, "uuid": "814a2342-0de0-42f3-812e-17e17b48a80e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652681548, "uuid": "8d558cf1-be80-4fb4-9c63-22b2cb7f6a66", "value": "Payslip_APR_2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ce8ba0-d4d5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652677461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652677461, "uuid": "7ffcd83e-8dd8-414f-8fb2-845a8ff6c04b", "comment": "Malware payload", "value": "c8e61b9c725ee801b9402f7cdb342f3a", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652677461, "uuid": "487f00f6-5fe9-466e-8628-92ef526cdcac", "comment": "Malware payload", "value": "429ac96989e566470d679d60a479cdd366065282442946d81186036df282ca24", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652677461, "uuid": "412af859-a277-499a-954d-e24a2fed8dd8", "comment": "Malware payload", "value": "955a323105568213cc832196de88956b61a59c1b", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652677461, "uuid": "8568db67-d3a7-47cf-9385-e58a0cfb1fd5", "comment": "Malware payload", "value": "9368a91d66c34bc4d045b1e6a82bd11967e09850d1b2f6807872c15896cd8345532545cb4f7a8ea209e30438491eb509", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652677461, "uuid": "db1eb7c2-ce28-4189-9012-e2fd04833712", "value": "T1A2E0F1D116F503584C34C1950535C1007FE9F11C6D5E30249266F0822723B41F497028", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652677461, "uuid": "c93a3a68-4276-464b-83b1-e357733650a5", "value": "12:zgzPtfJ19/GFKxwQv98nfPCwqdbqi7wL2gLUJF:zgzVfJz/GF0wQV8fKqiULtLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652677461, "uuid": "a293c0f7-ce85-4ed6-bf4d-d04e7492a90f", "value": 402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652677461, "uuid": "1d9c783a-9a42-402a-a2ce-26f5a788761a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652677461, "uuid": "ef3768fe-283c-4a4c-9b86-6ecb569aa7fe", "value": "detalhe-cmd-03.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8919790c-d50c-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652701035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701035, "uuid": "31d7a4cf-1029-404c-ae6d-9d82a31a7b59", "comment": "Malware payload (RedLineStealer)", "value": "31694520ace6ebf270337421668c843a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701035, "uuid": "b06a7b0d-936e-4c13-bbe3-f7293db0dc7b", "comment": "Malware payload (RedLineStealer)", "value": "42a39eb0eff9dccc54ca3d2d555709ec5a7979e8e3f0dbfd3afd2d472fdb814c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701035, "uuid": "694661ff-a7b3-4b3a-8771-3fd593899fb3", "comment": "Malware payload (RedLineStealer)", "value": "212eaf910f399e6c7686d7c264a2dd8395a11a5c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701035, "uuid": "db88b581-52b2-4efe-b2b4-4873b3e60899", "comment": "Malware payload (RedLineStealer)", "value": "f13713425bf7e7e845991698de4addf3bb2ff8e3bb624941ed3e80ebdf1f04a0222cd220ec082411f6c32120e60007b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652701035, "uuid": "c04c2de1-ba78-4aff-9043-722e5b43dda7", "value": "T17784F112B750D830E0B712304874EBE55F3F7962267488CF2B643B2A1F786E196FA356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652701035, "uuid": "c60c7b5b-a731-46c7-b6db-4b99ea9608dc", "value": "d4caf119a59974e14265e37638578a58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652701035, "uuid": "0e2e6cf2-115f-4adc-ae9a-4aeac63bbb0a", "value": "6144:8MNgEZvK3lBCE2KG9fF080nHXwE6R7ur9sUbX9YOv:8MN7ZvKuN1F0XHAerqkSOv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652701035, "uuid": "a39fece8-5c89-4b25-bdb3-bc6ccb99a035", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652701035, "uuid": "144bbee0-bb06-4083-b28f-2ee86fde6b6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652701035, "uuid": "07c3d904-3377-45ea-813b-7dc66af77a23", "value": "31694520ace6ebf270337421668c843a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34ae4645-d4ee-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652688009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688009, "uuid": "6c9d33d7-1aa7-4000-b804-6544455d34f9", "comment": "Malware payload (Mirai)", "value": "24d0dc402af0b4745229a8b4a012f517", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688009, "uuid": "1e9e59ee-024b-450a-b687-3ec074a4d2a0", "comment": "Malware payload (Mirai)", "value": "42eb9b635382833d4ef0a891c43b436d5eaa0f6d79423e85af1d133876d90163", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688009, "uuid": "979d71b8-5506-4e22-806f-b0a2eb8cecf7", "comment": "Malware payload (Mirai)", "value": "e9a84415c24c6eaada92911d1edbcd40506a9a82", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688009, "uuid": "da3fa22e-04c5-4ca7-b07c-3c8e8b093034", "comment": "Malware payload (Mirai)", "value": "e943d9e6d122a91967511cd8926be20f7f8ba0bfe14097944cbb5dab1029f05037b62b87c27abe92a2d0b0efa1f398fe", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688009, "uuid": "443667bb-6112-4f54-8433-4e2d43b656cb", "value": "T1E353E9627C926A2AC5E063BAF6BE418D332167B8D1DF3217CC212B057BC551F0DA7B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688009, "uuid": "e3ad843e-715a-4ca0-90fb-e7abcba52911", "value": "1536:wmHfUXVywKHMIeVOeKSs2KlkaLFgiZuiKjoh+tTnm:wmHfUl1IFMiKEhqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652688009, "uuid": "1dddf056-c15b-4dd7-a2e7-acc6c9ecb0e5", "value": 62700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652688009, "uuid": "50f22055-8f53-4325-87d0-df9cd329f267", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688009, "uuid": "5e649004-3b71-4131-81f2-eee8cad278f8", "value": "UnHAnaAW.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1745c657-d51f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652709005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652709005, "uuid": "ae21058d-e940-47c7-8b68-a84448979925", "comment": "Malware payload (Mirai)", "value": "f9ec1276c7e6486ff5b318a02d6a862e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652709005, "uuid": "84718ab7-e3e0-4773-933e-182ae0fa1867", "comment": "Malware payload (Mirai)", "value": "42f3741b700f3e7b28ea79ffe2727385b01338e79c239221efe051f14df380b7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652709005, "uuid": "d0775ab4-d455-421b-8d41-93051c2f468e", "comment": "Malware payload (Mirai)", "value": "40715854bb52635f00dc1151faec10fc84ad310d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652709005, "uuid": "b62b3c5b-eec2-4912-a593-7794679e4647", "comment": "Malware payload (Mirai)", "value": "65e64faa48c807d6f2dcbd358bbcb71ef9e0a0589eeb12e1579029d16ea65913f55e9bb8cc51a95d631f4324558abe19", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652709005, "uuid": "c4854a3f-0fe7-4b97-a9ad-6ba3424fa72b", "value": "T1D3B2E1561D4D071FD205B077F1ED9E68857CABB4DF3E48A4778F858AA18363E8129C50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652709005, "uuid": "644e4c15-0fa1-4d04-bc7c-9883f46ac23b", "value": "384:MYV3MlsbHlq0vtzf1aQ/CjHaI6qyL3s2ZfrN9IzDL2TAJkF1q2Mx67fTEV3xzMjj:LOlr0vtj1aQ/01nE3s2ZhRTAgq2MxCT/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652709005, "uuid": "f463f4fd-c4b8-4f18-9f94-0e9c29494a3d", "value": 24080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652709005, "uuid": "6fffef5d-a258-43b9-b06c-a09026bc4a9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652709005, "uuid": "cbb98cf5-8803-4ab7-bca0-296620a8e565", "value": "kwari.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fddfca7-d527-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652712455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652712455, "uuid": "0b569767-274a-4f92-b517-4ebdea0d7b03", "comment": "Malware payload", "value": "00d12d0591655fcbd8aa0e630d3c69f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652712455, "uuid": "2006c961-9ea6-40eb-829a-f1380cedafc3", "comment": "Malware payload", "value": "438c2611826bee88cd811d8647c502d80d64bf4d679e1e189806512b2ababadd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652712455, "uuid": "02edca6e-8696-4699-aada-211eb57e3062", "comment": "Malware payload", "value": "72a788bed4ceeeedccd50caaffe9148c2907882e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652712455, "uuid": "2af03e24-df23-462c-b533-9171249a8f5d", "comment": "Malware payload", "value": "06677165f34c192cb2ad91e413a1123823ac7a2a5e35f6d7bdbd796f1c1eacbe51f2f1d010e3c269ccf59dcc119030fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652712455, "uuid": "94e524e0-6318-43ff-b70f-1ef5a28f7415", "value": "T1E0B2869D4F44826FFBB39EF9B9AB96232376AD895371A71740D814691C2F10B18B3D0C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652712455, "uuid": "e9e95658-bc1f-42c9-b63e-17470b5e6042", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652712455, "uuid": "b3eb4831-3a52-4625-872b-1fa894020fae", "value": "384:Gjd9zb+dy8SxheAQkz4lWkVDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDydR:6zbb4lWkVDDDDDDDDDDDDDDDDDDDDDDm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652712455, "uuid": "6131a540-4d20-4ec0-95cb-1b5df0f748f1", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652712455, "uuid": "e2bc0724-79f3-4afa-b974-852294866bf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652712455, "uuid": "3592d793-c23f-49e1-9c8c-1b07b0ddbc66", "value": "SWIFT 220516-001 USD15.420.00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faacdf09-d56c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652742458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652742458, "uuid": "54ad7983-2bd5-47cb-8682-42b60d15fec1", "comment": "Malware payload", "value": "5f88bf5f86f9008f126bb65c901d2323", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652742458, "uuid": "9d019b2a-2b0a-44b1-9a43-11b1d07dc3d8", "comment": "Malware payload", "value": "43ede0cde800eb34aff12099261f52b8e39c5fd8ac4bcd3ed95b89ed8304d924", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652742458, "uuid": "962e7308-402e-4b62-b33c-85125e2e6b21", "comment": "Malware payload", "value": "54e701a2496256c3914d044e44ec60e7de49bef4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652742458, "uuid": "8cfd862a-0037-4cf2-897c-be612f42aee4", "comment": "Malware payload", "value": "e3acd92776b3f970f6500a328af4bddc54f6dd3e95a5c397b868df17c3f0b2089cdd07799b27e78007f0ab8a5ee48e4c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652742458, "uuid": "28789252-5fe3-455c-bc97-2d88cb37061e", "value": "T1A5940807EA20A41AF61784B1DC5966B6182E2C7624C49D07FFC2BF5938B16D778F870B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652742458, "uuid": "c5a77ac1-68fd-4618-9642-5d9f08d1ee93", "value": "d364a42e77b13266ed0e9a62edb81aae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652742458, "uuid": "71490fe0-43f8-48ba-86fe-c9d72a9e4a2f", "value": "3072:fOHcJy1JycN5kOuI74C6HjTZ8ZFzpAGY+qkw/ldVJmh+wIO4r8XgQKtMz7QrW9Yf:foiZ8ZhpAGNmldjmgwIV4nQgPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652742458, "uuid": "bde86814-e572-4b5f-985c-765d0bb21ae3", "value": 422888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652742458, "uuid": "9ecc5aeb-ce9e-4f55-8e65-62ecd87de128", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652742458, "uuid": "abcd78cf-6c4b-428b-9560-d67f747528c0", "value": "5f88bf5f86f9008f126bb65c901d2323", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06d4c36a-d541-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652723580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723580, "uuid": "a6c7faac-c249-4be7-9b60-f2fed90fb9db", "comment": "Malware payload", "value": "bc076fc5b576b118b15658ba9033c36e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723580, "uuid": "c7a1e115-bf43-47a6-b128-0ea9d79a5477", "comment": "Malware payload", "value": "44ab016d4abd3ce79bc9bb28240cc00b48565a8e0fdcf06c729a289433861059", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723580, "uuid": "06bf50b0-b06b-4e1d-9d9e-360ed0d692ff", "comment": "Malware payload", "value": "1b823179906b35fefb1c0aaa19dc3e120a06748c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723580, "uuid": "e825c22b-8b03-4715-8108-f0949de813a9", "comment": "Malware payload", "value": "fa592830e05893d23fedbe0a902464259e7c665aa28aec3ad596fd86980a2b1b5a50571e60ba87539d7db8bebbcdd74d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723580, "uuid": "cefe25e8-ff52-4176-94d2-77121600e30c", "value": "T1B184C04673A48079EDB79338CC574A47E376B86907B0678F1364436A9F3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723580, "uuid": "6b2e270c-c884-4d8c-9f60-bb85520e6c2c", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723580, "uuid": "26be764a-2ef7-4ca7-8fba-fc43333d3614", "value": "6144:EbmRW/X22TR72tKbxGeXkesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/XpRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652723580, "uuid": "b31d8ba6-2d18-4a89-a905-89eed3ac5438", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652723580, "uuid": "ffce4fcc-6a7e-4d2a-a12c-e6f1e47c15fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723580, "uuid": "c8cf4dd0-3ef9-444d-bd45-f5d95fe76f9d", "value": "Ig2FaMSCdBwND.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ee7f76b-d563-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652738411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652738411, "uuid": "5b2bd130-ccff-48d2-bb65-55a13d1451c2", "comment": "Malware payload", "value": "45355fe5656814c65d7300b42edc11c3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652738411, "uuid": "5f9379b8-504b-4cbc-8db4-8eeda04d248f", "comment": "Malware payload", "value": "44c5a78a830026cea3a276f5129efe14c2ace09c7aa3717bb5a23f38cb369772", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652738411, "uuid": "3f71f147-4b50-4a5a-96dd-a8ded37ae1c7", "comment": "Malware payload", "value": "1019b27287781089216a4a1f8d886c917e0311f2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652738411, "uuid": "ac9834f6-c868-4b25-915f-2f385103da0d", "comment": "Malware payload", "value": "6726bf0209568c881c580c0d43873c2c5ce2dc255828b0a13f05c446f2d7ec6931127c77c1c46d5f98f0c749bae66fa4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652738411, "uuid": "f253c736-659f-4ca5-81be-cdbe1c9e55f0", "value": "T1F874C046B3A840BAED678338CC535647E772B45A4B70A78F13244379EF2F3915A3A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652738411, "uuid": "e8b9fa44-9a7c-4865-880b-42521f6c9c15", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652738411, "uuid": "f20187ad-98eb-4476-a8be-8e9f35004827", "value": "6144:Es/2WX22TR72tKbxGe3kr2rlsy+vbEFXYvlx6xJkUjnKd:Es//Gi7/3gDvQFXTH9Kd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652738411, "uuid": "3bfa24f9-6d06-4eaa-b82e-6da3d9a9ef29", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652738411, "uuid": "c65c8988-6ec9-4e51-b766-0d42803c3b39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652738411, "uuid": "1435a6d6-8d3e-462b-816c-98af490fb158", "value": "UFfCflZjJd.lGA", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e533a4-d555-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652732440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652732440, "uuid": "8a6d4f18-6c11-4292-a6c4-724dc384ea19", "comment": "Malware payload", "value": "6913a4a92b9c453cc63d81963ae9d65d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652732440, "uuid": "20e7dcbd-121f-4bc9-babd-2b152af8dbd1", "comment": "Malware payload", "value": "4569409e80631fe85b794a736958f686aa04672e73f870e8aeddaad6b7b971c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652732440, "uuid": "479c46fd-84d2-4493-a51b-44d7ed9620bf", "comment": "Malware payload", "value": "1dadc733deba8b910d8209c87444db258048b7ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652732440, "uuid": "16c1b3e6-c042-4a3b-842a-2d0b085ae5bf", "comment": "Malware payload", "value": "ad9edc3cbfe434b1259cb8982375c4099d61550c2cff9afc8bee91c260fa60e3c462961ce8279109adfda5870253db2b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652732440, "uuid": "c6eb9e4b-c830-4bc9-971c-25967d70e481", "value": "T164B4E08C7650B1DFC81BCD768AA81C60A620347B534BD247A45722EDDA0EADBCF456F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652732440, "uuid": "f3e345c6-998f-408e-b587-6a1ac4a66c83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652732440, "uuid": "f29f5602-4f44-4af1-b0d8-0eab446a8499", "value": "12288:bg2x5QzYEuV5iBTdZ4JlByH8tcVdiRtGqAXomIk1Ad1rXS:rQzSeQFyHCcILGqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652732440, "uuid": "b648ca6c-f8c2-4bf4-813e-2e7667d1c7b0", "value": 522240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652732440, "uuid": "98a4dc88-e9e1-4d0c-ab43-2479537c7272", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652732440, "uuid": "a6bf5b8d-a2b0-40ab-a4fd-9b7411a155a2", "value": "6913a4a92b9c453cc63d81963ae9d65d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9307336b-d4e0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652682154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682154, "uuid": "a5eb009d-1b72-4ae4-affd-ed54a1239939", "comment": "Malware payload (Mirai)", "value": "ef7d0770bd6c7a97422967c4c0a92fcb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682154, "uuid": "f5ba34e3-a334-4a6d-99d3-963a7d900fd4", "comment": "Malware payload (Mirai)", "value": "45696fc09e60b22a67eecc749737410911b47046ba085ce8bbf5b877468f5dc3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682154, "uuid": "ab863b5c-dfb3-4c40-9a7d-56c45ba94cfe", "comment": "Malware payload (Mirai)", "value": "90bb6fe4e23d5334e3560770e9a0241a2893ffbd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682154, "uuid": "609957f9-aa87-4fa6-b184-782a6fbd7172", "comment": "Malware payload (Mirai)", "value": "ae5c282089d9f4494eda8c775ffbb1053c904bb0ef69b80e58821f8f84dc7bceae786033ca013a38ca5384da49e64466", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682154, "uuid": "4af9cd3d-d66d-466b-8f8e-1d0af46c26c6", "value": "T160E2E1E9E0846FE2DA6F9E767E52D3C51F430FD7737215A020C2DF510C1BA212256ADA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682154, "uuid": "c35fe3a4-da72-4371-a783-121bbebc7c24", "value": "768:ZP8xCiYjrGuX1dnorPjeadOTMy2vT4uVcqgw0+O:ZP8YdmuX1dorrqI4u+qgw0+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652682154, "uuid": "ede4db29-0962-4482-b8c9-6ff516cdf4b5", "value": 32428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652682154, "uuid": "d97ac231-ae6d-481c-bf51-056c9b31419e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682154, "uuid": "69b9786a-2cc1-4d0e-8d33-ddc79bca6d84", "value": "ef7d0770bd6c7a97422967c4c0a92fcb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9936c18-d537-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652719692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719692, "uuid": "41a2aa40-95ba-4d80-8526-17220cc1e45f", "comment": "Malware payload (Heodo)", "value": "6648910d92a93c94f0c517d8cd970635", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719692, "uuid": "9e2290e0-2efb-4763-a288-3bc366ec2eed", "comment": "Malware payload (Heodo)", "value": "46cf759c0576f1d81c4593aa7ef89b99d3f7779858d217f3d7fcd7a0747bab79", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719692, "uuid": "3aaea18e-5327-47b2-b136-7df027db67cd", "comment": "Malware payload (Heodo)", "value": "34e673dd788360e4cddff6e70d372af41aff1aa5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719692, "uuid": "afba7b99-eed3-416f-86a5-523d4506c83e", "comment": "Malware payload (Heodo)", "value": "41add818f12c6af700025d6054a34b6519b70a44ebebadc9663f64233a0e349fdd1d98ebf27c8bb026db1c33fbd09020", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719692, "uuid": "984d7266-a44e-4c70-8163-bd43f7d48600", "value": "T11C74C046B3A840BAED678338CC535647E772B45A4B70A78F13244379EF2F3915A3A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719692, "uuid": "1cfa1d6e-e1bd-4a2e-9bc8-ce29d31eba60", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719692, "uuid": "2706d910-afa8-44fe-a160-d7c5a19c6761", "value": "6144:Es/2WX22TR72tKbxGeJkr2rlsy+vbEFXYvlx6xJkUjnKd:Es//Gi7/JgDvQFXTH9Kd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652719692, "uuid": "c81a4117-3a2b-4815-827d-1f0f2d301e54", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652719692, "uuid": "06f1d98d-b771-4d00-b65d-a203ca585203", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719692, "uuid": "06156261-d73b-416c-9507-d454d4c9dd54", "value": "6648910d92a93c94f0c517d8cd970635", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89763797-d545-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652725517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652725517, "uuid": "de13c11c-4034-480c-b96d-d1a9ab9b94a2", "comment": "Malware payload", "value": "555eddbdcf2bbf8091931d11857c560e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652725517, "uuid": "5dd00c6f-aca7-4121-b542-1cb2866f45e1", "comment": "Malware payload", "value": "46e0f2917ce08084587be463952217e54823e227852cd3a534ab4daea0e96a18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652725517, "uuid": "15b860ef-d522-45fa-81ea-419ad0f0e1fd", "comment": "Malware payload", "value": "b6344e57d9cffe81c90f0064c3ec826cdc6a3045", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652725517, "uuid": "12a5ea91-30c4-4102-b27d-7619b0769fbf", "comment": "Malware payload", "value": "22c75a3cc653bcffc71559fb24fd7985478fa9663c4b4020a3313b100dc25352d5f403f0f13ac82e9420de47d63a0ce5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652725517, "uuid": "10077f76-fda7-4f53-af70-746e26f864b6", "value": "T12B84C04673A48079EDB79338CC574A47E376B86907B0678F1364436A9F3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652725517, "uuid": "77eb505f-69d8-4e1b-bd29-051a8ead7262", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652725517, "uuid": "f29bbfa5-a11f-431e-89a0-e59065f03c70", "value": "6144:EbmRW/X22TR72tKbxGeskesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/spRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652725517, "uuid": "2250ca07-18b9-4a3b-ab19-357983875b0d", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652725517, "uuid": "38e7cf5a-e859-4a11-9934-17c3efdb453d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652725517, "uuid": "c329822c-e0ce-4475-a287-92dbf1ae0734", "value": "555eddbdcf2bbf8091931d11857c560e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fd43dc2-d51d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652708321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708321, "uuid": "54c00108-d94e-46d4-a394-bda39c35e6fa", "comment": "Malware payload (AgentTesla)", "value": "04821b01daf031cd461f60aa3e534a38", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708321, "uuid": "80c4e06f-b66f-41cd-b6cf-4adb3aaedd3d", "comment": "Malware payload (AgentTesla)", "value": "46e54fc84ea88fea0275cb5c20794b27e9bd3a557475e80f4c0ebf55ff055885", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708321, "uuid": "687592b0-8f4f-4b7f-9f5c-d0f7df34800f", "comment": "Malware payload (AgentTesla)", "value": "9fd8f08013cb5ddd6f4e3df90c1a648a7c9691a7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708321, "uuid": "94294e86-6404-42aa-8b1c-1ec500a91691", "comment": "Malware payload (AgentTesla)", "value": "a594a2fb13699af2982f6f2c09ca6b82472a69556abd29e20cdb55cbaa9e62eda994092f9d60a2059a5f09cd5e07f258", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708321, "uuid": "66958c2d-d7ba-491a-b87c-c0a7bfd5dd44", "value": "T1007423B204F3CD9F756DA05EC856CB6AF53372F99C8128D1912ED4322027BC85A9D68E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708321, "uuid": "b6f14a6f-d8a1-4358-a764-8e337de9a108", "value": "6144:WGYNuFtgtmb5SyH5VD3Z7XHJdpMxeL0jC4L9RowI7F5giIbFJN5bFPzMNHudExor:OEFtgtWzV97XHDmHzWwIjSF/5x9G4v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652708321, "uuid": "fbff36f4-ed41-4972-921f-faf20e0dbae6", "value": 356166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652708321, "uuid": "2bd6f1d3-f175-48c8-b03d-f3fe93ff7950", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708321, "uuid": "2e45b154-4fd5-41da-8f48-771ef99932e2", "value": "PO.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf4f531d-d4b6-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652664190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652664190, "uuid": "389eb747-5dc9-4a51-8b95-e57aa61031db", "comment": "Malware payload (AgentTesla)", "value": "e2112c296020f3de1747010fac6b84cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652664190, "uuid": "bf923fce-3aae-4728-903d-2917fa07acfa", "comment": "Malware payload (AgentTesla)", "value": "46fa60ef2d60341ca91fb98d550a3057deddd11f47347d2f295c6ab06c438a7a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652664190, "uuid": "9322af1c-8883-46af-8422-8a34c16fa991", "comment": "Malware payload (AgentTesla)", "value": "63983d87ca38917353aceec69964ec0e11d66d70", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652664190, "uuid": "3d9e9a44-697c-4c7c-8e74-96fbe7a2c806", "comment": "Malware payload (AgentTesla)", "value": "086aa57d0bbae2b5960e71022b4fb3beaba7ff65b574775f20535442ff9abae28769cdd7df2151b6b9ec858926e2e121", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652664190, "uuid": "5b78e7de-1c8d-4140-a5e4-4f1393b319c5", "value": "T120D47D9C365C71DFC85BC572CAA44C64EA60787F671B9107A0672A9DAE2DB47CF200F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652664190, "uuid": "be42ec90-7232-4d5e-925c-ca19435855d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652664190, "uuid": "2385209f-47bd-40c3-9693-429cd25608d3", "value": "12288:NPop1u9KOYWDuU+7TISERfnHQ5h4ebOtD6EKEvfFf/QRzzv09kMSbdJrlCbrduTv:NPoHu9VYkiIVFwzZbOhw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652664190, "uuid": "5673b517-884e-4917-a875-362fb0b7fb6b", "value": 635904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652664190, "uuid": "4e0f5db4-4b11-4f8b-ae8c-09f8b9e98d21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652664190, "uuid": "4dd47b83-2b23-43e6-aea8-76189beebfcd", "value": "slPQoDUf4q3funr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1657ffab-d51f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652709003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652709003, "uuid": "729f687a-0744-4654-b9b7-a764f63caeab", "comment": "Malware payload (Mirai)", "value": "ed90af18c0eabcf664a27ec5d1d2d835", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652709003, "uuid": "e96a9a5c-2add-4e4e-be37-874fa3479b1a", "comment": "Malware payload (Mirai)", "value": "470d763ce099232f9b76c19c911d29b3a58d3ebc542aa509338d7a18cc067c98", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652709003, "uuid": "7ee9d052-402c-4016-aa39-f4014fb34b81", "comment": "Malware payload (Mirai)", "value": "cd709c2a73ab82c35c21a99ab243ae79d2f44f13", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652709003, "uuid": "12c96821-bd52-41a4-b7db-9cc4cea320a7", "comment": "Malware payload (Mirai)", "value": "43160dc17a0fe9115ee4cc31fdd26dc99d4b81c435f8ecebbb714855eb1192ad64a061eaf299de569efd22260e30ca4c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652709003, "uuid": "b380ed84-d284-4100-894f-61c47eb21ab3", "value": "T1F023F1A1FABFDDA2D2018C71FDB5DBC1BBCA5975E17474B3131C0B29E9400412AB9A83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652709003, "uuid": "62a9d8bd-488c-45b3-8040-25170be8937a", "value": "768:gBH8ikdyLocAnRTYxZHl30HrRultT385gDGX7pc9q3UELi0db1p/ecHWfIUm6NQo:gBH8GMcOIKL8ltgO6XLL9p/ec2wUdKl2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652709003, "uuid": "56447f0f-90c4-4b0f-93f2-d6deba9692dd", "value": 48376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652709003, "uuid": "34489b26-ebb9-4613-b0bc-966f78fb3716", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652709003, "uuid": "0fc48c5c-4426-43e7-988c-cf340cfad1f8", "value": "kwari.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b256cc-d51b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652707360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707360, "uuid": "9901c15b-ca4b-4dbd-9c90-4a6daed1b545", "comment": "Malware payload (Loki)", "value": "dd681f3150ec84420322b08be5b61f67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707360, "uuid": "b6a5bb05-bc32-4fcc-acdd-b288ff8ff15b", "comment": "Malware payload (Loki)", "value": "47802875c3a8e65c2408aac1e29bc5204147e0f69f7bfedb8e3a2460c6d774d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707360, "uuid": "1b30ac82-76be-407a-ab4d-85b44f3ddd39", "comment": "Malware payload (Loki)", "value": "b3e7c18e59360f4e8103721bf3205306edc3ac17", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707360, "uuid": "cf1f6eba-b1b6-4d95-953f-3a815856f0b7", "comment": "Malware payload (Loki)", "value": "3f4607fdc943f27f89d8023b9aba218a5c22bdbc6df36a185f72a69b52019ec2338f4314486952b1be032dc38d262526", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707360, "uuid": "3788d0cf-aba3-457f-b308-d0e1677afb31", "value": "T1B8B4CFAD3260B5DFC85BCD72CAA41C60BA607477431BD343A85322ED9A4E99BCF151F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707360, "uuid": "14df2bf9-7733-4411-8ba9-a7bda4417fb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707360, "uuid": "64f24e4a-34e8-4d71-ab48-99e70dc5275f", "value": "12288:z4UGCu0k3YaWG/md6lu57jIWDcD0OBGNvakv501vSMcmw:zdlkInG+bo4fN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652707360, "uuid": "953d96e5-1127-4367-a5f7-27a72f13ced0", "value": 519168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652707360, "uuid": "d8d66d60-d40f-49e5-87cb-cb9a06e945c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707360, "uuid": "d97217d1-9ada-4205-bd42-cb4723dbecd0", "value": "dd681f3150ec84420322b08be5b61f67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e0b5108-d540-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652723404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723404, "uuid": "f8162508-9270-4286-9aef-d5106840aa2c", "comment": "Malware payload (Mirai)", "value": "5743c6de3843ce1e8ba562ec7bc95cbe", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723404, "uuid": "60a8c4e8-aec6-4f77-a57c-ce1757fdfda5", "comment": "Malware payload (Mirai)", "value": "47ffe7ed2dfe1d7030bf51affd3e767040feb7efdeab7bcccece62b1cdb29d78", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723404, "uuid": "3c141b7d-4651-4d65-a89e-d7ea368dfcd4", "comment": "Malware payload (Mirai)", "value": "f6984a28c124558ae2fd2b3f8caa301dc0e50fd0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723404, "uuid": "81768c23-5cb0-4105-bc8e-159be7ad32e3", "comment": "Malware payload (Mirai)", "value": "65de5658400650504707a0b363809c71109abecc0865f815260c31b0be9bfa4b071a555800c749c354047cdc2549cd60", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723404, "uuid": "d24871ca-5c8d-453b-ab60-4ff4eb3de1f1", "value": "T18D032A036451C2FCC455D6704B7FA62ADD33F03D1235EA9A73A47F26691BE312E0E989", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723404, "uuid": "5400bce0-1ceb-4fb1-a649-1e265095dc2a", "value": "384:v9skxJc7fNhRbn0uA514hl/zB7BUNGQszTfaOPTP7DqvY+UuFoGkDLI75XsxLeCk:vfk5b0D4vt+Nj2aGz7DtbUoSCeykh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652723404, "uuid": "9337bc39-766b-4194-b7a1-165e2c702e2d", "value": 38144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652723404, "uuid": "a6cd645e-9555-4aa1-b60a-aed510565010", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723404, "uuid": "5add128a-9019-40d0-80dd-f25677196ea3", "value": "miori.x86-20220516-1750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b283161b-d56f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652743625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652743625, "uuid": "122afcd5-7bcb-457c-8579-4318783c5ad0", "comment": "Malware payload", "value": "7d759b104fd4da27fb11cb6abbdf0395", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652743625, "uuid": "552aadc9-cff1-4029-8770-f47126499dca", "comment": "Malware payload", "value": "4834d13feb3391e788c10950cf20622c559046847f6c14b1f426ec75fe1df562", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652743625, "uuid": "e8332f70-fbae-47b3-b7e3-79ff17f8ff39", "comment": "Malware payload", "value": "7b7500765676718fa471f75d0278961c53b3ded9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652743625, "uuid": "5c6341d3-c96f-4b74-bd14-948ea561f654", "comment": "Malware payload", "value": "a8913e0571b0d2df6f5b8209e078b6f867d05383a9fa823511f9a5cc92c8bb4533119f90f1177350c719292ae20a55ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652743625, "uuid": "ce965459-b67b-4fc6-9c87-ee6f2e789463", "value": "T13084C04573A48079EDB79338CC574A47E376B86907B0678F1364436AAF3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652743625, "uuid": "96b812e6-d310-4fa1-a2b0-ad363d039b20", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652743625, "uuid": "fe7609c0-e819-4ecb-a721-7efdf215c252", "value": "6144:EbmRW/X22TR72tKbxGeykesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/ypRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652743625, "uuid": "4f7cc7da-e76c-4356-8f7e-28684c739942", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652743625, "uuid": "c1880964-d722-4c18-ab0e-4bf82f79c3c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652743625, "uuid": "66f16430-7af2-4e33-b09e-02ab1ae6a472", "value": "7d759b104fd4da27fb11cb6abbdf0395", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7abbde43-d4d8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652678677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652678677, "uuid": "dc2a56de-4f77-4d59-abf6-b9151f34d443", "comment": "Malware payload (Mirai)", "value": "6c9abe257702349b43e076fec2e04bee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652678677, "uuid": "975f0baf-df60-478e-9688-bf36f42eb60f", "comment": "Malware payload (Mirai)", "value": "48d728a21df9732b6cfe40b195ff52bdbbd064f179211d41c259bfb343918ac3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652678677, "uuid": "46dbdf16-bec6-4fb6-a728-65cc234e80d6", "comment": "Malware payload (Mirai)", "value": "5102c3d1d44129fadbe68afaf5aec3f363fb7a8e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652678677, "uuid": "ea6bec97-8701-4536-8d32-2ecda0ddbdcc", "comment": "Malware payload (Mirai)", "value": "f01e33bd1b2e08ab2e6ead92a2ba4f70f6fefddd6e9a54732cf8c8aa3bfc4c89de273e5863ab10c378e09e1f2865921a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652678677, "uuid": "8d4b89c1-85ae-44ce-8eb6-739dacd11a8b", "value": "T1C8539FB6C1A8ADE8CA648678B610C8788723D405A5E73DFAD746C657D007AECF049BF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652678677, "uuid": "d2aafcd7-ff26-42f3-8f67-e1eaaf282204", "value": "1536:w//GMJ22V0haiwtTCSPN0sJ6TXTFf2Ps32WWlvi6JnuCMQ:suMf+RBSH6TjUP+2bJJnu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652678677, "uuid": "703dd9e6-a143-4a37-86b0-a333c8eb3006", "value": 64028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652678677, "uuid": "ac7ca049-913f-4bab-b6bc-dbe12946e32c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652678677, "uuid": "74a6e606-17bb-4755-bad7-8743252f9738", "value": "6c9abe257702349b43e076fec2e04bee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a18e52f-d52e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652715640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652715640, "uuid": "dac13589-daa5-4a9e-8de2-bdab3b6e4093", "comment": "Malware payload", "value": "5ba45720ddc526c80ecf135211876183", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652715640, "uuid": "40906519-9eaa-48f4-a0f8-883a002819f2", "comment": "Malware payload", "value": "494e50277e9added0f90ee0791c2ac21c54c18ab0b0b9820c66fa7cf437497ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652715640, "uuid": "c6e5e7cd-f058-4eb7-a0d5-d6d601831d3f", "comment": "Malware payload", "value": "27d3947d73caed97a805b8393b4af761d31667d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652715640, "uuid": "fc093f66-af9c-4f11-9119-fc60fc7055e4", "comment": "Malware payload", "value": "f36c386eb0ca830de322af11febed40c36ee4221a6f4e82d1aa8eaaff116cfad9fcab93c0d2d04eb16616924734b9efc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652715640, "uuid": "d28b045c-673d-4e8d-ac52-8b31fc4468a9", "value": "T1B614A6A0E665F8AEE429883A8979D5211E57A72CE0F4063F219C711979B738350FFD0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652715640, "uuid": "a06ec056-396b-49c7-9c4a-2097f2ddc752", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652715640, "uuid": "11d0ff5e-4537-44cc-b7a1-675fd3161a44", "value": "6144:79biAEHbORGSalRPfLSs+e3Vby3SmtfnVgLyBF:0DORGSalRHLSs+e3Vby3SmtfnVgOv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652715640, "uuid": "37b1c97d-c705-4901-aafa-40c4f69d3789", "value": 200376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652715640, "uuid": "3c3cda43-b1b5-4ff7-a8d6-fbd4b3740af1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652715640, "uuid": "a4e2a3c7-9f52-4af7-bf7f-dfe87023d138", "value": "ORDEN DE COMPRA - PO02349.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b19bdab0-d506-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652698526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698526, "uuid": "a1d5a783-95d8-4f34-b5e8-65bee31b5977", "comment": "Malware payload (Heodo)", "value": "efa643f636af54a4fbd8ff97b6704e60", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698526, "uuid": "f4ede7f8-002b-40bd-a1fc-cb179a160164", "comment": "Malware payload (Heodo)", "value": "499cfecf6f41d3b0924b458159e513fa81aeb37565567dd927f90fe674f4c8b2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698526, "uuid": "864b1796-c7b1-4e91-8b5a-263f01e62944", "comment": "Malware payload (Heodo)", "value": "992d1b73b553c1b29dea6f25c85de326f5518e80", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698526, "uuid": "04e30a57-4750-44a8-b272-3ea82462ff4b", "comment": "Malware payload (Heodo)", "value": "f0677ba5d811b9c58900a6c1f8f64f2f9b6fa84d19d9326cb5bf147b334564883a52c5c649ebc5ddbba4e16af94bd94c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698526, "uuid": "743cc9b8-b870-4738-87c4-0b1fe057304b", "value": "T11A055A31EB6C8492C6A3553D88A34B06EE7AFE940B6183CB12A0733E9E777D45C35671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698526, "uuid": "6390ab00-c237-4ec7-b046-768b689444e6", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698526, "uuid": "69efc3f2-af7e-49d4-ba4b-236e75b95acc", "value": "12288:BeI3xkoz0/7aG8GkZHFT1Yi5a8kL37eGfv37:cYyozAWGxGx1Na8kLqGff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652698526, "uuid": "1bab5d12-36c2-461d-8e86-9f7e8047446f", "value": 800256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652698526, "uuid": "f5405586-7c61-4078-86b9-49db4d245f9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698526, "uuid": "a6114bf6-6de3-424f-94ab-67490edafe3b", "value": "efa643f636af54a4fbd8ff97b6704e60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77a596c5-d4d3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652676525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652676525, "uuid": "e4c1a9ff-4296-4ea2-9149-eb1429fdfb64", "comment": "Malware payload (Loki)", "value": "325496748cb0e5b51ff4cdff645972e7", "object_relation": "md5", "Tag": [ { "name": "Androm", "colour": "#08C503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652676525, "uuid": "94afcb2f-a19f-4542-a30f-1ee5aa7692c1", "comment": "Malware payload (Loki)", "value": "49cd6c22ba6cc6d91ffd7db249bf010ff451319101614de0cd5fcefc1a0c38e8", "object_relation": "sha256", "Tag": [ { "name": "Androm", "colour": "#08C503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652676525, "uuid": "f24cbc3e-88f9-4c88-8a38-a8baa5b8e0d3", "comment": "Malware payload (Loki)", "value": "71e0913867e2104f45866a3599cc3794ae963ede", "object_relation": "sha1", "Tag": [ { "name": "Androm", "colour": "#08C503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652676525, "uuid": "b3e56dd3-f405-4e35-8def-44902470aac2", "comment": "Malware payload (Loki)", "value": "93e3c64d07f2e53a8c079c0b6f4bcfffaf6dd4881751a96ef181cd3b5846a089f6043d96d69808f3b7a4f67eb857037f", "object_relation": "sha3-384", "Tag": [ { "name": "Androm", "colour": "#08C503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652676525, "uuid": "eb4abcdf-0b77-43a7-bddc-136b50400030", "value": "T1BD941284FAEC936DC1BF55B8723741580AF2B506BA31EB6C0D9760E62476F878F50A09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652676525, "uuid": "c1b9732a-d2ec-49de-b1ed-0cc110a33dae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652676525, "uuid": "4504f640-406c-4a9b-912a-f616dae72e02", "value": "6144:eQIRe0Dwic0GTblQFK5mtBO2uJIYoV2mvFWAFgFf46Ey0pBqzpQE6DFQZ+Iw8Sap:+e0sgSc4MnuJIYEBFgFfcfpQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652676525, "uuid": "79c57a62-d629-4a26-927c-021b409ce664", "value": 441856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652676525, "uuid": "74d5ca4a-000c-4a0c-914f-27079aa5a03c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652676525, "uuid": "c9d827dc-cb08-4e04-85df-0f1c23a21374", "value": "82926898.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb58bc1-d511-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652703241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703241, "uuid": "23289da4-2690-4c18-8b43-bdf5581b071e", "comment": "Malware payload (AgentTesla)", "value": "b3b4d140cd337d4df0ded27118c8d5bf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703241, "uuid": "0c8224e0-15a9-4212-94b2-322dead2e8d0", "comment": "Malware payload (AgentTesla)", "value": "4a40884d9847b1e155498dda174e2d120056fad63549d646dd4282f9f2c3a17c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703241, "uuid": "28a43041-0ab0-4cec-a885-aef1bd7a7b5c", "comment": "Malware payload (AgentTesla)", "value": "8ee2c089b9b25a2383d80f11ea0f529f0a60f336", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703241, "uuid": "a57fcf35-54b2-475f-ba3f-634e74968f1a", "comment": "Malware payload (AgentTesla)", "value": "2b3da9c2e873413cd6340cc6b7df3d672762b0c60186798768cc1876b12c147e8b3f4d8cfa7ac1d7f072a3e065a49839", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703241, "uuid": "12589c24-f417-446e-8eb5-f83b6cdb9124", "value": "T16293F06182E9C96DD2356EFE4007529E83A94F34561813027EE1FF9A4EB0EECBD50397", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703241, "uuid": "96779968-4140-4d8d-8e6e-af4aa6d9276f", "value": "1536:lbgxxorUNgHlWwEsKMXIimHBcqWXXFxnyHQ3mGinDJ+wqtUuW7sSVGF09kauQvpa:lbgIraaWwE8YimHBgX1xnyHQ3/ZttLWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703241, "uuid": "774b8796-eb2c-4f86-9ffa-ac2cb644d892", "value": 96256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703241, "uuid": "15af2261-e1ea-42ae-bad2-990e98a9fbef", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703241, "uuid": "8243489b-c8ad-4fe1-8281-a1448922e56f", "value": "PRE ALERT 2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be705ca1-d505-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652698118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698118, "uuid": "268b7adf-995a-4d2f-bd95-82ee1be8c84a", "comment": "Malware payload", "value": "1b934c5d68cb72d6d4f0ad6b8e168df3", "object_relation": "md5", "Tag": [ { "name": "jpeg", "colour": "#E03B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698118, "uuid": "b39ca439-3dea-4a8d-add6-17a77409d5fa", "comment": "Malware payload", "value": "4b5fb3343e4297fc019470482e63d5f3ba39cd06a2f1d6cf49c6308b58fcd8bc", "object_relation": "sha256", "Tag": [ { "name": "jpeg", "colour": "#E03B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698118, "uuid": "c3d3b51d-3eda-4ab4-b880-7244ed42f325", "comment": "Malware payload", "value": "09f009209998db51a573cfd76ef9bd0837451aca", "object_relation": "sha1", "Tag": [ { "name": "jpeg", "colour": "#E03B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698118, "uuid": "9ad6610e-7063-4631-81b6-22283c0d4c65", "comment": "Malware payload", "value": "ed2bed27958eecdf8ba8687c964aed51ef8a07f5434025a758fec53514b8bc4172cb5aa3b1b3f4b8361b63bef32e1e21", "object_relation": "sha3-384", "Tag": [ { "name": "jpeg", "colour": "#E03B4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698118, "uuid": "dc6538ca-f7d9-4ed4-b417-15cca2671c2b", "value": "T13572CF63842FD321D41302F96A97CB5FFF4A261DB10C1BC72798581FEDA0D91A58AA0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698118, "uuid": "c4b6b6ef-b0ac-4f90-b82b-9237a35a65b4", "value": "384:UVp3QZNDkID/2cdQh84EYWNo45IhQF/WlXEWunHT:UbQZVPDMCer4CxXzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652698118, "uuid": "9afc11b9-f6af-4f19-ba21-13f6f60829b8", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652698118, "uuid": "9148ef89-6b2b-42db-9666-6207da44a52a", "value": "image/jpeg", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698118, "uuid": "58f5e6d9-549e-428e-a72f-fa69134fad39", "value": "thumbnail.jpeg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a2a120-d53f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652722801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722801, "uuid": "0685c4f7-c65f-4213-a081-1515906f7549", "comment": "Malware payload (Heodo)", "value": "92be3a723b950aa85509e8b6e76fcb20", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722801, "uuid": "be2401bc-73c9-4641-be5d-899219a83d72", "comment": "Malware payload (Heodo)", "value": "4bbd1755eae9d5a46edf2143e4439736eaba64c36c7bfd63f9944813abe9dd5d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722801, "uuid": "56448c61-b099-4a3b-8e5a-4e70ea418325", "comment": "Malware payload (Heodo)", "value": "09b5702e5f04ec74ce1f54dfce274aa672942d3e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722801, "uuid": "28a23547-3832-465a-b752-6af7091cd5b2", "comment": "Malware payload (Heodo)", "value": "b8ab45e89adc1be0650adbe8eb409a2949404d84f97e1579a4e28a3d0cb28f237ab24e7bd1ecb3ccd5da64b34a25a814", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722801, "uuid": "5cdce8f7-6534-486c-8045-348e30c2786a", "value": "T19D84C04573A48079EDB79338CC574A47E376B86907B0678F1364436AAF3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722801, "uuid": "29e22093-b5bd-4e89-8302-c49bfc29a1a7", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722801, "uuid": "e9fd12ea-7f2d-42e6-bbca-324c84115ceb", "value": "6144:EbmRW/X22TR72tKbxGeAkesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/ApRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652722801, "uuid": "25b5b205-46dc-4836-bd4f-48ca96cd7e54", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652722801, "uuid": "bf384f05-3cbd-42b3-a468-3af2c2eb362b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722801, "uuid": "c85b38fa-f553-433d-9cab-7161a641637e", "value": "92be3a723b950aa85509e8b6e76fcb20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44498c84-d51d-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652708221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708221, "uuid": "b456768e-b16d-401b-8e73-9363fa46baa6", "comment": "Malware payload (RedLineStealer)", "value": "46ec617afcb7031e6e8dc755fc0debcf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708221, "uuid": "24cdde7e-d849-48a2-9124-0b451e40ebc2", "comment": "Malware payload (RedLineStealer)", "value": "4bdc48e114978c475a2497736efb4fa1afd76839ab21e19e3138ee47af7106f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708221, "uuid": "2b297110-ea9b-4ae1-9890-91f068ac405b", "comment": "Malware payload (RedLineStealer)", "value": "9d66505a147ab4bb9a5382856cea201f75190c50", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708221, "uuid": "ad44447b-4594-4cbc-820e-013edb45eb45", "comment": "Malware payload (RedLineStealer)", "value": "2cd109bd9d68daed12c4233cbf553026b41fa97f73160f7adfb43b7f249f314ab2ab5068336548445687b14d9dcf5742", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708221, "uuid": "c3cdf76e-d0d2-41d8-bea5-d021ff85d310", "value": "T1CB94F111F7A0C434D3522E348924DBB18B3FB9611670942BE790676E0FB3BB1A67536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708221, "uuid": "21f304ba-bba2-49aa-9d85-d103becbd2d9", "value": "1aa8a0bb9714464b5f28dfcf2c93afb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708221, "uuid": "e032343d-de42-459f-a489-1e237b983436", "value": "12288:8GoDpAE0HSoDLB1RlXWPiIqrePG/t8hAN:8G9E0HSoXTgiFCS2hAN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652708221, "uuid": "be1e80ac-f4cd-47c9-b29c-4d2181a1030c", "value": 409600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652708221, "uuid": "2f7ee84f-695a-4550-b327-8ddc72b5370d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708221, "uuid": "66628285-d418-4dfb-ac5c-501a1cc7f9fd", "value": "46ec617afcb7031e6e8dc755fc0debcf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0741545a-d512-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652703394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703394, "uuid": "73046eee-6cec-435f-a3d7-a0bb0736a98c", "comment": "Malware payload (AgentTesla)", "value": "a974ac10c4532ea9b5537cc6490a21c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703394, "uuid": "5be91a5b-0d59-4826-b6ad-45937f49f5e9", "comment": "Malware payload (AgentTesla)", "value": "4c0e3c61c593592192edb4dff9e795a342e50e397654e3e5de3628b2ba8d294c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703394, "uuid": "86529c9f-cad3-4d2a-bc59-4192eb1cce0c", "comment": "Malware payload (AgentTesla)", "value": "2044c344521419b582acfd255e9d288335b2d282", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703394, "uuid": "bfa30ec4-36c1-4d1b-a5b6-64b0efa45c79", "comment": "Malware payload (AgentTesla)", "value": "18704a12e9bd8619af0c1ec05ef018bf8bc48e1f18d7151a1d9e94c52e4d1558c21c184767fcafabc2d488cd37bc7053", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703394, "uuid": "56f4455f-1f64-4380-b772-cffc7dabffda", "value": "T1B224124C32D96078F25CAF7715F1022AB154FDF3CB7A907A2C4EBA2969317C07E06A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703394, "uuid": "1ca8aefa-4273-430f-bfce-59e7e9411c8e", "value": "6144:5FbFIcXgaOS7wxf2+yx2gr+/rtzGz9QAl:3b6UgaMxeCHc++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703394, "uuid": "777d5c49-f2da-4604-a0a7-fe02e4ea9607", "value": 229080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703394, "uuid": "f797afab-c9e3-4077-bf95-494dd4837618", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703394, "uuid": "f701402b-1472-4006-836a-7f25f47fe3cd", "value": "catalog_b_design_order_16052022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f29b60c1-d4de-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652681455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652681455, "uuid": "d84208ee-67f0-4481-a1ab-dce8591b893a", "comment": "Malware payload (Formbook)", "value": "55ecd48ffdf4e580e1b897163f1473ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652681455, "uuid": "8e164a6e-a3da-4871-9502-faf431b4e8c1", "comment": "Malware payload (Formbook)", "value": "4c2507937c1200a3bcb04401ec42295d72d7af0d6b1d075c60087390cbab046b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652681455, "uuid": "78a88d8b-1ee8-422e-9212-58b4d1653fc9", "comment": "Malware payload (Formbook)", "value": "61aa9bea696644cfa3e153ff80b45893a79a21af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652681455, "uuid": "6699e0b9-5b1d-4013-b9af-df150a1ea3bb", "comment": "Malware payload (Formbook)", "value": "181d70d2c0413936e5e014f9fb295f91a3f722e76e8cf23bb83b1b9db4e87eb9f912082ab517ef8137e23bd0913be8e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652681455, "uuid": "00f006a7-e66d-45aa-9505-3edfad0890ad", "value": "T143B41200B6EC433AF43C03B55376482945B5FD16DA65F23D1EE6A0E42DB1F468E88EC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652681455, "uuid": "e5c800ee-6ab0-44aa-8759-8f7dd92b057b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652681455, "uuid": "51bdd2a3-10fc-4880-8794-c3faa391f36d", "value": "12288:Zlx33u91GaUo+jELidv3zTpYcC5b3X/DoSG1CwPw+yb3S:Zlx33o131+jDbTAzroJ1Jrm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652681455, "uuid": "b878b197-d960-4e06-b785-33300e33d69f", "value": 522752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652681455, "uuid": "927bb534-52a4-4998-ad82-c2df88f63025", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652681455, "uuid": "3e760df8-cdfd-4ca6-a640-187ca17dfca6", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ceba845-d56a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652741307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652741307, "uuid": "eaa49f76-85ca-44e5-b8f8-f46cd574c45f", "comment": "Malware payload", "value": "2a1b9e7275501500c491945a673055b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652741307, "uuid": "332d91af-53e5-4768-93a4-11009fc6a36e", "comment": "Malware payload", "value": "4c7aff9ae4f265a56b8a7ce9457eae03b15cd5b67fc8c401026e714c5806ccd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652741307, "uuid": "ad2cfffa-da62-4b73-8ffa-720cb0532da3", "comment": "Malware payload", "value": "9725739430fc3088eb85d140a679ba29ae0f7b7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652741307, "uuid": "a8c52324-8246-4ef6-86c3-ac2e0a690299", "comment": "Malware payload", "value": "d7f1a62cfd83123910dedc6ee8edd31a5367fb35715653d887aceb65aaf4593392a4f20b6678ac70db15ff29a651c725", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652741307, "uuid": "ba02130f-4b92-43bd-b1a1-66aa2f4c3aeb", "value": "T1D084C04573A48079EDB79338CC574A47E376B86907B0678F1364436AAF3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652741307, "uuid": "6f07f896-e845-42dd-8b60-7b954e35cd92", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652741307, "uuid": "8cc78cb2-569e-4b52-987f-f2fddaa90cc4", "value": "6144:EbmRW/X22TR72tKbxGe4kesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/4pRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652741307, "uuid": "f8b3a159-a0eb-44b0-bbd6-714f56b61120", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652741307, "uuid": "d5a5623f-71c5-4908-90b5-069ee3a48cbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652741307, "uuid": "6866e5ae-c3f6-4643-bc85-bda325a89fba", "value": "2a1b9e7275501500c491945a673055b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07b1347a-d4ee-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652687933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687933, "uuid": "578caea4-20b4-4f07-89b5-784249b60b73", "comment": "Malware payload (RedLineStealer)", "value": "d1146db4e2cb7230c2b7a597534ba6e3", "object_relation": "md5", "Tag": [ { "name": "176-10-119-117", "colour": "#051CED", "exportable": true, "hide_tag": false }, { "name": "pixelmon-pw", "colour": "#765B0E", "exportable": true, "hide_tag": false }, { "name": "pixelmon_pw", "colour": "#378CF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687933, "uuid": "eb6a015f-79cd-495f-9675-56ad057ee991", "comment": "Malware payload (RedLineStealer)", "value": "4cebf7ce12d43491ddc36051063ca3ec4bc1b89bf146036ca4b6ddf33bc61955", "object_relation": "sha256", "Tag": [ { "name": "176-10-119-117", "colour": "#051CED", "exportable": true, "hide_tag": false }, { "name": "pixelmon-pw", "colour": "#765B0E", "exportable": true, "hide_tag": false }, { "name": "pixelmon_pw", "colour": "#378CF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687933, "uuid": "404209bc-3fd0-4d25-91aa-03f410d6401f", "comment": "Malware payload (RedLineStealer)", "value": "986ff87708d8c17ca9ff2790697e33df39a03a2d", "object_relation": "sha1", "Tag": [ { "name": "176-10-119-117", "colour": "#051CED", "exportable": true, "hide_tag": false }, { "name": "pixelmon-pw", "colour": "#765B0E", "exportable": true, "hide_tag": false }, { "name": "pixelmon_pw", "colour": "#378CF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687933, "uuid": "02584441-3b9c-4679-9aec-a45be49ab2cc", "comment": "Malware payload (RedLineStealer)", "value": "ac54e283ad957e5e7f78c816c80a73d4f967885bd62cbc7c3425678f96405ca5fe0481095b0a080e3f2db9ce58c95e2f", "object_relation": "sha3-384", "Tag": [ { "name": "176-10-119-117", "colour": "#051CED", "exportable": true, "hide_tag": false }, { "name": "pixelmon-pw", "colour": "#765B0E", "exportable": true, "hide_tag": false }, { "name": "pixelmon_pw", "colour": "#378CF8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687933, "uuid": "5c4abf7d-f174-4087-95ed-9302e6d0adb9", "value": "T13A46335394A10F91D858047D80CB5F8A27A9AB1F444AD35F6776E62F3FF23B8DC24886", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687933, "uuid": "2f63e205-c7b6-4305-b216-a0ed54099c52", "value": "98304:ZTh2a6xMSlcLeGEg4mb+9YArUxu69TdpcmP+LoJhCXLkfsV9B9uoLeOSrttDFKLo:Rh2a6YCGE/ehD+68QgbDV9T9LeHPFKjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652687933, "uuid": "651b3830-4181-468c-ac39-556318c9265f", "value": 5518877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652687933, "uuid": "474df08c-1db3-4471-9d14-dc51f4836819", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687933, "uuid": "cd3a54f4-8dda-4fe6-80dd-11b8234693ba", "value": "Installer.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c02fb2ea-d4db-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652680082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680082, "uuid": "002ecac1-b67c-45f9-b508-e2792ae71dc4", "comment": "Malware payload (AgentTesla)", "value": "c52b7fc17e6bd0cf7f5d90eca2c9855a", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680082, "uuid": "ec3a0d06-2ec8-4e7d-b3aa-04ba6fc8b07a", "comment": "Malware payload (AgentTesla)", "value": "4d62b57274c69a321751eec28dcef6aa35abf5bcbb9c8877bf8dda7ddeb37b14", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680082, "uuid": "e8c77454-6c98-4675-82e0-4bdec0f0745a", "comment": "Malware payload (AgentTesla)", "value": "6ab255f3bddc394413843290827abf4dab1a9dc5", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680082, "uuid": "405f4aae-fcfe-4eb5-bc4f-288fe933da6a", "comment": "Malware payload (AgentTesla)", "value": "9d19c24fea8bc030aeaf065d2f4187ef2e9f7c1c0befe36d06f15dbf26794b9eecf1dedfe1251f776939e91670ffac49", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680082, "uuid": "d501e68a-7a70-4471-a319-8e09cfdf49a5", "value": "T131A423130AEE4012F43C21AB2FE6C09EC6C21793155F6A24A5E71BD79F0FE7A74E4261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680082, "uuid": "f6e2a9fa-6226-46af-bbeb-7ba60496e90b", "value": "12288:dMkW3n92PcqMgHy5bHuw0p721uvlHtRwtraYyRvQomlAu/V:dMkWt2hMgHoHuLlGtf4vQom/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652680082, "uuid": "577533d5-007f-46ec-a1bd-bdc1f106ff3b", "value": 460500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652680082, "uuid": "c5b4fbda-f15f-4774-8a24-7d9646682f2d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680082, "uuid": "ff341857-fb37-4fd5-be9e-8d84604d89d5", "value": "Shiping Document.eml.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae570a4-d519-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652706568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706568, "uuid": "39a10da2-e392-4a8f-b635-9a13b2f5588e", "comment": "Malware payload (Formbook)", "value": "9c57cf589c6ff051d2aec2bbaf515dfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706568, "uuid": "446edbf8-13af-467c-9395-8edf5747831f", "comment": "Malware payload (Formbook)", "value": "4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706568, "uuid": "351040a8-eb74-4cd5-badb-011c1c527928", "comment": "Malware payload (Formbook)", "value": "846b8e1244b7a7e2cbddbd837c77708b6bb0bb32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706568, "uuid": "fecc640c-14cd-493e-b226-b8b891d47b40", "comment": "Malware payload (Formbook)", "value": "0b93cd3b9793aaecc9faa8c47741c9b0a04cd15b3077b7883f1883e0bebc63ad32c6f2ecf4a887f26ea6e0e43c199606", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706568, "uuid": "4e63fb14-a821-4376-8826-32235cd73c0d", "value": "T16735CF20B3499F21E1ED3736E786250623B685D31E66D64D7A4E37C289B23436D2B34F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706568, "uuid": "f0b9b4b9-f1de-41b2-9cea-0200c5072c31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706568, "uuid": "3d62372c-95fc-4ae8-99fa-080f303976d1", "value": "24576:f4m9xolh58dZhM32ufDQ/0bMfe1NJH3H2XocqO4xKPXrCBt2epQNvho:f4m9xolh58dZhM32ufDQ/0bMfe1NJX2W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652706568, "uuid": "37e81345-2587-4f2f-a01b-cba18425d6c4", "value": 1084416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652706568, "uuid": "ef97d87f-b3cd-4400-afe1-458bb0d64a0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706568, "uuid": "3eec472f-6492-40ac-83ef-b1cd6d82188a", "value": "9c57cf589c6ff051d2aec2bbaf515dfb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eaa7db1-d4f3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652690334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690334, "uuid": "15c63893-a32a-4e25-b203-5992a90ea30d", "comment": "Malware payload (Heodo)", "value": "af442618375228b6573eaeae59b43706", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690334, "uuid": "10795dc5-c49f-4aa4-a99a-98d5650df954", "comment": "Malware payload (Heodo)", "value": "4dbe82b8f7508fe0628073658dfb38b9f988d49cff2739213c390d1bc178ada1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690334, "uuid": "1841e6aa-ed02-46fe-b003-0d0c55ac74c9", "comment": "Malware payload (Heodo)", "value": "900966e8e9297ac4cdbc257f307dc37046ad9a22", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690334, "uuid": "0fbb1539-780a-483a-9dca-80c01b5df0e9", "comment": "Malware payload (Heodo)", "value": "e9ed0b896ee2205440c8c61ee7ade0eb7fc28615a5050b6aaa0b91b69304eedcdf7bf22e06bb171fc84e5bda0aaf3332", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690334, "uuid": "baaeedde-40ce-4fff-9e87-c0647a8ab0b1", "value": "T181055A35FB6C8492C6A3953D88A34B06EE6AFE840B6183CB1290733E9E777D45C35671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690334, "uuid": "e8f9be48-ba48-48d8-9033-b807fc85ec78", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690334, "uuid": "840c822f-a2e8-4759-b116-e30cfb5597dc", "value": "12288:Q9983xaoz0/7aG8GkZHFT1YicDAXmvQaZsbNg:A9UkozAWGxGx16AWvVZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652690334, "uuid": "d6d08fbe-1ff9-4ec4-b0fc-17580c81cc17", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652690334, "uuid": "b3eb4d22-21fd-4f03-8d7d-ef5c7f9c2c86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690334, "uuid": "72cb38c0-52eb-4b1a-b997-f6652289a983", "value": "af442618375228b6573eaeae59b43706", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1a8b571-d52f-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1652716163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716163, "uuid": "2493cd9c-4aad-4aa7-9b3e-68fe1679fd96", "comment": "Malware payload (SilentBuilder)", "value": "6da8d4cafab4bb9eef4a53df19442807", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716163, "uuid": "5c2208c7-a366-48c4-bb9c-914e8c822ddd", "comment": "Malware payload (SilentBuilder)", "value": "4e03c41a857039e440a9fe9f5f0ae1c8a3fc8a032fd14fd5cf4e0a5e962e1193", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716163, "uuid": "892ed436-abbb-4467-b4ff-03419bb38686", "comment": "Malware payload (SilentBuilder)", "value": "5dc9c8cc3ddb307d4888a329d55b3abfd4c8fc27", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716163, "uuid": "4682fdba-5bcc-440f-8f9e-17044220f07b", "comment": "Malware payload (SilentBuilder)", "value": "89ef03c41f8500463c6152f7017611aa8903dd6b16817cab41118ee83dbac69fb87cb6d5cf3407d1a281b505c7f5d839", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716163, "uuid": "34551f8d-ee19-4004-bbe8-fad59f72bafc", "value": "T193734A4AB98AC96CE615C739499743A9B313FC114FAB078B3109F3727FF49A05A0761B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716163, "uuid": "53f8ddb3-6e83-4ee5-a3b6-eb1eed146f1b", "value": "1536:tpKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg5AezwrMCtvJecvRtbTNFo:zKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652716163, "uuid": "575156dc-64b2-49f6-9543-73bd53f6f47c", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652716163, "uuid": "1c14162a-15c0-4ebf-999d-c4f107e7e34f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716163, "uuid": "88a7bedc-620c-4c2e-893c-b0b8f9abd8af", "value": "44 8.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "876fbcce-d521-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652710052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710052, "uuid": "a877116a-a357-4039-9a84-1c7e3ef49e2f", "comment": "Malware payload", "value": "eebe5785b6dd0f74da38463c6687f542", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710052, "uuid": "d986885a-3137-4522-944d-7c2bc863faa0", "comment": "Malware payload", "value": "4e4e7000c1111b0c86914679fa90a39ec3b068708d70c9e20c93a58d2dab58b3", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710052, "uuid": "ba9629cd-a373-499d-ae88-a0c5459e82bc", "comment": "Malware payload", "value": "16470e93576f15accf642c9c12b2ea1b9ac17b91", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710052, "uuid": "fe7b1043-35a3-4e63-b71e-ee6d1806041d", "comment": "Malware payload", "value": "11612df72db9db6c8f5aabeccdb1aa9715ef305bcdb8c831ab5e5198d1253905529192bf45d3f9deea4040604e23c492", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652710052, "uuid": "fc2df0cf-b28b-49d3-b828-55d8b5e2fac1", "value": "T1B8C49B1365A64F90CC6E057E90EB9F42379CBB4A1106DB6B03A5E36F3FF63B59829401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652710052, "uuid": "e7a0de65-bb0a-4b9f-abc5-de63402ebcb1", "value": "6144:OkQ8Gcelcr9NVcdjp07qTgaBo00z4OZP8xKm3:Q89ew9NVc+ugmo/MOZPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652710052, "uuid": "a5ee67e1-910a-45e8-9eed-abcab04a4a8d", "value": 556988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652710052, "uuid": "fa4794a3-add9-439c-b91b-2175a21d60c9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652710052, "uuid": "4badcf43-2530-4ff5-9817-d1bc722fc3ee", "value": "Important shipping information required by DHL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f486bccf-d56c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652742447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652742447, "uuid": "e1d87683-7df9-414f-ad3e-286dfc950ba5", "comment": "Malware payload", "value": "22e2eb60ba4b4c36b056cb48f3f1843a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652742447, "uuid": "212be386-14a7-4760-aa4a-1ca0d248a838", "comment": "Malware payload", "value": "4ec96a09ac30d88f525b2de25d8c0135491c4175cd0ca95d82afac9534df4e96", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652742447, "uuid": "d5f7bde0-9895-438f-afba-aa929c262f0b", "comment": "Malware payload", "value": "2d598f4a4a5060174717565ec87da17f391b245e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652742447, "uuid": "f1ccd113-9ef5-4c69-a304-655b1eeeb3b8", "comment": "Malware payload", "value": "bbf311816aef75c22e59ee1493b078abbc1efcecf90f32ed8111a7b599fc9f7f9df2e0d013d7e018dd6b9e3050079501", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652742447, "uuid": "ff1a6ecc-e2da-4174-9d03-6ae71ac1f6e2", "value": "T16F841827E560A41DFA078471D869A6B6182E2C7224C99D07FBC1BF5A34766D3BCF430B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652742447, "uuid": "6d0ce655-cb44-489f-af0c-c2352f378def", "value": "5bf79ee07d6deeaabedee0b793ebe960", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652742447, "uuid": "2a6a27fa-6885-42d7-a256-21958fa3af58", "value": "6144:uXh1Ss8E4FZgxmpYhjUr208lYAUnHtnawjT:a8gxv1i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652742447, "uuid": "fe42389e-4dc6-4943-a30b-f5166d8a63ea", "value": 373736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652742447, "uuid": "f4a69af0-281b-4a7e-a070-00f3bf77e968", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652742447, "uuid": "a7a21bec-39b8-45e5-8691-ed348c826bc2", "value": "22e2eb60ba4b4c36b056cb48f3f1843a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8359454-d52f-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1652716174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716174, "uuid": "1cdb4866-89cc-4250-b5b5-25f934ff4587", "comment": "Malware payload (SilentBuilder)", "value": "0eabac58e2022082f5095108238a693f", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716174, "uuid": "dc47bdd4-0737-4e65-a5ee-20ddef2a1d23", "comment": "Malware payload (SilentBuilder)", "value": "4ecbfefb6fefc5f75687ac958df6b9a3c122153637658589124a802ceddd628b", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716174, "uuid": "c0ebf0e4-67c6-458b-81e6-90bc532a71b4", "comment": "Malware payload (SilentBuilder)", "value": "f1aea25f68b5d6f4b58d8b9b5af596be6468a4a5", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716174, "uuid": "93b59b52-2a02-45c6-8d7f-9a48ecb95cc0", "comment": "Malware payload (SilentBuilder)", "value": "ad511459ed2dfc92388d77fc3cb17eddc0d78551f7455fcde23fe1805c1960f992f72577337f96f2683a934834441484", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716174, "uuid": "14d75cc0-57d4-4c04-9e71-2232ebbae2ca", "value": "T1E8734A4AB98AC96CE615C739499743A9B313FC114FAB078B3109F3727FF49A05A0761B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716174, "uuid": "94195156-904e-40d0-9e73-53c603181151", "value": "1536:tpKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg5AezwrMCtvJecvRtbTNF8:zKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652716174, "uuid": "fa0eb7c5-fe36-4e4a-9741-b80854dd226d", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652716174, "uuid": "dc63d411-c43b-4317-941c-3f4d4af73ef5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716174, "uuid": "05c1ee49-ad78-4145-bf7a-d8c6b461c93c", "value": "dettagli-1794998.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42633e95-d4ee-11ec-8e58-42010a9c0032", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1652688032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688032, "uuid": "c7a2231e-b303-413e-923a-67cd93518613", "comment": "Malware payload (ArkeiStealer)", "value": "b70b30d15ab6d806f2d4eee9ae40e275", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pixelmon-pw", "colour": "#765B0E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688032, "uuid": "47055acb-8041-4244-9300-e53077623172", "comment": "Malware payload (ArkeiStealer)", "value": "4f1a14769b149677a39c1d1074ca1c17fa38324a578c5125c2470a6603273f2c", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pixelmon-pw", "colour": "#765B0E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688032, "uuid": "b52ddb49-e4b8-4b41-81e4-11813b3c15e8", "comment": "Malware payload (ArkeiStealer)", "value": "dd26d51e8c5345452f49593e0067f0cffa29e690", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pixelmon-pw", "colour": "#765B0E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688032, "uuid": "cae02608-f094-46c0-9712-58b003900757", "comment": "Malware payload (ArkeiStealer)", "value": "3bc28be17f8df4747919164489be43893399c4b3b4c3727dfc80bae469c2ec2523deecabcba3f64996bd4a919004bd6a", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pixelmon-pw", "colour": "#765B0E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688032, "uuid": "f36d1a1e-f36c-4802-bd69-704c61d4325a", "value": "T17FD5D0BF9745D80EDB433075859F92A25002B672690FB5935B847AA9D32F0CDFF22B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688032, "uuid": "494ab752-41cd-44bc-833a-4b5231d9ceae", "value": "37a87ba4c777dcd1db50684f6b029f1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688032, "uuid": "0054a5f0-2efb-46d1-9b75-ac3b9084b4c7", "value": "49152:I23v7D5ofu4b0ygR/ZnEQghbFBPzah3+tAzTV/Z2WBazQmlTch7vSPzHAHavfg0:I23v7DOfBZgR/ZnEQghPz83+tAfV/Z2P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652688032, "uuid": "a44fa7bd-f794-4ed8-a4aa-3934de58539c", "value": 2795960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652688032, "uuid": "8f4e34ed-6737-4b8a-a1df-9ae8ddfc606a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688032, "uuid": "2d175551-1fd1-4a72-8ffc-4542782885ba", "value": "4f1a14769b149677a39c1d1074ca1c17fa38324a578c5125c2470a6603273f2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e258d05-d542-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652724022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652724022, "uuid": "a8566397-9a33-4359-b920-263241a43c89", "comment": "Malware payload", "value": "f11a9589faed04ff9c880a8e590ec76a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652724022, "uuid": "713e7c68-e2f0-463b-895a-3cf2cb6bb557", "comment": "Malware payload", "value": "4f33680b816650d32dc9f43cf4e152cafef8e73621747df8c73f0d2bcecf5c63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652724022, "uuid": "befb6483-6f83-4f91-8a3e-81126fd48637", "comment": "Malware payload", "value": "4be9dccb645efe603ca3621098aa73080fce8378", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652724022, "uuid": "7fc1603e-0601-48ca-967e-170c0d1ea159", "comment": "Malware payload", "value": "340899f176d9cd4ff757361acfc1eabb4f3c2d4354df83abfd358447c1a67ff157f29933f61b04cff12fb4113fe22e1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652724022, "uuid": "6d908c2e-b8f9-46f5-9726-17705e7e1508", "value": "T15984C04573A48079EDB79338CC574A47E376B86907B0678F1364436A9F3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652724022, "uuid": "e3a4e96f-05c7-4890-a474-1c66da9b712c", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652724022, "uuid": "70af12ab-6562-4840-82aa-3fe6c9820dac", "value": "6144:EbmRW/X22TR72tKbxGeKkesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/KpRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652724022, "uuid": "650bca01-c04e-4cd0-a040-18ada2b1c3c3", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652724022, "uuid": "3e05b79f-0ae5-4d1c-a8a2-eee303a997fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652724022, "uuid": "6b9a04db-0899-4b19-bfe5-62cefe700e9d", "value": "Jc90tB6QhU.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d1c764-d4db-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652680036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680036, "uuid": "6dd215a3-f030-45b6-b269-af9f3d83a6e8", "comment": "Malware payload (Loki)", "value": "0a7d9ccdc25245256b6a9e89c95d4d3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680036, "uuid": "1100fa20-f18f-414c-863a-e7f31a42ba40", "comment": "Malware payload (Loki)", "value": "4f9792ea5b76f74a616ce795d00eaacf1a053567b42b5d400b6c082a6208a297", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680036, "uuid": "ff406f3b-8ef0-4430-a4b2-aac7c251b136", "comment": "Malware payload (Loki)", "value": "5378b4a5ff2bd6a5c0422b6d65cfa990f3b507ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680036, "uuid": "a18820c3-0207-4236-b050-a9ec7d5df16d", "comment": "Malware payload (Loki)", "value": "9181feccb98b542d03252e4bd3ddbb24ab6f13421f98f0f0af29efa2b6a7819fd037cf68d0492dcd32b9721e994f65d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680036, "uuid": "94054396-f720-4c0b-9070-90e90faa539c", "value": "T1DF94124863DC4726E6BD16B9EB37081107B6B0096912EB6D3DDB60AF1C73F494F40A7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680036, "uuid": "29f23ed8-a8dd-4497-b58a-85db21906efa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680036, "uuid": "aef3cc40-45d3-4270-8d98-eb5faf8fe171", "value": "12288:zcdHgHhgB+w8bb/dYzHl8MCRE9OudMKlg:z0MgBz8XyH6M7Oo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652680036, "uuid": "9fd39a9f-1b55-48eb-9437-819d117c7e21", "value": 439296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652680036, "uuid": "24ae1f62-5928-4617-b951-1a7e48c89ecc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680036, "uuid": "c0566d63-4897-4cbf-bd1a-a8b5014688ca", "value": "DHL Receipt_AWB811470484778.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0529546c-d53e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652722289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722289, "uuid": "96b9ce84-3edf-4506-80aa-0f58a5b062d1", "comment": "Malware payload (Heodo)", "value": "755e0e2efba10846b8ea8a45025779d4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722289, "uuid": "236f434e-bb07-466a-8c2c-efc37fd8e8ec", "comment": "Malware payload (Heodo)", "value": "4fd401a13bb88315e07f39f426456c27ae9c094e2c6dca0684749f96e29b0ae0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722289, "uuid": "3f1b4ba3-2828-4986-a802-02669af6c80c", "comment": "Malware payload (Heodo)", "value": "7fb0590f7b713accf5c54dd6c24e2e79a118c5d6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722289, "uuid": "0679bcf7-f821-419a-92f5-b25502282b48", "comment": "Malware payload (Heodo)", "value": "dc4a0804d237a91c9eccb22d21815797c4d10b9acf5a461d03bad34f9ce14561d5f932273adf93c16ebb0bf717fc2c81", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722289, "uuid": "e0d6eb8d-9285-41b1-bac6-7eee06e8b190", "value": "T18284C04573A48079EDB79338CC574A47E376B86907B0678F1364436A9F3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722289, "uuid": "47092783-d7c5-4710-9cbc-7c92dac8cf59", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722289, "uuid": "e71810f5-cf8d-47bc-baa2-99970548a1b1", "value": "6144:EbmRW/X22TR72tKbxGemkesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/mpRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652722289, "uuid": "d829945d-fc75-411e-814c-d7278708cea3", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652722289, "uuid": "8b8155b4-253c-42b9-ac23-cf4af2a38460", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722289, "uuid": "c49348e2-6937-458b-be09-a0f49ac0bf1f", "value": "755e0e2efba10846b8ea8a45025779d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "979e41fe-d4db-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652680014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680014, "uuid": "3ea43c30-2950-45e2-97e2-5959c7c52005", "comment": "Malware payload (Loki)", "value": "b73712e28d6ea6b338638e5ea7233b4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680014, "uuid": "ee5388f5-428d-4d95-a14b-132acfc1362c", "comment": "Malware payload (Loki)", "value": "4fed851fee3f42d43e2da8c061b44615be2827eebe74e7c891e94fe517ded5eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680014, "uuid": "2426e8be-b9a5-4639-bf3c-9528c4cb93a1", "comment": "Malware payload (Loki)", "value": "86b90124907369daf212aa6e2cad79d1131860cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680014, "uuid": "66427e8c-b0d7-4f56-981d-61d75c3f77f7", "comment": "Malware payload (Loki)", "value": "1828151a8523730f20d9eb5e900909ba49c4b365a2f1f3363375464702bab374c69e9e119e8db50cb47281e0eec2c1ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680014, "uuid": "41e24341-ba9f-4def-a233-a809fde43b25", "value": "T1CAA4120073AC1A27E1BF6276753B146806B7B8225877E72C4DC5E0F23DB3F0A4E85A56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680014, "uuid": "5bcef07a-2de8-4268-821b-d95416acfafc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680014, "uuid": "ed3f9b87-1689-451c-a533-95d6bf85b642", "value": "6144:hQIT55F7WkIXnkfd71Y1RJWxxbWJ7mRsCSABPjtNq7NAIY6OJzpRbKEQhdSjqYza:JF76UDxbWJ7mpRPjSK6OJNRWZQfz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652680014, "uuid": "679d08eb-04f1-4d41-bc4a-77c0d1d980c4", "value": 449024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652680014, "uuid": "ceb549b8-ede1-4de5-8c6c-45332137743a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680014, "uuid": "2771a36f-104c-4f11-9359-975887c2e9b6", "value": "Purchase Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c8b0ccd-d50d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652701256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701256, "uuid": "87ca975e-3590-4888-94de-829a2e968421", "comment": "Malware payload (Loki)", "value": "2b782d8bdc0487882a3294e343acd511", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701256, "uuid": "039db84c-819f-41cf-a0bf-39d53fd2d4ef", "comment": "Malware payload (Loki)", "value": "504cd80cc305c3f7bb57d8ea839779e554daaf03f8c108898b8e7a4c300c4494", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701256, "uuid": "d2e93bb1-c20c-4d79-ab00-36b6c9816703", "comment": "Malware payload (Loki)", "value": "8f5613c034f370974bdd26c0f7f86ff94b00555f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701256, "uuid": "058a135a-cd1d-436d-8404-8938e4257689", "comment": "Malware payload (Loki)", "value": "edd86e6aafd7b9a59f218e70561c7ea35708243f5e5681aa4c393679fd3de5287dc27aef0a87c845fa6a1703fb952a8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652701256, "uuid": "d87c1028-50fb-46ef-894e-c7c32f5469c6", "value": "T14595C60E12D54F51C8608E76DAF31F5EDF53DB6ADC51234AF2863729942A3BB0A007B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652701256, "uuid": "bfb35c5a-c11a-499b-835f-00e84a004727", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652701256, "uuid": "27a5bf1e-1952-4e5a-885e-ca584766190a", "value": "12288:+aaqs3xGa0u042GAJQkWJ+gDY/fan6eFQ8ZO1bGPcQtIh+O5IWDwmfIxt9f5nw:+rqel04rYU10/VDG+W5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652701256, "uuid": "6f3e8da2-2129-48a2-8ab0-e7009bbbef6d", "value": 1886208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652701256, "uuid": "80d9cda1-3b16-48d2-8f1b-5ce749eba527", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652701256, "uuid": "c6eabbc0-9bfd-454f-b6b3-9800232da5eb", "value": "2b782d8bdc0487882a3294e343acd511.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47da5c69-d53f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652722830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722830, "uuid": "6a4a7304-aa38-483b-b285-e4c4a4ad0095", "comment": "Malware payload (Heodo)", "value": "d80b542c25bf0a539ff6459ef0913bc5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722830, "uuid": "3c06317a-4560-425e-9e9c-bfaf965b1d97", "comment": "Malware payload (Heodo)", "value": "517b34aa4d52727a900daf2674ded15af7ff6ebb234c9867ddacff05a611e712", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722830, "uuid": "738634d0-0c0c-4346-bff7-6c8a69d9a01f", "comment": "Malware payload (Heodo)", "value": "342aa84319297ad21ed9b35a8e3fee6661097947", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722830, "uuid": "1f03dd51-45b6-4711-9ea1-704b6a73f62a", "comment": "Malware payload (Heodo)", "value": "b491de0b0be4e21c76958ae53f939c52e63261cf700a2139e3049b723bcb87f0dbd09a0f1c0177ec0a0863aca1494351", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722830, "uuid": "327ba9e5-a4dc-42d9-aba9-7cb7b07f6f98", "value": "T18774C046B3A840BAED678338CC535647E772B45A4B70A78F13244379EF2F3915A3A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722830, "uuid": "befffd05-3b76-4444-81c0-8a3d8b5f9365", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722830, "uuid": "338202db-f46f-4191-a6b6-4542c9e428e4", "value": "6144:Es/2WX22TR72tKbxGe5kr2rlsy+vbEFXYvlx6xJkUjnKd:Es//Gi7/5gDvQFXTH9Kd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652722830, "uuid": "cad642c8-76bd-4c02-bcd7-4b177579d1cb", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652722830, "uuid": "abd76ed1-3de0-482c-a7f3-defbc095df71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722830, "uuid": "dfc11411-d9cb-4c11-9775-9e117a91db75", "value": "d80b542c25bf0a539ff6459ef0913bc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8747f987-d506-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652698455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698455, "uuid": "237ad064-b381-4ecd-836d-f9d4aa9cc84e", "comment": "Malware payload (Formbook)", "value": "c03837e9203f4f27c43f83a81c2c998c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698455, "uuid": "0f638014-77d8-4ab9-a4b9-35e24b4e35ee", "comment": "Malware payload (Formbook)", "value": "51d589a01ef70d7961a53244a56df4427176375e4001481ecae0c88848fc0fed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698455, "uuid": "e1598603-6b95-420f-9c3f-a7cf4f56d853", "comment": "Malware payload (Formbook)", "value": "a12abfa3e7c3c436a5fd26bbef0659b9fcc2b91f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698455, "uuid": "087af52d-6a78-41bd-82c3-60dcb9cfbace", "comment": "Malware payload (Formbook)", "value": "d76b7018bf6ae5ff4bd89d2a8b2e7ebf62172558019f102a148604355309e62661b2bd099020bc00c390748f7cd735fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698455, "uuid": "90b733ca-d154-421c-b59c-0d378c7b26f4", "value": "T1C7A4F10B2BCA9665C1AD1674DBB8516442F0A38B12B5F7AF5C0162E89F51BCB6B021F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698455, "uuid": "c63086d3-2a76-4df2-a903-cc57f503f284", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698455, "uuid": "64af6efd-7fea-4e52-ba76-a31427c5c6a3", "value": "12288:578LLCgzaucw9VqUQCdYVfXHmyhEQ4Zmdt:5QLLCgtcbUQCdivmyhEUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652698455, "uuid": "c940a25a-215c-4be4-a930-d604ef279f97", "value": 482304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652698455, "uuid": "ce56820a-d25a-4496-9e07-efc1225937c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698455, "uuid": "cd7a8669-a768-4dc7-96a9-a1678685b982", "value": "SK034252562672.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "440015e7-d569-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652740863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652740863, "uuid": "98a1bf96-36f8-4e08-8370-38b3ba781dc4", "comment": "Malware payload", "value": "fde7d5248df7cf85a9d40616b5962e53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652740863, "uuid": "fc25be7d-7cf1-4b14-b6d9-42a024a8ff0b", "comment": "Malware payload", "value": "524f05b6426b8311a942eaa7b0dd79ecf9f51f74b4dbdcd12a970f169e8b0d6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652740863, "uuid": "0ad66009-3dfb-4b14-a76f-fd1aac69842e", "comment": "Malware payload", "value": "569841f68da48a86b03d3b5a85c179371b9fa573", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652740863, "uuid": "7fe9ca9b-7dc6-4531-ad24-69ec7dae029c", "comment": "Malware payload", "value": "be66563bba8dd1c6fbcecd052db5ce89031f47a726d3fbbd96bdd18a2cf1c83ec273405f22fd58afefc0cccf9451bc5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652740863, "uuid": "ca9a5d2c-4e14-4560-80fe-158780f269e6", "value": "T14384C04673A48079EDB79338CC574A47E376B86907B0678F1364436A9F3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652740863, "uuid": "dc8e5d19-7d13-45a9-8855-2fed99a73ac9", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652740863, "uuid": "8f610c12-b397-479e-9e60-8efc2acfa7d1", "value": "6144:EbmRW/X22TR72tKbxGe7kesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/7pRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652740863, "uuid": "7701d8a7-8f19-49cf-bdf5-ed35e0b073ee", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652740863, "uuid": "02c3b901-bd32-4597-afa0-a6a838c24b76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652740863, "uuid": "6a09f919-4752-426d-885e-212ffe28b98b", "value": "fde7d5248df7cf85a9d40616b5962e53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d0bc14d-d519-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652706518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706518, "uuid": "a60338a0-f6e4-4df6-b3e1-404226642917", "comment": "Malware payload (Loki)", "value": "caa3caca6653773d40e7dd6164113bb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706518, "uuid": "7b90790b-6843-45fd-988f-a4925f79ee9f", "comment": "Malware payload (Loki)", "value": "52a539866fa6472c9c5367c5318e2cd9c5acb140701f2ca97d5869ca47b88457", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706518, "uuid": "36eba1b8-c3b5-499b-b0d9-dd486b7026e3", "comment": "Malware payload (Loki)", "value": "bb8ae0c3ea8578147a2fd9ce3b325fb3b273e2f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706518, "uuid": "ca2a74ad-7d76-4308-b8ea-05a8285eab11", "comment": "Malware payload (Loki)", "value": "b1c03674b94b4d8485917b8faebd69578865bbeb730b02e9f864c4085112b477c9cb75441f79b785435eabde4c4f20fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706518, "uuid": "0ad2a0af-e9a1-4059-bd08-11d4660f5427", "value": "T1FB040211E364D46BE4C16B322AFA9B264DFEDD512674751B0B007E5CFC221D18B2FA1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706518, "uuid": "d150b1f6-57b4-4bb9-af41-499d6c4ac378", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706518, "uuid": "7190f91e-e214-4a96-8ee6-b0339cda5f86", "value": "3072:LODZGPEounbZVAoS2o2m9Lc8ones86hJDxAWHuwvGc1BcmsCTRJXXYVQvkpS1itr:LOtIOZVB3m9LaneGJFA4e6c9CFJXnnor", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652706518, "uuid": "3b4ddd7d-dc64-457d-a751-4a0de38732ef", "value": 187281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652706518, "uuid": "a372a275-6c51-454f-af0f-49ee4979668a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706518, "uuid": "e40e28fc-702c-4a27-89e0-f7adaa619f68", "value": "caa3caca6653773d40e7dd6164113bb5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cec90248-d50b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Amadey)", "timestamp": 1652700723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700723, "uuid": "e9a763b9-4d91-4e70-a1d6-f9095d7c9dae", "comment": "Malware payload (Amadey)", "value": "9083ea498dae79a1c3124d7eb231c415", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700723, "uuid": "1ee6a80d-8b7e-478a-8df7-656bf9951353", "comment": "Malware payload (Amadey)", "value": "5342a90e6dd43fb471d9674de99d8cdc048381efff246af9de32f9257cacdcc3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700723, "uuid": "a8989b0d-3095-473b-b24a-7c2beeec39a7", "comment": "Malware payload (Amadey)", "value": "416506992b86749bebdc03e76faf65a82d20c6ff", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700723, "uuid": "ef43d580-c8ea-4479-aff9-951d7a06ba13", "comment": "Malware payload (Amadey)", "value": "b035639c3f80f883d3cae07c7f83227eec9e8c0cd24329da1c99bc9359f7aab82f235dc784fdf4be930d9fa6836bc95a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700723, "uuid": "34d87f07-6b38-43a2-a491-4a5b409148a9", "value": "T137C35C73F1D08872D0B10E7C9D5AE698662EFE202C351557B6E94E4C2D3B6C2296C6C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700723, "uuid": "1a7a55ae-0e7d-4787-8528-ea560088cdae", "value": "557f0c64436e04f97f66ceeb0911cbf0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700723, "uuid": "f8461497-1b4f-4f87-979b-ba5958f10abe", "value": "3072:Qx7p5EJTJO/DL5nr0Z2fgnXKSxN07IXauEed0Kj6K9:Qx781O/DJ0Z2fjgrEeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652700723, "uuid": "2a737063-8483-45ce-949f-3109361b1b40", "value": 129024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652700723, "uuid": "328c41c8-f2e1-4bff-b2de-68ea1850fc2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700723, "uuid": "7e79230f-c4c7-45c4-b3ca-6c3477d5847c", "value": "9083ea498dae79a1c3124d7eb231c415.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac566e10-d554-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652732018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652732018, "uuid": "18934713-4ff6-4fbb-a202-978f452b49a3", "comment": "Malware payload", "value": "44eb92d5bd1ffdcc17576bf5c9e3b891", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652732018, "uuid": "65fc9eb8-c804-4d30-92a6-c5b59c39eb3f", "comment": "Malware payload", "value": "53809336e5754213201e19bbba0978f9fddb4edb9237f377ed7dee5376e86a87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652732018, "uuid": "75e8667c-df14-4027-bc13-be62a1c978f2", "comment": "Malware payload", "value": "b40c389bb7b7f3d6b23c4e3819c52f02a89d7a2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652732018, "uuid": "7c837783-3d4b-4c61-be5b-e7b1261d7e58", "comment": "Malware payload", "value": "89c73d51338706f674f75abe4693742b81e591d09e5c9f989e5255678e214ecad123f69e3aad822462207d65b702df37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652732018, "uuid": "679e062f-fef8-4e7d-a73e-05e545e74ab7", "value": "T18874C046B3A840BAED678338CC535647E772B45A4B70A78F13244379EF2F3915A3A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652732018, "uuid": "cf8206ec-3664-4e0c-b164-d0d6f3779305", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652732018, "uuid": "5082b623-3441-4bfa-9af7-865caaaebb33", "value": "6144:Es/2WX22TR72tKbxGeMkr2rlsy+vbEFXYvlx6xJkUjnKd:Es//Gi7/MgDvQFXTH9Kd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652732018, "uuid": "5f71b2c6-a7bb-4a1f-b6a9-69fe96175961", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652732018, "uuid": "51bd9f95-df6d-43b1-ab76-46a17c5e19bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652732018, "uuid": "f3032d5c-b19d-44a1-a4c9-99e73d03b161", "value": "44eb92d5bd1ffdcc17576bf5c9e3b891", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6a5634c-d549-11ec-8e58-42010a9c0032", "comment": "Malware payload (BumbleBee)", "timestamp": 1652727311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652727311, "uuid": "4aac244a-fe35-4e12-82f7-01d953832a55", "comment": "Malware payload (BumbleBee)", "value": "41c0e76996a43c4eead6af11bbd9dbe4", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652727311, "uuid": "ca3a2fed-3489-4912-a15b-247d05a54cff", "comment": "Malware payload (BumbleBee)", "value": "538ecb4299c89ffb241cfd63b6823ab604420ccaea1b05535be1ea2701afca1b", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652727311, "uuid": "4387cb8f-aa04-4dcc-98cd-7f3310b7634f", "comment": "Malware payload (BumbleBee)", "value": "f814fa9359438d312f5efe1aa28033f076a933b8", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652727311, "uuid": "ed69b2c3-d268-493c-8fe3-3cf11419df4b", "comment": "Malware payload (BumbleBee)", "value": "72e4b4cc588278f49b66361f9f4cf36ffef1c8653394c608796f657bf1fb504d185a25896509543153bc7d43500c99c2", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652727311, "uuid": "415ab73b-e89c-45a8-8b1a-8e7b610379fc", "value": "T148553A2A48AE4B4DD401CE5458343D73DAF6EF935F649298F576B883CD3E7A900B9B80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652727311, "uuid": "a65004c1-8300-41df-8416-87b31c5af318", "value": "6722b2e696f3409c5ebe8621b864aad6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652727311, "uuid": "b49240a8-2964-46cd-8c2a-0b9854ca54e3", "value": "24576:A/Cnpo704jLANvIZyltwL9L9pAtIDeFCv4o0k:gjLANvIZyrwL9RmtIDivHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652727311, "uuid": "95a7e019-61e5-464b-ae9f-cd0c77ff4b65", "value": 1308160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652727311, "uuid": "15b75df9-a131-4f07-9f2b-5b8a5b262783", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652727311, "uuid": "1dc1f6e8-8e51-479b-b9c9-3c13196e6597", "value": "procsvc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb528d2-d4ee-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1652688156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688156, "uuid": "e776d86a-ef92-4e88-b855-c7b68b4821d4", "comment": "Malware payload (GuLoader)", "value": "b882db2f52bd42d4ede42f8315b0b3b9", "object_relation": "md5", "Tag": [ { "name": "dominical svenskekrigene Bulgarske", "colour": "#FE7FE5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688156, "uuid": "f75c2635-9874-434f-b993-1f98898ce056", "comment": "Malware payload (GuLoader)", "value": "54385b38613971cc152178926fb1079fccd356b2ed436f3c396d87456d986e7e", "object_relation": "sha256", "Tag": [ { "name": "dominical svenskekrigene Bulgarske", "colour": "#FE7FE5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688156, "uuid": "89c5ea48-7035-4c62-a927-6a03ba601734", "comment": "Malware payload (GuLoader)", "value": "27e1298d467cd8af04006acc861b0a8da4e98c79", "object_relation": "sha1", "Tag": [ { "name": "dominical svenskekrigene Bulgarske", "colour": "#FE7FE5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688156, "uuid": "1ab8f61d-0045-4503-9212-c48848f7e728", "comment": "Malware payload (GuLoader)", "value": "4dfcf8a8a76f792393485a202f071ddaa108426cd5051bb952a2c97fa168efe04ca9086f4aa3bc3ca7ab963a01c7aedf", "object_relation": "sha3-384", "Tag": [ { "name": "dominical svenskekrigene Bulgarske", "colour": "#FE7FE5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688156, "uuid": "e4c214be-59a5-4f69-a567-7f65f5da691d", "value": "T14484CEE4604080E5EBF506B0CC7AAF35A651ACAE54941D0761717F973FFD2A3B80AE63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688156, "uuid": "89631103-4cda-46eb-8873-9860968ebb26", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688156, "uuid": "e0ebe953-9f80-463a-9a24-73f83b4cc25c", "value": "6144:LYa6f8fGGGGup95aGnGkG8p5HIHj3mdAKvBQqzyBjJkOANGN3D+GrS3SIUXsgUlg:LYPoW7zytO7NGtiTPUcRTqNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652688156, "uuid": "bfcc934e-8ed0-40d8-8afe-3c98ed71147b", "value": 398976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652688156, "uuid": "30e5a7ea-2847-4a29-979f-a248369de23c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688156, "uuid": "3a00af17-39a5-4cf5-998c-408a28baa132", "value": "PO140785.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fdcecd7-d4e1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652682605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682605, "uuid": "4542121a-59e0-4260-8bd1-a47017b38f75", "comment": "Malware payload (Mirai)", "value": "f40b889f5270529b6c9874d15026fcf6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682605, "uuid": "00bf0c27-987c-4c6f-91a6-f9b336e24cff", "comment": "Malware payload (Mirai)", "value": "5457068c92d446ad71e3af78bb1e7e4307cc9234d534672fc8f3d563fed64b10", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682605, "uuid": "ee8cf35a-1982-45be-aa37-2d3b1588b112", "comment": "Malware payload (Mirai)", "value": "5e5daffcd905bd2b36d92df168dad5adcbf9398b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682605, "uuid": "2241b840-ed67-4614-9a51-c2fb4903d23c", "comment": "Malware payload (Mirai)", "value": "a9df24a6b0d5dd2796ad25696c688833fcafcee3867607cde900981d01c9c741f431ff06c0589a831a4ff5b13b8fe774", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682605, "uuid": "0f748ec4-c068-40eb-8d37-a35d2a5c1183", "value": "T1F5E2E16B604D0821CBF03439EB358FA2315BCA7CF1BA786958355AF576C610499F8B83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682605, "uuid": "d4e1ba51-042f-43bd-abe3-1e1174fe3098", "value": "768:nlwSapRSl4MqEDjDsMgiDHaAx1x2VxhT36rA0vEx1XzcV5Ss3UozH:nuSapRI44D3TzaAx1xcT3iA0vsjc7zH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652682605, "uuid": "f3d7462b-af90-4044-a903-a96a7e7589cc", "value": 33060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652682605, "uuid": "339ceae4-0233-4cf6-a802-6aad18466a95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682605, "uuid": "3d44e816-48e4-4524-ac52-5281b7ac0080", "value": "f40b889f5270529b6c9874d15026fcf6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81e27173-d511-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652703171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703171, "uuid": "2d29d4bd-5ad6-45a1-bd77-b8bbc23e4f9d", "comment": "Malware payload (Loki)", "value": "c242b35faee92316e62b45e7b8ecfb3f", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703171, "uuid": "ee66556b-c759-4634-bf45-6d9269f73c96", "comment": "Malware payload (Loki)", "value": "547a7aaa7ed9f2172c2a1685f36b158c1b1c53999a883c38219752b40a61ddb7", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703171, "uuid": "cb03e6d3-6d52-4538-9022-342532c27baf", "comment": "Malware payload (Loki)", "value": "5e0f6a64e7452d055f78025583dcc138950b2506", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703171, "uuid": "4cdf1294-fded-459a-9ae3-ed06ff021a07", "comment": "Malware payload (Loki)", "value": "d4127b1afc805588d7d86229d5171827bbb369d4d823c7831a7bf001e48d58469fcb9c876f4a1500b4430ebc1035915a", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703171, "uuid": "ee29f9bb-0a99-457a-9058-fac92ff38711", "value": "T1052412A97E21D018F23DF73476E46E4D880BEC2A4C27E56BF5053A7E64F08A1A855337", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703171, "uuid": "ea6b347e-332c-4d60-b75b-a4d8c35ffdea", "value": "6144:GVYoBqt5Rl3sXKHLbqnc4njoNtk22i5yQps2wS:GVsnsXyLOnc4ncc2Mis2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703171, "uuid": "4d32de70-eb64-4af2-ade8-b415b3e8f990", "value": 229448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703171, "uuid": "a73b1394-1ac8-4eee-bc91-87f663f2165b", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703171, "uuid": "c3e292c0-dbce-4d16-898f-d3c043f38a46", "value": "lod4.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42bf3187-d56a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652741290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652741290, "uuid": "f3ef841b-eef9-4c19-974c-bb648b76b7c4", "comment": "Malware payload", "value": "42f743d2ce422b87bd39f8619fab04c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652741290, "uuid": "99775e8e-efba-49b3-8856-925bc1f8cf59", "comment": "Malware payload", "value": "54b1de248d3210d791bd950bf782bad66bb69de6b38fc7953b8cfb2d50403425", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652741290, "uuid": "f0568807-7878-4a21-892b-f0a930b238c3", "comment": "Malware payload", "value": "9d0bddf24e3c6d9e9625eff9a8554824913e2001", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652741290, "uuid": "43d33d70-e1df-46b6-ac9b-099db2ebc1c7", "comment": "Malware payload", "value": "cd826ac4d5e96313914a44365d7fe07cbdc9949687295a853c180dd0f11dd8c74a21e61d0b2ada28a25c608246666acb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652741290, "uuid": "c22721cc-84c0-4962-8688-16621e6910e8", "value": "T122143A137305E0A1F47A68B2CD82C6F895122C929EA14F477EB43F0FB872587656C75E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652741290, "uuid": "06b57bf2-365a-4630-b180-51d80b60b64f", "value": "fde2d5541e4069e745a6e58e932bac6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652741290, "uuid": "92c3eb40-763d-425c-ab37-28fe6c6d6ba8", "value": "3072:0p+j6HAWFLUxfxlQR4JHTuXR4JHTut6VR4JHTuKR4JHTuYpAxkYvcY6j+Tu+Jvi9:W+MHNabpAxjcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652741290, "uuid": "6edab7dd-dfac-48bd-90e8-ed4381acd14c", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652741290, "uuid": "7f281051-66ae-4a58-8722-4ad4233c4b3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652741290, "uuid": "ae66aac3-ded7-4cc7-83be-dd3689a1ef7e", "value": "42f743d2ce422b87bd39f8619fab04c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfb45302-d52f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652716186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716186, "uuid": "fe22b9c9-c4e2-488e-b715-efba968c6552", "comment": "Malware payload", "value": "587becd982c277b0eee81108f7b769ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716186, "uuid": "1b4222cf-3d5d-42d1-95dd-bb5ecf7581ba", "comment": "Malware payload", "value": "557a565c06f7afd0595510577dd1ff500c70fefe72a57fd2c12152353a3c1608", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716186, "uuid": "f0e62649-558c-4573-848a-9737c2457b19", "comment": "Malware payload", "value": "4ebb0a3ba077ced524420d0b46c2dd0e624142fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716186, "uuid": "24f6a949-92f4-411e-8b2a-6104980e079c", "comment": "Malware payload", "value": "a20147fd99c4545584094670b30e315d1f22f49bcb10bf0dbfe5c8764e1d1f8e4fb6a64079fb61e35e205376cc277216", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716186, "uuid": "80a106fb-1e65-44d8-a7be-b8d2e325258c", "value": "T11D620819D7840736EA330FBADD524B67433CD6526A5BDB0E3F9828196E137C08AE17E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716186, "uuid": "d3132dad-3be3-461c-a9ef-c1bb55f0dddc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716186, "uuid": "44ca179d-9557-4bb6-abc0-bcc104d47156", "value": "192:al8EkyxILK9JuPKvORRK0Dza2icHej0vBOJo3m7XlEdp4sdajvF:aD93vM0qa2icHeQBOG3mZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652716186, "uuid": "8ce9a600-2c27-4eca-acb9-5b596304dcf3", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652716186, "uuid": "70b9a1bc-69d4-45e7-ac2d-85caa3143561", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716186, "uuid": "0093d1f1-ec09-4628-9ab3-c4aa64aa46fe", "value": "Vtsane.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b44f5c16-d50b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1652700678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700678, "uuid": "6395fa17-1351-45b8-9f3f-4e55291dde92", "comment": "Malware payload (Smoke Loader)", "value": "5cd0e9cc68748d240448240de76ec63e", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700678, "uuid": "cc5b5d89-1f4a-412b-944d-8b71f1ff25c8", "comment": "Malware payload (Smoke Loader)", "value": "557e55bf2bc420daa7795501514f8e60b74dcbf371af4c46bd41528934012704", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700678, "uuid": "61cf890c-d1ca-408f-803d-6d0a92d5efb5", "comment": "Malware payload (Smoke Loader)", "value": "1920aa05fb79a5bb8250037cd3c8d60fb8a78fa6", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700678, "uuid": "48aefc84-6f78-4bc2-80c2-dfcc0627e87f", "comment": "Malware payload (Smoke Loader)", "value": "9e07dc5fa432db555202d7cf97e2d98b430d87d59301863601f8889a011c224f9822a57532463c06e9ac0acd1911593d", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700678, "uuid": "e6964f2f-004f-4d15-b18f-53cd79e8f648", "value": "T1CE34BE22B791C030D0A7553449B9E7B24E7B342217B45D8B23A42BFE6F733D15ABA316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700678, "uuid": "4c5b816a-1bf2-447b-a7a4-7b62d1d77917", "value": "0226362c44ee52f8cb9cb585e58c69f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700678, "uuid": "d5d01198-5f12-4cff-84ef-8b5c6ca07d9f", "value": "3072:rQBcHyRcJVx0w2gTKGolaN1I0O1pQbLS+g:URc/uw2gWGo2IhQS+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652700678, "uuid": "b66947a6-54f5-48ae-aaaf-fe759f5e8d5d", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652700678, "uuid": "5c745304-6ea9-46c8-80a3-c8ab8ffaad69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700678, "uuid": "83505942-d85d-4617-8fb0-46fbcf40c448", "value": "5cd0e9cc68748d240448240de76ec63e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28159147-d51c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652707744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707744, "uuid": "dc93b5d4-78f1-487c-a910-e5564700a9b8", "comment": "Malware payload", "value": "0007655a587b3ee8807dbad48a68d9e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707744, "uuid": "ac80a490-0f6b-4c30-a1e1-057bd43a9967", "comment": "Malware payload", "value": "559ed782565be897dabd42987b3c05f90b06f3627a7bce14ca532eec25758e99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707744, "uuid": "f416557c-7896-452b-b04d-feb6b1b4c4ed", "comment": "Malware payload", "value": "1bdde368ad2445647529c28a0d6f0478662adf42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707744, "uuid": "93653815-4ac7-4aae-a471-21c836aca70d", "comment": "Malware payload", "value": "eac6ab3ee451e8bdb2060d63ec163592baad92871b4120454da13dfd5362c4946abed8d32d8c852fd73e471d7355b2e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707744, "uuid": "cfdb095f-bf34-487e-a4bf-88ef12b43766", "value": "T117751232B6E2C175E99A57714DB9077892F9FF505E34870F2382E2CD8D72E464E2B212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707744, "uuid": "e88046a7-55d5-42dd-a4c7-14237ef58394", "value": "07fa46b08d6228a2e377f3707547f330", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707744, "uuid": "b1ab12d7-2007-472a-8318-4fc1650eaaad", "value": "24576:B4tnay0f1ts9HB+mh+5w4MmU5gHone95S5jopRZEVRg7gJQJshQpyFU6:ca3s9HB+msv3U5gIe9s0n2B6sh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652707744, "uuid": "38983241-35f2-4b85-9810-40a6b4dd4057", "value": 1662976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652707744, "uuid": "b7b768b6-b955-4f91-89e8-2db452894ec2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707744, "uuid": "1f866491-e0e2-4cac-8088-6962bd014534", "value": "XCC11\u70b9\u51fb\u5b89\u88c5\u4e2d\u6587\u8bed\u8a00\u5305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0bc79ad-d4e4-11ec-8e58-42010a9c0032", "comment": "Malware payload (EternityStealer)", "timestamp": 1652683949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652683949, "uuid": "e0d2b939-a361-4396-87c5-5c8192c6a4f9", "comment": "Malware payload (EternityStealer)", "value": "76c5b877fb931ed728df30c002bf8823", "object_relation": "md5", "Tag": [ { "name": "Eternity", "colour": "#271FB4", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652683949, "uuid": "7509e1b0-354a-42c5-9918-73ca1281d462", "comment": "Malware payload (EternityStealer)", "value": "55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91", "object_relation": "sha256", "Tag": [ { "name": "Eternity", "colour": "#271FB4", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652683949, "uuid": "ccbee583-8d5f-49bf-a699-08169cd78442", "comment": "Malware payload (EternityStealer)", "value": "16a8a21ef1a30849bedc514e42286de7676db5af", "object_relation": "sha1", "Tag": [ { "name": "Eternity", "colour": "#271FB4", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652683949, "uuid": "76b2acf6-393f-4db7-85ef-893e477b1537", "comment": "Malware payload (EternityStealer)", "value": "0ae995888a7162ed401b0ed50c04887cb00c5ba5b1e57891d7b7d2333310b7eae0da586d39c7cc88321e8fd7cc2c71b6", "object_relation": "sha3-384", "Tag": [ { "name": "Eternity", "colour": "#271FB4", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652683949, "uuid": "afe23c10-f913-498b-8380-a822e3785530", "value": "T156538D1877A56033F7A276F6607712408376F4231A11EF593C8C11CADB627649ED16FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652683949, "uuid": "43e00092-041d-40db-88e1-c139864087f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652683949, "uuid": "87106a16-454a-4e6d-bfaa-10b3b6538d4c", "value": "1536:Xa1RsMTQDzkwozBnDEJw8zEQoVw8zEQo2tnpqKmJ:Xa0MTQD4hzwVoQoVVoQo2t0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652683949, "uuid": "72beed05-ec0b-4795-afd0-eea7b4be6765", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652683949, "uuid": "5b4ab16a-513f-4463-83b7-1364cc0fb5d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652683949, "uuid": "a7421763-5790-468a-83e1-487abfd27530", "value": "55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7973144-d52f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652716173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716173, "uuid": "a1d5202c-af2a-4abe-87f6-c20ca3759b36", "comment": "Malware payload (Heodo)", "value": "ef18b9279ae7fd0b0561477880c3ea96", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716173, "uuid": "772369a8-8113-4328-b762-e800e553c1d4", "comment": "Malware payload (Heodo)", "value": "562437c3d3c65d35ecf7e6cea33e243c1185e0fd33b246026b02c870fd48e4ca", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716173, "uuid": "5b317a00-707f-480e-86cb-2634f53cead1", "comment": "Malware payload (Heodo)", "value": "3c8ba1674b623dd393abb782a10f0b51e6fd7dcc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716173, "uuid": "9a7bb9bc-bf73-4448-9de9-aab31aeef0e8", "comment": "Malware payload (Heodo)", "value": "15c14b0aa9e61480979bbfbd6ae20abbc089ee9c633b131f0337ac629f16b900e08bfe914a66b59c452964f5605a93a0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716173, "uuid": "74e453ae-f51a-4d5d-990a-591c71ca94a1", "value": "T11D734A4AB98AC96CE615C739499743A9B313FC114FAB078B3109F3727FF49A05A0761B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716173, "uuid": "6efd4142-0d44-4e48-ad99-c9feea14b20a", "value": "1536:tpKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg5AezwrMCtvJecvRtbTNFI:zKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652716173, "uuid": "ce58a9f3-28fa-4372-b6e4-3f14d0cfef47", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652716173, "uuid": "e6f387b8-69c4-4ba0-99b8-d4528e747bea", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716173, "uuid": "336d256b-1a7c-4e6c-a8e5-21c46ea2ac2c", "value": "dettagli-1605.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f8852fb-d4fe-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1652694818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652694818, "uuid": "89b8d4d6-4ed9-4b8a-a0e2-52d60565bb3e", "comment": "Malware payload (RemcosRAT)", "value": "401be041a25b31e02102600645800a94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652694818, "uuid": "c14da832-4401-4402-9fd2-91ba16dc8195", "comment": "Malware payload (RemcosRAT)", "value": "56400d285883e72264ab693e17d3f94bb35df61618891768c8959932b5d9f140", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652694818, "uuid": "75efcb71-7345-4a7b-877f-e920e8b202cf", "comment": "Malware payload (RemcosRAT)", "value": "a2928c294f5847329d1608f9217e6b3f1f92b0c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652694818, "uuid": "b992ce6e-f474-446d-a168-d469e611b8ac", "comment": "Malware payload (RemcosRAT)", "value": "58735d455951accdddcf3998f3efe36d8a36af02fa0bd76c32a57eaf0928c245acf7ca3755b358c891c76a60ebd6b42e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652694818, "uuid": "2754d891-021e-47f7-ac5f-edffdda87546", "value": "T130E4D0485B41CCB0F8660A714816ACE0091B9DCDDDF8600DBE97F99B2AF299770BF617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652694818, "uuid": "2a9605f7-567a-4ed1-a565-7496655b7602", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652694818, "uuid": "035811a3-dff1-447c-bf68-471330d74dd2", "value": "12288:IYvHDRyXENCAEyu4NRBOUcGIhQoGKtiH74sTT+SJwmb7DRMGL:IYvHDQXIUyuYOUcGIhtiH7xT+kb7F9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652694818, "uuid": "bb1dccf8-f748-4e3c-a185-4345b6d52994", "value": 659053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652694818, "uuid": "5daa36ed-b4f5-490f-a805-ec4a46603bdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652694818, "uuid": "766f7bbc-0e2a-4fee-868e-87da967f1fbf", "value": "NINCMPNGB - CMP - MAY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32a7ca24-d53f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652722795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722795, "uuid": "e5a23e3e-d867-4ec1-8a76-2e35f1353e30", "comment": "Malware payload (Heodo)", "value": "0648b0032cd7ceb02adae2ccc4a06efe", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722795, "uuid": "784a75f3-b68f-4286-91f2-bbc4b56cee07", "comment": "Malware payload (Heodo)", "value": "56617689db08f023c345f1c68c0b8f1dbb8826d46eb5b3555c8b70ba26632898", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722795, "uuid": "8d21f17d-e084-4137-a6a4-878f03ac85b6", "comment": "Malware payload (Heodo)", "value": "07b9327cc38733536fdcba06f13d6fb1d1aae6b1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722795, "uuid": "f87c524f-0a9a-4d7b-b172-280e42cd18bb", "comment": "Malware payload (Heodo)", "value": "625e6d526f5503be1760cfa1802dae0e1403746a5c77f9cd0277e541d39550fb9bb0dc500404cbd66195982a2b0197a6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722795, "uuid": "85fb5f71-5b52-4cfc-9018-c364cc139cf7", "value": "T1E684C04673A48079EDB79338CC574A47E376B86907B0678F1364436A9F3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722795, "uuid": "ab4d5c3a-1b5a-456b-9378-d75699af3f29", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722795, "uuid": "d20db8dc-ef95-412d-a043-431d8562e094", "value": "6144:EbmRW/X22TR72tKbxGehkesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/hpRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652722795, "uuid": "5f9fd376-f821-470a-ad7f-2b966999da4d", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652722795, "uuid": "88cf9654-bd5d-4828-8000-21f111bb5b57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722795, "uuid": "301fb322-4224-440c-bd69-3505516eb24c", "value": "0648b0032cd7ceb02adae2ccc4a06efe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7f42b16-d4ef-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652688685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688685, "uuid": "1f972aad-9c88-42c4-b8ff-d2f60715fdfe", "comment": "Malware payload (Loki)", "value": "a0cfccb849ebd91113118234dbc32587", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688685, "uuid": "c5b1492d-5057-483b-92da-85a35c6059af", "comment": "Malware payload (Loki)", "value": "57a53d6a4f0734fd1e7e65da8b5b677b7d01d204e25b4d942ec990311046046d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688685, "uuid": "6e4edad6-3a74-4a27-99c4-fae7495c7b0d", "comment": "Malware payload (Loki)", "value": "f767dddba463127251ce4a425880e43e743d7861", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688685, "uuid": "281eb274-a503-400d-bbc5-eb9b5f04d0aa", "comment": "Malware payload (Loki)", "value": "3573783e75c6f7b1099437e7b3271f1d914e441846dee41b3fdf14cd1fc4edda850c8b4bf7379b15808973459ebcefe4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688685, "uuid": "0ff1696b-161b-4ec3-9626-bb42ffc13f29", "value": "T15294128476EC9739E2BB5F742237460005B2F119A9A2E33E5DD3E0D64DF2B029B48677", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688685, "uuid": "1990e22e-b29a-4747-9d69-de3446cc43b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688685, "uuid": "7d0a01c9-34d5-4655-8424-3a8b4c04a045", "value": "12288:iUSxU/IEqxG/IxtDZwih/FpbcCNC6vC0Hl7z:iU+hxtDX5FiCNz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652688685, "uuid": "b41f0533-e792-4295-8d85-5334492698ef", "value": 429056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652688685, "uuid": "28620dc3-5be8-49e2-bda1-69cd67b6534c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688685, "uuid": "f329d0c0-bb77-4219-bf69-e5387fd4b6bf", "value": "jay.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3728d0a-d4e4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652683900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652683900, "uuid": "ce9fbfcf-b8c1-4044-892d-38661a4a8124", "comment": "Malware payload (Loki)", "value": "f3e8a3a1304f67802a0a1d6e8b46deca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652683900, "uuid": "118122a3-5765-4830-9ce8-2c550c0777bb", "comment": "Malware payload (Loki)", "value": "57c8aa8fcfc3924d3076c7ab101aca78cdef35a62d3359c51f8d0cb90eb34b20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652683900, "uuid": "274c4312-f0c6-40da-8a96-bae47b149dd1", "comment": "Malware payload (Loki)", "value": "fb0d2f9abb692058eadb5ba1d8277fef73fc34d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652683900, "uuid": "c941e298-9dbf-41dc-8f9f-70387094d768", "comment": "Malware payload (Loki)", "value": "c8fcfa0c1114daf661dff3d293fb7ba5a4e8f90ca81b045f9586a66614f2efe6506dc3b86525936588e8f513ea29bcd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652683900, "uuid": "0d0b04f3-f8dd-4acc-bc24-4264a6a0406f", "value": "T1EA041205F0D1E0B3DA773A321ABB4F2F4EA9213159A5531B475029AD7D52382BF8F790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652683900, "uuid": "dab59537-1c97-42ba-9780-bc78864f9b8b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652683900, "uuid": "1d45a661-23bc-4ee2-9545-42124256c545", "value": "3072:LODZGPEounbGT8aR5RO3eNAUjjUHbRueiESJkz4xRuPgKZ1tyza7eUg5IyWd4J/G:LOtIOk1CSjygscg4xRWgQ1tyo9RyWdY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652683900, "uuid": "490513bf-1f60-4e64-8fcb-b97e32c1e6d7", "value": 186495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652683900, "uuid": "f9f2503e-7775-4785-8596-156d82bce555", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652683900, "uuid": "b561de1c-58c3-4c23-8371-584162ac76ba", "value": "DHL_PaymentCopy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e14777d3-d528-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652713209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652713209, "uuid": "fb923dcb-1142-44b6-ba48-64bc2500fa5a", "comment": "Malware payload", "value": "ef1f26dfa86dfd2f11b444d66a78f742", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "NYAN CAT", "colour": "#D6F25F", "exportable": true, "hide_tag": false }, { "name": "reverse PE", "colour": "#E4EF6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652713209, "uuid": "c5099dd0-fd5d-4aca-85ed-83bf0ef6316c", "comment": "Malware payload", "value": "57ede35e24dfa32aa91324568afea10bb8e32f746043387c2d56ae5087bae921", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "NYAN CAT", "colour": "#D6F25F", "exportable": true, "hide_tag": false }, { "name": "reverse PE", "colour": "#E4EF6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652713209, "uuid": "1bbc2485-aa3b-4e6d-a32c-c45257128de8", "comment": "Malware payload", "value": "5f25eda59bdb0aa23b4dbaa7c41dd854b16da6ce", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "NYAN CAT", "colour": "#D6F25F", "exportable": true, "hide_tag": false }, { "name": "reverse PE", "colour": "#E4EF6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652713209, "uuid": "301c138b-4fb6-4036-bdbd-1d08dd50fe6c", "comment": "Malware payload", "value": "e9dfa2458c7ae60cc87c7f9f46792a691f862520a5b29c3db36440fffc8bf6b30b20732b1d35d27d790a0ff5ead1a3c8", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "NYAN CAT", "colour": "#D6F25F", "exportable": true, "hide_tag": false }, { "name": "reverse PE", "colour": "#E4EF6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652713209, "uuid": "ad9af4ef-66b5-4034-a287-6ef9cd19a69a", "value": "T128A3772C686EB02B3D6B9E8DBDD1F8A68C8DE712613774BA20A403475741B4CDDA3735", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652713209, "uuid": "9e5fff5b-665a-49b4-8c74-61ff42df1745", "value": "3072:/v9h0/888885V9c4UYZ//pR17ItxBur69eWlHU1I5GswU84Y7HofXqfd0:vXD5L8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652713209, "uuid": "ec0ef71d-40f3-4a12-bcbc-f30207df73df", "value": 106814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652713209, "uuid": "7b378bce-dc30-491b-b43f-33a667323425", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652713209, "uuid": "feb32fec-29a8-4cc6-a962-68f2f8009d2c", "value": "RodararoPe.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f9f9be9-d562-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652737956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652737956, "uuid": "a012d4f7-6582-4f9b-a3c8-ada71c33d190", "comment": "Malware payload", "value": "ca169caa85b9b783026367a810d3716c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652737956, "uuid": "7e432754-9d36-4767-9c96-aa3017b342c8", "comment": "Malware payload", "value": "58a432f8ffe2189118f017ee1d8810d579e4ce5df83fef9e7b3bd1f1fec7be06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652737956, "uuid": "83840158-7ace-4638-9993-93fb751c69ab", "comment": "Malware payload", "value": "f35f27f3d8cb3834a774c692dab3ea98c1fa99a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652737956, "uuid": "6c15ffdf-f6ed-4731-8ab5-198845a6e72a", "comment": "Malware payload", "value": "4e915afae46f1208aca2ca83870dbf43366cef1084434b6168fd37e2f28b21e641419985f984ec3abdeb702ec05604b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652737956, "uuid": "460effef-1e1f-489a-a6f3-76f2a1e38f1d", "value": "T17E84C04573A48079EDB79338CC574A47E376B86907B0678F1364436AAF3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652737956, "uuid": "8128e4fa-afcf-4870-ade6-888e24e0469e", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652737956, "uuid": "57c5d741-3211-444d-9341-09d0e89cf77d", "value": "6144:EbmRW/X22TR72tKbxGeRkesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/RpRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652737956, "uuid": "bfebaa15-82ff-45d6-ab84-345e887417f2", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652737956, "uuid": "015a6fe2-d046-477a-982e-6ff44568226f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652737956, "uuid": "479d1bc8-1fff-4ade-9b39-68439e7595ff", "value": "ca169caa85b9b783026367a810d3716c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc53b763-d540-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652723455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723455, "uuid": "b3e00cd9-3952-4be5-8f0b-2f7b90fd87d9", "comment": "Malware payload", "value": "715891345434799023a3b76d5c506664", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723455, "uuid": "77f8a29d-8cd2-46ee-9cf3-3c9235b68bf3", "comment": "Malware payload", "value": "58ee645385ac5b61df9018b70301886fe057912e2503b43fff229808f32a862a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723455, "uuid": "c4f600d7-a048-41ed-85bc-e516f503d4fd", "comment": "Malware payload", "value": "ef4e452ccab5b63547444848f2e7bab7f81e5ba7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723455, "uuid": "6d049df7-02f1-4c17-94d9-f9e15fbf12de", "comment": "Malware payload", "value": "d5cd7446003d094367412ceb7482134509f55c8646c4d88ac1bfd36a43654f5b3aece60b95e3ecb2d2b3eca1ff5ae2c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723455, "uuid": "7e79a0b5-fa27-4b9d-bd4f-7caae6121769", "value": "T1C384C04573A48079EDB79338CC574A47E376B86907B0678F1364436A9F3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723455, "uuid": "6e88771d-4fd7-4c8a-8f2d-21373160c368", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723455, "uuid": "8c13ba44-8ddc-4444-8a68-54f64f4826e3", "value": "6144:EbmRW/X22TR72tKbxGe/kesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7//pRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652723455, "uuid": "b107595b-d55e-40b4-aa17-6f97618a8c68", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652723455, "uuid": "864dd985-ca89-4b1a-8dda-aaa995ff450b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723455, "uuid": "1f02e48f-e27b-4edc-86bf-f207505d3817", "value": "f58J4cIIY0w5dRN.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a8072c-d4da-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652679741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652679741, "uuid": "0c929633-eeb7-4348-82fd-ef676af6d392", "comment": "Malware payload (Mirai)", "value": "158e7601e4eccc8e46e428bfa805fa46", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652679741, "uuid": "cdd7e934-4094-4ebe-8ce8-1cd957fb6d15", "comment": "Malware payload (Mirai)", "value": "59125f28280c962daf1b4d3f6b695560d4571de955984d540f2b64e01488c29c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652679741, "uuid": "20fe09c1-0d80-4fae-8250-5ab2e796bec8", "comment": "Malware payload (Mirai)", "value": "4dcdd956ac57a161e07d97b52fd034c976eba366", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652679741, "uuid": "cae8503f-5379-46eb-aa6a-c293e1676f87", "comment": "Malware payload (Mirai)", "value": "0def7472933deb1599a5dbdee59f0dd8f0fe32dcae4b3363b24c2e716a52113237b3ced885423575994a1117021287db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652679741, "uuid": "30496739-0346-4f5e-9311-a2efa0410764", "value": "T188635B24AD792F26C0D4A17F62F7C361F1E6220E25B49A5D3CB60F8EFF1464468572B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652679741, "uuid": "9e288c6c-30aa-4dfb-81bd-23f152b2bbc6", "value": "1536:+O96lSB/DS2gQ5Xu7ckkUXKePY6v4MiR0v:aEFhXu7cArhv490v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652679741, "uuid": "510b9cbc-aa6c-480e-8d51-7690b9370ed8", "value": 72884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652679741, "uuid": "c4f99b46-02bc-4c20-a1ba-dbf18de3d12a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652679741, "uuid": "d61ae7d5-45f2-47a3-9497-b069e8c1b652", "value": "158e7601e4eccc8e46e428bfa805fa46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d34ccff0-d4f4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652690852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690852, "uuid": "48fd9a3b-e809-498d-a967-fbb8e32b96d3", "comment": "Malware payload (Heodo)", "value": "6db653e06aa7b306c8b33cb9cd8e4a5b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690852, "uuid": "9c754410-9ecf-4900-9ae0-2c9ef8a6dedf", "comment": "Malware payload (Heodo)", "value": "59f6c7be65ee9e3418c34f558c448aede23ed209e3988ae67f860701e8e9a531", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690852, "uuid": "da329a07-e3c1-48b0-aa92-ab2c48f46897", "comment": "Malware payload (Heodo)", "value": "e1b84bcf919079e1bd1363f389ae1d7d591f3a40", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690852, "uuid": "35b7db24-967b-453c-9395-fcbd4941665e", "comment": "Malware payload (Heodo)", "value": "4d675356ea824ceda15e45d4af162134738590c87ee817798aaa4b21728303eade28472abd6a0fe3eb1890e1267e5f60", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690852, "uuid": "0410bfda-47c4-46d4-bb66-65511e13b318", "value": "T17F055A35FB6C8492C6A3953D88A34B06EE6AFE840B6183CB1290733E9E777D45C35671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690852, "uuid": "a3c2daae-4e41-4363-b7c0-fc07d6dc66b1", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690852, "uuid": "9bb62150-b728-441f-9d94-3610e5b7937b", "value": "12288:Q9983xLoz0/7aG8GkZHFT1YicDAXmvQaZsbNg:A9UVozAWGxGx16AWvVZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652690852, "uuid": "554be528-71b1-4a1f-b09d-3a07146dc591", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652690852, "uuid": "49a66703-b5ef-4a30-bbca-74e1bb99f2b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690852, "uuid": "2d3fa8c0-1194-43d7-9014-ad70209c8a0c", "value": "6db653e06aa7b306c8b33cb9cd8e4a5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5dc7cab-d4dd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652680951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680951, "uuid": "92f96bdb-5ba7-4c7c-8286-39f7006df5cf", "comment": "Malware payload (Formbook)", "value": "cd817669b64ae0073adb581aafc7671e", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680951, "uuid": "2842342d-0dab-4ec1-98d2-5919b144663f", "comment": "Malware payload (Formbook)", "value": "5a2a8329e5e2b69453359eb379c53ef494f2705cf1e20c60c769d70b9c475393", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680951, "uuid": "0f5c5b82-9f96-4bf1-ae68-9a80217374f9", "comment": "Malware payload (Formbook)", "value": "cdbae3e9b7da953dec25589cd14e6e9a28dc4ba7", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680951, "uuid": "97ee3a5c-70c9-4396-a71a-80d703496785", "comment": "Malware payload (Formbook)", "value": "e3e4a6183400097b0b9711a57be2666a433ab593527a55461b458ed980d7c291a8778af70ffc1f1d8db574bfb42e16bb", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680951, "uuid": "6b92dd7e-011e-4602-8c84-4be3d3ad627e", "value": "T1661349857FE8BE43CE3DDB3020D542525B34E2247B42E76BA598B63E4E537DA3984413", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680951, "uuid": "0c860b72-719b-4617-998f-d6cac1bc2690", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680951, "uuid": "775e5adc-65bf-4b9f-a85a-41b53b3103c5", "value": "768:OAabxx8GdPwl1DRUoOZcXADUQBFW4mgSjjxbGGk9Tal9hR:RabxxFPwJsKITLsx9YTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652680951, "uuid": "4c0c7d5b-bc0c-4bd4-8a1e-e6c51e85f6bf", "value": 43056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652680951, "uuid": "0548042f-ecc6-4fd1-9f03-6409b20cd10c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680951, "uuid": "0b2b40b7-7020-4f03-9335-4b9bcaba7475", "value": "RECEIPT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "544af539-d50c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652700947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700947, "uuid": "08c734ae-c33d-445d-9c43-14f8cc962777", "comment": "Malware payload", "value": "c5b87b84edcc1c1d68d43fd09173560c", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700947, "uuid": "a38c100a-f312-44f9-a81e-77913d4a9003", "comment": "Malware payload", "value": "5bb0e85a37f99374e9fc98356070b12936eafc67bbea53ec9b66e22ee0199dd8", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700947, "uuid": "f632c056-06c3-493e-bfc3-8c73dbd6a4b5", "comment": "Malware payload", "value": "d0bd38b03daa5a24e62c38c8cf2c751172246126", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700947, "uuid": "1d4d18ee-2112-4ef0-9821-2e7db0465538", "comment": "Malware payload", "value": "3f21b91741a2e231e49e7601dbf54c38e06d1c279c6be088c88b1404411cae11b6baeed118048a49b9b3f53964da5dd6", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700947, "uuid": "bfe7a114-bb66-425a-a7b5-c2871432dd3c", "value": "T1A8566C92B2C4A53EC06B1A3649379758583FBE612A129C6757F43C8CCF35940393BE6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700947, "uuid": "323e8fc9-ad12-48db-a9fa-22faf9196ac9", "value": "49152:OBZeLJHrTe6Ss3F/PooBufOmYLtCGUfbK7BTN28+ycTggG6gD2CUg1CR7rVV6JBo:YeLJJZBMOyGUW7BT6Xr6JB8k2OYCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652700947, "uuid": "ff6cf392-fe37-4601-88e2-4b7e1469a996", "value": 6431232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652700947, "uuid": "68199d3b-2b09-4b95-a4e0-ba2943cb2cf2", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700947, "uuid": "cb59fee6-7606-4fd5-a176-917a8eaac34b", "value": "ArcFact.Carrefour1605.MSI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de7f5ebe-d530-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652716640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716640, "uuid": "645124a6-79bf-4578-ac6f-b93df894e7a6", "comment": "Malware payload (Formbook)", "value": "a7d4be6144a308660a5714b5426ab5b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716640, "uuid": "910756c0-a7c4-4631-a5ab-bb0d11940299", "comment": "Malware payload (Formbook)", "value": "5bd972667024edef60c1f0f0bdb7c1602e7d9da7c736bc373e100c7521bb53f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716640, "uuid": "840df96a-0fdb-4777-a809-e2de619e8a7e", "comment": "Malware payload (Formbook)", "value": "c7346635bcd71b170c848a3f5aab35c7aa15995e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716640, "uuid": "77aae2a0-2c83-4b77-bad0-1fc9f523e972", "comment": "Malware payload (Formbook)", "value": "46e9946b91d03c6cd9fdd20a10f9e2f0f346203c9ec1930cc80e64aecbdffb6dfecc3dd2ac1df0996870af2cbfd0cf6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716640, "uuid": "51182509-12f7-4651-b7ed-545b346faf72", "value": "T12A341288F760D9C7E4F312B11C7C667AAFF5A45235E4960F23009B98B5962D1EB0F392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716640, "uuid": "cda1e6df-facd-4a35-aba8-7b194a677540", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716640, "uuid": "ef776ade-5819-4198-a960-1173e7b41753", "value": "6144:ZYa6Vg1CF7iaYPC4vFHf8dwHzQ/6p2I3ijG:ZYDgI6P9FHkdozQ/6rB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652716640, "uuid": "6a019bf4-4d59-428c-8a54-de26896a83a0", "value": 237298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652716640, "uuid": "0b73ff8f-a13e-430f-9cf4-6b9c4a3e80b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716640, "uuid": "5e47e618-a644-40df-ad71-05622910d691", "value": "SWD0004 PO06350.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48a7db53-d540-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652723261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723261, "uuid": "b5a67e5f-f8da-40ed-bd18-ec5183808c1f", "comment": "Malware payload (Heodo)", "value": "cab771d5e8737a77d574d6e04ac9a673", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723261, "uuid": "861911ef-b3eb-4216-8fb2-6ad451e2f4dd", "comment": "Malware payload (Heodo)", "value": "5c1c1f71616c5e7e4678cd7ecbd24273862bf77b90a1809bc160bff459ad3917", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723261, "uuid": "44f2a6b5-9223-440d-95f6-489fb28e83bb", "comment": "Malware payload (Heodo)", "value": "0c42998e1001cc4024d0d547fe6388f8f9f4cd4c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723261, "uuid": "d13634c2-68e5-44ef-82d3-f5a2a6a1a2ef", "comment": "Malware payload (Heodo)", "value": "909a05adbe87aad9d061a17501fdfe1dfab4c3bdc504d888d128bf1432e06adb19d8eb1e0aeec378cb0ad0abc5469db7", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723261, "uuid": "d137424b-de2d-4d65-93d5-2819f598d81a", "value": "T11F74C046B3A840BAED678338CC535647E772B45A4B70A78F13244379EF2F3915A3A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723261, "uuid": "c67b165e-b423-4781-81b9-5e78aef5c40e", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723261, "uuid": "a2636fe6-dd16-44bd-bd24-a3e53ffc527c", "value": "6144:Es/2WX22TR72tKbxGeOkr2rlsy+vbEFXYvlx6xJkUjnKd:Es//Gi7/OgDvQFXTH9Kd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652723261, "uuid": "e038684a-f0f1-4fee-9d1e-e6d5e47a87a2", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652723261, "uuid": "7a9d76e4-b29f-49d4-a20b-b9d331da5bf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723261, "uuid": "ca60d5f3-625c-4f3d-b154-817a167b5831", "value": "cab771d5e8737a77d574d6e04ac9a673", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc5a1934-d501-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652696504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696504, "uuid": "bffdb051-83bc-4afd-bb3c-2057e40cc6b6", "comment": "Malware payload (Heodo)", "value": "4376ff7d1832348fd9e13bc93a24a1d7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696504, "uuid": "66917c32-e4a3-4a98-83a8-c905be24670e", "comment": "Malware payload (Heodo)", "value": "5c23f4c753a2bc9d3cfee36eebdc8f37c402a5779f894ffbc5e0a7a0820db166", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696504, "uuid": "e0d34f54-dd2c-49ca-a0f5-050375574ff1", "comment": "Malware payload (Heodo)", "value": "267e245f9ec0b66bacbae63b3ace59954b08ea8f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696504, "uuid": "68f2921d-0509-4651-b451-1ccfc67d2cd1", "comment": "Malware payload (Heodo)", "value": "6948546260bc8ecc40995b445f5e6687d26965177f7225f5871d8d51e174cc32ed01d096f93e9645ab6abfb530eb9ddb", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696504, "uuid": "ff8e4139-8157-4873-8320-99ea46a70883", "value": "T121055A35FB6C8492C6A3953D88A34B06EE6AFE840B6183CB1290733E9E777D45C35671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696504, "uuid": "da7a2a9d-865e-4d82-b0f4-32071224e69d", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696504, "uuid": "925d8cd4-1fbb-4af5-aea3-908dd5af494f", "value": "12288:Q9983xxoz0/7aG8GkZHFT1YicDAXmvQaZsbNg:A9U7ozAWGxGx16AWvVZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652696504, "uuid": "adb6b020-7324-44cd-9216-9141806e67ca", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652696504, "uuid": "ec2d7883-2a07-4770-a792-fbcee963fd73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696504, "uuid": "33893c58-fc99-4359-9cf3-7eeee52e8cd4", "value": "4376ff7d1832348fd9e13bc93a24a1d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc9e6826-d529-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652713577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652713577, "uuid": "e48d065c-811c-49d8-a69f-fa2338af6151", "comment": "Malware payload (RedLineStealer)", "value": "688fc87d394462a64f23a72727b52cc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652713577, "uuid": "263ca229-da47-47dc-a560-736384f8f931", "comment": "Malware payload (RedLineStealer)", "value": "5cea628133b4e12c6882ad54f831cb5979979532437eda6a8fee75cf84360daf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652713577, "uuid": "d9caf681-d853-4e87-bd6b-3647ffcbfb1d", "comment": "Malware payload (RedLineStealer)", "value": "bb4a227f421a180aee78edf8e5fadf8f19f5233f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652713577, "uuid": "0f7c2870-7095-4f6e-8f55-4ccf2121ce25", "comment": "Malware payload (RedLineStealer)", "value": "2b372c8892ae1e000a173857dfee65fc8295bf50151107200020dc99fcbe0067f709595b115b85a2bdc34472285e0e56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652713577, "uuid": "ac92f44a-3be4-4b5c-b7e7-bb98f5c43544", "value": "T10894F112FB90CC31E4A22E7045359BB29B7BB8621274940BFBA0575F1E73385D6B5327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652713577, "uuid": "fe73c707-1e74-458e-b6d2-db2c790972da", "value": "1aa8a0bb9714464b5f28dfcf2c93afb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652713577, "uuid": "607337f1-9a02-472f-bda1-c0251b3c9eed", "value": "12288:pGMDNJE0H1uykxz9HoI7UFK/g06CcOxo0N:pGcE0H1Lkxz9HoI7U064o0N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652713577, "uuid": "80d6e2a7-5c61-46be-bca1-245dda821254", "value": 409600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652713577, "uuid": "fd8f99c6-c727-406a-a058-1c7f84451f46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652713577, "uuid": "533eabab-c2d1-4f08-bda3-41f5a8562f68", "value": "688fc87d394462a64f23a72727b52cc1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "028b3c8e-d53e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652722284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722284, "uuid": "d2646e66-4960-48d6-a3bd-a5d751450dca", "comment": "Malware payload (Heodo)", "value": "74c8089b55c427565213fb0cb5721d5f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722284, "uuid": "15580d65-41e0-4ff1-b1d9-2859e67a8d2d", "comment": "Malware payload (Heodo)", "value": "5cf0813c8cb564967a1698ecce6593eda2a2fae70b70e4dd5293130dff2ac7d8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722284, "uuid": "262c2f83-3af1-4652-a7ce-e25d25288cac", "comment": "Malware payload (Heodo)", "value": "8b8d07cc8b367fe517752457a0f74e744975b957", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722284, "uuid": "74919364-ba68-4102-95bb-3aadd7decb5d", "comment": "Malware payload (Heodo)", "value": "13022710f8fcf148d847c72d36cdc9f095f86ae4ca01bfbc680ff1867013c98a7a05f0698eb8ab8b6cb1f5c9530b7e33", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722284, "uuid": "d641e706-17a5-4fee-9a8d-b005ac7d88f5", "value": "T1CC84C04573A48079EDB79338CC574A47E376B86907B0678F1364436AAF3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722284, "uuid": "da079d50-cea5-44de-83bb-54a80217fb5c", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722284, "uuid": "5f236d01-69c8-4178-8bb3-5a3a655f438c", "value": "6144:EbmRW/X22TR72tKbxGeEkesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/EpRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652722284, "uuid": "95c9c8e5-67e7-4e9b-864d-a0bfd14a5f1b", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652722284, "uuid": "60efcfc0-902e-4b6e-9723-571d06ae2835", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722284, "uuid": "b550b564-3fe4-46fa-89fc-4de272f5a89c", "value": "74c8089b55c427565213fb0cb5721d5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ce7700a-d53f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652722812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722812, "uuid": "6fb6e3c3-a111-42af-aa46-85f037d4cf3c", "comment": "Malware payload (Heodo)", "value": "92c776e99fb63345850554d2480aa0f0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722812, "uuid": "44a5a26b-a849-40c3-b079-5df6b7fafca3", "comment": "Malware payload (Heodo)", "value": "5d16b779b0e0c261f548149a0be89f20d463d6dccd99fff5339452ed7b76b0cc", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722812, "uuid": "ad09c763-1919-406a-88a6-d05ccba1d224", "comment": "Malware payload (Heodo)", "value": "9377a0d90f6e6483222e6294b5d5a4f53029e942", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722812, "uuid": "a88c2302-d52e-481c-aff5-deaa17c5e514", "comment": "Malware payload (Heodo)", "value": "6a8d8c6febaa5831e2a7a54906ceb99df5880d2bd90421f5eda813d93555b7998a054544fdb98ab501b824b849660fb1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722812, "uuid": "502bad1f-4bb5-40ea-8824-f6cb2db38543", "value": "T1B784C04573A48079EDB79338CC574A47E376B86907B0678F1364436AAF3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722812, "uuid": "1460e7a2-b086-48ee-9bdb-093b1754b56a", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722812, "uuid": "689c1d87-14c7-4d6b-a2a8-14b0aee3ebf0", "value": "6144:EbmRW/X22TR72tKbxGeVkesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/VpRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652722812, "uuid": "4e3d6da1-4012-4489-b682-e25f303e1168", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652722812, "uuid": "16db928e-8b16-4858-9ab0-ba07fe45dd69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722812, "uuid": "05a25b11-7511-4cdc-8316-cb350d0659ff", "value": "92c776e99fb63345850554d2480aa0f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b74ab88-d4dc-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652680209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680209, "uuid": "bcc97352-7600-4712-8886-002a8bfcec64", "comment": "Malware payload (SnakeKeylogger)", "value": "3d87f643081f6f0635f63bdea010f731", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680209, "uuid": "296c350a-9d90-48ac-aee4-5e80a0bb8c81", "comment": "Malware payload (SnakeKeylogger)", "value": "5e643893de51d86d322c275fa035eb34adcc04ab0fda29c66ed43c14787ab705", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680209, "uuid": "ab6f9eeb-0252-4255-a06b-d466edafbfcf", "comment": "Malware payload (SnakeKeylogger)", "value": "0778a2cad05b240f2d59e9e189874153b444253e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680209, "uuid": "f738bf10-785b-4005-b710-dd47d2247340", "comment": "Malware payload (SnakeKeylogger)", "value": "8ca14b0a93119e7bd4d5460f4989ddf6a4113a0f79d9e7d9dcc9ac8966512b7692cdecf00e313261b37d124637cb802e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680209, "uuid": "b2f8cfd4-6da7-4182-8d39-d6fbe8155e5a", "value": "T1EAA4138973E403B1F3FD5239B6760A6006FAF259DA56FA3C1E9262DD1C31F014E41B96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680209, "uuid": "843f445d-96ce-49ce-83cb-889e775808d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680209, "uuid": "7252b36c-f03b-479c-bff1-96bb2c034662", "value": "12288:JP1ZIYysYhVKBoQw5wNZuGu37ETCSYLVjsuVev6WWx9e:J9ZIVsVBotwio+SYLVZevzW9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652680209, "uuid": "e6d3b9e1-a621-46d7-ad63-7cd353895055", "value": 479744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652680209, "uuid": "b3175126-303c-439c-9bb3-d1e4e020a51e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680209, "uuid": "8bfe4478-92b5-4456-a748-b511df1d376a", "value": "Payment slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "031f59c1-d542-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652724003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652724003, "uuid": "435ac3c1-f68f-4b23-8192-5429d678a7dc", "comment": "Malware payload", "value": "95abd457fd77ae31bbc2e05425eaf04f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652724003, "uuid": "2185dc6a-cc55-4ce9-adee-169faaf14e1e", "comment": "Malware payload", "value": "5f06589caa3aed7818158b76a908e826e12f4f6ae47741fd264570a11bbfc308", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652724003, "uuid": "c2917790-b8d1-498d-a221-6a5b435bd3a9", "comment": "Malware payload", "value": "d2040e63d1ca2f09a3f904dc3cde9568fd4cc06c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652724003, "uuid": "d1de1f4e-31ff-4d26-b1b6-1e054211edd2", "comment": "Malware payload", "value": "5be88d4878cf8fed2e61212db594f8e786fda0e783044a435a3da53d228879a43810e6d474449018a37e929575bd3b9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652724003, "uuid": "58f7439e-c8e5-4d5b-914d-eeda2816576d", "value": "T1CF84C04573A48079EDB79338CC574A47E376B86907B0678F1364436A9F3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652724003, "uuid": "1d74d08d-5f6a-48d0-bde9-2227ecf10d4e", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652724003, "uuid": "93026e4c-7136-4476-a33f-1b058cedc6c9", "value": "6144:EbmRW/X22TR72tKbxGeCEkesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/BpRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652724003, "uuid": "ede015f6-9044-40fa-8e11-7bc5fb467972", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652724003, "uuid": "c4eb3058-160e-46f9-b525-1d4d219db251", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652724003, "uuid": "5b1cbaba-031e-4678-8783-460a67c74b44", "value": "QBbnHMWRxcs5J.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c97ab7f-d505-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652697874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652697874, "uuid": "60f12cdb-e337-4a36-a7e0-20d631b350c7", "comment": "Malware payload (Formbook)", "value": "845d1b123a10700751e9c5fc6cd5abc8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652697874, "uuid": "9018a2d3-35c8-4802-b5dd-0171855e6130", "comment": "Malware payload (Formbook)", "value": "5f7bea8ed2f978c1a896c4e8a60abe84779be8a706bdb45922fb45ffd57e019a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652697874, "uuid": "fe003b33-a65b-4cc0-bd79-69b2886cf9a2", "comment": "Malware payload (Formbook)", "value": "0ff4177cf02b938e1ffbb9fcec7f9bdf39c45e80", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652697874, "uuid": "06f50d25-9a05-4191-ad02-ce0bfd68b55a", "comment": "Malware payload (Formbook)", "value": "76a19c6a8153ac83c878019df28349e4035893c535333fc888c4b2d6b3567276bfcfbe33db0e17b99e7056002880eef3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652697874, "uuid": "01086ac3-551e-4ab7-8e1d-f265ccb5d5c8", "value": "T1B9241226B5A8EC88E1BD37F215ED9FE951BAED088E00B990B34CB75E41393701627712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652697874, "uuid": "753abfea-5340-4528-83b0-ce725a1fadee", "value": "3072:rbgXgQqxrvSjLN3K1KjkyuiPkT4dQcaAsvcrpnXUp4F4KdgE4kNJkDoMVr9x:K7+raHNaUZvElErpEpY4KdZoxr9x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652697874, "uuid": "d2524d0e-cd1c-490d-b7fe-13f34905cc60", "value": 229672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652697874, "uuid": "28784a2c-ae71-496a-bb43-4c3e6e37af8c", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652697874, "uuid": "c29a6b77-d84b-4acb-8141-e469e692dd5e", "value": "May Purchase Enquiry.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e8a5dc-d51d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652708310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708310, "uuid": "2a65368b-0f36-4aaa-85c0-ddec1cf83bb2", "comment": "Malware payload", "value": "22f5a0adb473621ed46777e547888161", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708310, "uuid": "adaa05e0-72af-4fa5-94af-00f40cf3385d", "comment": "Malware payload", "value": "5fa75bfb5e9c9cfe55df7a31bb9782c2cec9746eaf4c73d8f31d2c0579d00812", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708310, "uuid": "58e07da4-aaed-45c8-8586-710c243352c7", "comment": "Malware payload", "value": "49668eae8d46bf14e81bf30ed604d275af01f907", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708310, "uuid": "7ab1cfee-5c8c-4428-9ee0-3e9d716b9bd4", "comment": "Malware payload", "value": "a380567b1a383f5153352b694a4d313426b90b90731122fffc442ad6c1608827108a1406242c1b93582ff8fbec08e3ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708310, "uuid": "185e4b59-b493-40c3-b3d8-cc393889b779", "value": "T178B2B94FDAC50CB6D7E9D2B059FF0B37837338D319699A0B4E80DE4D5832639652660E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708310, "uuid": "b952aa32-c656-46f4-9aaa-3f5e4a29ea15", "value": "d88da9d893eb6e98ede2a78b4fc5c67b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708310, "uuid": "69eb9e22-be2d-45ab-b681-b58f49f766ea", "value": "192:IJACrc2gjZXrjWs13161snm3Dh4otzsAM1kPMP1oynz9WYg8zmEoP4SR1M89cwr:WAoc24Xrj1lI+nm3DWew1Z9WYEuS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652708310, "uuid": "42701ece-85d6-49f4-9bf3-1ed169bd3eb5", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652708310, "uuid": "cec87738-7acf-4670-8da6-a035abb9a2bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708310, "uuid": "a7a13788-2458-40a3-a39a-5d18de32bcd9", "value": "22F5A0ADB473621ED46777E547888161.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec67afe-d519-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652706521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706521, "uuid": "8e0dd482-c8a6-47a0-b634-85bd19e6bd88", "comment": "Malware payload (Loki)", "value": "3fe3699a62de454defd75c884f72dfee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706521, "uuid": "1b4850c5-fc33-44dd-9348-4dbeb4d81529", "comment": "Malware payload (Loki)", "value": "600835010085d34587ad412232e67bb3de2918a490c48342a55c68bd05ebc99e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706521, "uuid": "84bdd540-a6be-4362-8f08-f17a082aee3f", "comment": "Malware payload (Loki)", "value": "cdad89d9f0db1ae992c2752fe8f5c6ccd7743f0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706521, "uuid": "774ccd8b-dc37-486b-8705-567feeb80076", "comment": "Malware payload (Loki)", "value": "7e5489d7288f6a7ac060bf7c74455804817dfa19813d810f95d30c619582b7134cbe95176253f02f5d747185f9c42f1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706521, "uuid": "231b9345-d0c2-470e-979a-dedbb8e630ec", "value": "T1C804121065B09273FEA31B734EF376678EAD893024512B470B50789ABE71752DB4F3A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706521, "uuid": "f7d3a646-8ce2-4837-9bf5-542a04b86ff6", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706521, "uuid": "6a7316ea-92c4-40b3-b951-be055c7d95a4", "value": "3072:LODZGPEounbEaULF0kE9w58eA6jIE3jb7iAoC1KGh1KuRB8hrCt9yct3JE7nA5Y:LOtIO1mF0dmCJ6jP3jHpvdRBnryct3Je", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652706521, "uuid": "3723d798-594e-4396-b3de-e1e6615f5399", "value": 186812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652706521, "uuid": "a489c347-32e1-48c7-affe-34b1cb2c980a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706521, "uuid": "e521b66b-3fda-4e38-8e69-06e773c6d8a3", "value": "3fe3699a62de454defd75c884f72dfee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeda45d1-d537-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652719674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719674, "uuid": "1aa84b7d-3bdb-4bbe-b994-daeec1aea870", "comment": "Malware payload (Mirai)", "value": "6a88d8b0482eefb7665b468aed10ea50", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719674, "uuid": "c94df7a5-d54c-4bbd-821d-a50c473b3051", "comment": "Malware payload (Mirai)", "value": "6074e0b3eb5de2b7b32b08326e2accb6745755ec2644237de03e6e8ee2e8d051", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719674, "uuid": "1143d96c-d9c2-4a45-bd0c-15e1410b5232", "comment": "Malware payload (Mirai)", "value": "19ad7eb93e1c31337fcbec3097f0155703f8292e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719674, "uuid": "260b06be-b54d-42cf-85ae-a60e91e2af5e", "comment": "Malware payload (Mirai)", "value": "37e424e513e6971fc1e9bf27259e96a9100b7588b15c6749c82f1d82ee951d0acfce64f3c1df2240843a910cb848b739", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719674, "uuid": "b716e674-074c-450a-a4ad-67f8e7c221f1", "value": "T16043C94E6E715FACFFAC863447B38A109248339527E2C985E19CEA011F7074E745FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719674, "uuid": "6941a3c4-db83-467f-841e-3fd23fbed18e", "value": "768:TOYnEghlCrYjZlthRQAkGGajhYTaZHXYKH7wqbWjN6DrGUgs+Uy940bvGV93i5yG:dtCrGzPkG6Ts7wqbWjN6DyUYbQSNAwLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652719674, "uuid": "800bf023-7935-43c9-92d9-5a638225bbce", "value": 60524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652719674, "uuid": "a6da6e15-a110-4fa9-907f-391e427f96ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719674, "uuid": "a47a2ef9-0342-4d22-aff0-d5c727071073", "value": "6a88d8b0482eefb7665b468aed10ea50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace78363-d4fc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652694223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652694223, "uuid": "d8454d49-a5e4-43d4-a560-a138b9217629", "comment": "Malware payload", "value": "451024161ef75983b0ad4305dba5c39e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652694223, "uuid": "a8a4c10e-d2f9-46db-854b-888b26a7f35b", "comment": "Malware payload", "value": "607f815f47b19adef7c23368321a00aae4bb83b360bff766260bf26e0e947627", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652694223, "uuid": "f5b1f82e-4533-42ce-8d8a-50e925fcde8a", "comment": "Malware payload", "value": "03397b298b9a4decfd05da09c768d21166dfd83e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652694223, "uuid": "48f631d1-d075-479f-b1b1-7c478be62fd8", "comment": "Malware payload", "value": "f7a1031dd86dfea2b32608fd71a581ec7c29a0f5f41f06185e57182d42e86147be02aee4ec01663ee26caba7fd8a6da0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652694223, "uuid": "a3cd58e2-dced-48f5-ab91-3625018e887d", "value": "T1C3A4010B2BD695B5C2AE2674EBB850B541F0A3CB1271F7AF584042E4FF6178A67421F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652694223, "uuid": "d630b5c8-fa33-4e77-966d-b5b2908cf5b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652694223, "uuid": "7bed307b-4d0b-42cb-a06e-616d08e757b4", "value": "6144:it+uCFY8LLCmf26a+Azkc7oRNFnnvfyOKUyutgT7nTVY9JovVUA:Q78LLCgzaucw9nvfd9+nTO9JotUA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652694223, "uuid": "9991a020-4379-4906-b627-4368ff0ea4a2", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652694223, "uuid": "b348c117-d165-472f-aa76-479aa053a797", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652694223, "uuid": "272f7133-22b1-4954-9edf-685e5777dec3", "value": "factura pendiente de pago pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddaa9c48-d528-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652713203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652713203, "uuid": "cc9aec95-935e-4807-944a-0f325d309f08", "comment": "Malware payload", "value": "2efbea92b34eb04a5c00ff0862d45322", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "NYAN CAT", "colour": "#D6F25F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652713203, "uuid": "6c3c9269-25f7-4a0c-9821-3548ed8541c6", "comment": "Malware payload", "value": "61b1e6b04a69136b2d2bba0d8ff13d5c57827362e4613ac4232f1b64fb007fb8", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "NYAN CAT", "colour": "#D6F25F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652713203, "uuid": "adfcf190-719b-4561-be8e-fdc275e65c26", "comment": "Malware payload", "value": "911a97b6ea96e282ef19686653f47ec90e5bd907", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "NYAN CAT", "colour": "#D6F25F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652713203, "uuid": "4edcfc79-e712-4e61-be4a-c7eb75f74708", "comment": "Malware payload", "value": "c79174d2b55f24cb432e992cbf92aefd578accd78726cd8f76e1f29de14048738c0d0f1dd1d0fa7756caacbe69f986f0", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "NYAN CAT", "colour": "#D6F25F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652713203, "uuid": "58847586-da85-4bf2-ad1f-9c9348b12ba4", "value": "T1F2D218332E83BCE45B7E1D06F54675C10D4E3E5B83784DA9FE89096624A4622DF2E838", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652713203, "uuid": "253def80-f10e-4a71-a9c5-d67706dcff54", "value": "768:j/N8yxba+6WIj2McnajQZvO9xIQPAu7rIb:jK+ba+YanLZW9x9PAufi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652713203, "uuid": "2fb5d299-a705-4f5e-a2fb-4ca59151e6e5", "value": 29356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652713203, "uuid": "c78260c1-1225-4505-9eff-ad0425766094", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652713203, "uuid": "651d67f8-7abf-4cee-bd96-8d4d3dadd5e0", "value": "rodararodll.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d6a8e7-d553-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652731660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652731660, "uuid": "97bd5c70-9b79-4fe3-8cdf-938006cb932e", "comment": "Malware payload", "value": "f2dcb2cb2ecfcf640eecec9b3eb57b77", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652731660, "uuid": "5ab1c24a-f3ce-4150-8ada-926b541c95b0", "comment": "Malware payload", "value": "62a88f196290d1726a9e851fc122e93cc91f59c1334972e5b6f33219948a4c13", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652731660, "uuid": "350abaf2-88d3-4225-8c64-6f0d895fbe60", "comment": "Malware payload", "value": "086eaeebe35d37ca3db0d7eb359da4e7ab5df4df", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652731660, "uuid": "291cad02-3a92-4859-bba8-18ed4f2ae92a", "comment": "Malware payload", "value": "75a90b2fa8d938728aab55af40d9cac52c992212981758fe4e7cd530c4f92220d75e8aa29b2b7dca89f75aea4f7444f7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652731660, "uuid": "dfab0e4e-1fe5-4562-9764-892547a57f09", "value": "T1CD74DF143FAC7A11DA9FDBB940A1C18442B1C18FBD23F21A2FA74CDE5D05B4996A1B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652731660, "uuid": "f4c8f9f5-eef0-4275-907c-b11cb6bca0c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652731660, "uuid": "7c0299ee-1f63-4fce-a655-795e88d220a2", "value": "6144:HxCMn4S2WinAvG/9x0vGvHOqmjX3oveWL30HZVj/myNYVFijaUROFP:0M42vo8GvHxmT3ovVk2yOV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652731660, "uuid": "9e765263-caba-4270-9288-8f25f5b8fa6b", "value": 349696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652731660, "uuid": "0e9416ab-2a4d-403e-a249-2fc99678b291", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652731660, "uuid": "f86ba1d1-ed1b-40ca-a7cd-78471457449b", "value": "UPS Critical Update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d3b3447-d521-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652710089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710089, "uuid": "708e7604-8489-46a2-8ca6-1ce7dd54cbee", "comment": "Malware payload", "value": "0c1375c8feb9a34bff9962345b9fce98", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710089, "uuid": "96b7109d-04a7-468e-a2d1-3eeeb0cf5cb5", "comment": "Malware payload", "value": "62aed61363753c83b8a84253ce4b21b25253a2d56abba36e9ac4ef82ee0f2452", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710089, "uuid": "5b5f2aa2-1b53-41af-ad88-90ba103c2d66", "comment": "Malware payload", "value": "3d13b2b13857cbfb7e8fcb2101341bfcfd0a6b83", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710089, "uuid": "f15b14db-b04b-4b63-83ce-03ab0b598c6b", "comment": "Malware payload", "value": "17668664d784565a1b35f00b7d3dc66bc9911276c15d823529cb75f4ef15dbc47811499957a7c59d8d4b821875ae60b0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652710089, "uuid": "9c0dee0b-1eeb-48c1-8361-ffabd6acfd04", "value": "T1F333A619657365AEB044CEF6B41A8C36C4C807E9E7E34CE5CBED5B14A022AA1FB704C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652710089, "uuid": "c0d00ad1-b58a-470d-bab8-66a73e141ad4", "value": "192:7jQoIH/IMIVXo2/+ye8r/JRg/Jw3GRESsgrGUKGP/ciIQuNEYMhH:SHARVXo4euRg1smJYNEnhH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652710089, "uuid": "73af61a0-8d0b-4bd0-9ac7-b8911b455785", "value": 51020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652710089, "uuid": "eb22dc9a-546e-449b-9618-9cfc17b57bb6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652710089, "uuid": "3911db3d-85ad-4f93-8a48-ad7757e7fff3", "value": "Requests Details.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc0e0580-d4f2-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652689981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689981, "uuid": "3cf6922c-3e2e-4fd8-9940-79263f537beb", "comment": "Malware payload (AgentTesla)", "value": "22d9f3cde8c53b26e966cce058bd50dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689981, "uuid": "a8fb06e3-8514-4967-b1d8-9de7c2831004", "comment": "Malware payload (AgentTesla)", "value": "6371e4cb722e241053c07b981e6090f080f67410af31702f1dd422937dac6530", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689981, "uuid": "b9d702d9-e494-4653-a0a4-6f85598286fa", "comment": "Malware payload (AgentTesla)", "value": "ad55a7bd79011dc66515c903a2d56f4e713b1fdd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689981, "uuid": "c12ce428-9f52-4776-813a-1ea88e7d0600", "comment": "Malware payload (AgentTesla)", "value": "664a4db8bf24df3a947f089a23ec464d21b59296f7404f584efe2f6aeb6a4a315aa91899bde0b9bd3fe3856987662ddc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689981, "uuid": "093a356f-96fd-4545-b135-be58d4c5dd27", "value": "T172D4E0AC721472EFC85BC4369E681C74ABA074A7430FA317A46354E9EA1D987CF245F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689981, "uuid": "37abfaea-df48-4507-8405-1a1633a7ecf5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689981, "uuid": "29087320-8311-4bb8-8b65-3fdd3985ff4f", "value": "12288:nwbg7iR9sf6o39YKVOcdHeOO9VCEuJsZy6IVREBjV9z55mLbBl5Tc1DST6hjm6Q:nwbgzf6U9YKVOZ9VFdizEBTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652689981, "uuid": "28905d0e-dcf6-4673-bfe1-6d19376322ac", "value": 629248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652689981, "uuid": "0ff05a78-27d6-4d50-8d3e-8ba6b00f1664", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689981, "uuid": "b9d60d3d-30cf-4153-8304-9943e0e260f7", "value": "20220516091818,XLS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "469ef181-d51c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652707796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707796, "uuid": "c394d17f-979f-4d92-8135-40157bdc84be", "comment": "Malware payload (Mirai)", "value": "9b365de8ed320f8c86345617f5b08a44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707796, "uuid": "eb981c29-62a5-463a-b632-83e91f957cd1", "comment": "Malware payload (Mirai)", "value": "63e4f396ebd5b3a65a6b88975319b9353f3b5218915758bc5b5d00470cdf02d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707796, "uuid": "035f1fff-7feb-40fc-a2a5-b945c349a09f", "comment": "Malware payload (Mirai)", "value": "e1bf5614bd76b5e233d802079cf24149ec5ef883", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707796, "uuid": "d5031532-c7c3-4142-9ea2-c69de81a5f55", "comment": "Malware payload (Mirai)", "value": "72e092e2e0bf9984d05a105fc027096631c684e729962504437a8b36d754c2e84937fa3042fafba9fc09c92f837b547d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707796, "uuid": "10dedc6c-fffb-4144-a3d2-a933f01a5684", "value": "T13F436CC8968799B9E8160D7520776B338777F22E106AEF47E35DD622ED02B02E11738D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707796, "uuid": "4f896157-3f12-410e-bfbb-159d9041b52b", "value": "1536:LwXYjsTIyaMQ5ClcVoEGHOq+V8ulyqqHGSeD:kXYjsTI1l5KcVoVHx+iu0pHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652707796, "uuid": "a87179d6-267f-440d-bf18-cc9dd5691ee1", "value": 55248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652707796, "uuid": "092675cb-1042-4266-bb23-08b3a205b077", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707796, "uuid": "4130d09f-3362-4d4b-b915-3d8f9260b1d0", "value": "9b365de8ed320f8c86345617f5b08a44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "972533d8-d4e1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652682591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682591, "uuid": "3e11bafd-0fdf-49a9-b977-a4c11558a218", "comment": "Malware payload (Mirai)", "value": "5b352e77025f528063f3c705166e03aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682591, "uuid": "ac3006cf-2fea-475c-bb24-68003d208ef2", "comment": "Malware payload (Mirai)", "value": "63fb138002dc463ef01bacc3af98f43aaaa063887149e83c716d3fbac87bddee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682591, "uuid": "4955483f-116a-4c7c-9146-54affdf61e7b", "comment": "Malware payload (Mirai)", "value": "b53c88f02ce4bef511a9028ec0e545590ae10faa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682591, "uuid": "0adcd29b-2e32-4c83-bfd4-e6f3c951998d", "comment": "Malware payload (Mirai)", "value": "1e290dca1c3138e0835acf14fa0c2195d0a31e27a92328ea8b04c518a50305708b6d6be96e7f6a842af74aea94ee7874", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682591, "uuid": "b7d7d3da-754b-43ba-848b-2bd3efa1b4a5", "value": "T1ED934C25AD7A2F26C0D5A07E11FB4711F5E227CE36B5C60A7D720E4FFF146406812ABA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682591, "uuid": "db77311f-ee03-4cf2-a278-7c64d5b249d9", "value": "1536:wDnp6Y275IKa/YAd3NpU4s9pa0JRFoerk6vowrWx1IucAi:SmU29pxoerVvoYGI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652682591, "uuid": "6e513e50-5e1b-4c45-94ec-51ebb22ab867", "value": 93928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652682591, "uuid": "6992d164-7f63-4ae5-b77d-8d9b254e3907", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682591, "uuid": "88208b1a-41ba-42eb-b399-2c9fcc8b4928", "value": "5b352e77025f528063f3c705166e03aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d65b53e9-d4e7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652685274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652685274, "uuid": "28bb8338-087a-437c-b952-854daafcf982", "comment": "Malware payload (Loki)", "value": "32d5ac11eba2a9202c1760de11938eba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652685274, "uuid": "4c0621d6-d3df-435e-904c-bcaa5fdc38de", "comment": "Malware payload (Loki)", "value": "64ba4618d20a463dcc4e5878c1216ca73377dc5123ae4d64b7229cbd203c1dce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652685274, "uuid": "7174a630-8508-4dde-8e08-667bb9535f96", "comment": "Malware payload (Loki)", "value": "faad3bddb3c726727d7ed0a192573040e2b6e364", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652685274, "uuid": "f25d78f1-62c9-48f2-9e09-050b6ebac166", "comment": "Malware payload (Loki)", "value": "9b4ed0d598108b9dd4c2188a12f1b217d29feb64adb96b78628ac954a95419724820f3c2faf29f8ca4d270d8ac78a2bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652685274, "uuid": "be7802d8-7e66-4935-80a9-9d844fb36b8c", "value": "T199B4E0EC322472EFC857C57A8AA81C64EE21357B931BA213A45755EDAE0D987CF101F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652685274, "uuid": "71ed1ed0-ea79-4f9f-b253-653d83ab1a5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652685274, "uuid": "e5c221e3-e399-4b8b-919d-91b9ff199a12", "value": "12288:zVln0hf6DpWFOmO/A97H78pNbieWqYUWIhlB6Q:zz4f6DpWFOPA1yNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652685274, "uuid": "2cc0f38f-66a0-4c9a-89f1-95d48bfe50a1", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652685274, "uuid": "02d997c3-4cf2-4099-9c55-8bd6d13c99f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652685274, "uuid": "d2c3ebb3-aae9-4877-92fc-dfe68c9d03fb", "value": "Purchase-Order_excel.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86999008-d4db-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652679986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652679986, "uuid": "7db21ac6-09fd-4187-8f0e-26cfd5386e9b", "comment": "Malware payload (Formbook)", "value": "8d0c62cf03c1e8b8edc0af522e5ca38a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652679986, "uuid": "f477479b-6f72-4f68-af64-49e964d6adc5", "comment": "Malware payload (Formbook)", "value": "6532ef52b6dc45894c81610a5f29adf7b5668da4014bd0bbe549f31657b80633", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652679986, "uuid": "e184991b-fb55-4fe2-ae26-80e158b9170e", "comment": "Malware payload (Formbook)", "value": "c21f63f9ea5270d86d366943c1ed6831b2524fcd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652679986, "uuid": "0964a14a-8e81-4412-8b23-252a2cf6a18a", "comment": "Malware payload (Formbook)", "value": "25c2c59c0661a19a6baccf2ae89f91a28ca2c6756b67a110feb8be27e89772cf98a189d8f7c0da3eec67fcb51b7e9d6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652679986, "uuid": "6ea29787-c4c9-461a-9165-219168b8dec5", "value": "T140B41248B3FA5636C03F0676E26D5C2909BAB5118472FE683CD630AE0D77B449F4897A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652679986, "uuid": "95a98257-5b48-4318-90b5-1126959b502c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652679986, "uuid": "c80ae101-484f-4c57-bf30-94c62465cb44", "value": "12288:/O4eSNlN1/NSXtq6icABsMuNn12wX4EGfjfYzSV5:3eslf/+hiSlN7EjfcSD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652679986, "uuid": "7e0ae68d-faa9-49c0-b95e-804e8718260f", "value": 516608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652679986, "uuid": "ba874b62-dfd3-4524-803c-74ccb8fdc202", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652679986, "uuid": "cd335310-f811-494c-9066-22c406a10b8d", "value": "PO8765.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb81a64f-d4e4-11ec-8e58-42010a9c0032", "comment": "Malware payload (EternityStealer)", "timestamp": 1652683940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652683940, "uuid": "0906a167-726d-41ba-9c81-f90b09466b94", "comment": "Malware payload (EternityStealer)", "value": "b35aa57c5c963bde7abee2a4e459b146", "object_relation": "md5", "Tag": [ { "name": "Eternity", "colour": "#271FB4", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652683940, "uuid": "adc30783-6d21-4c3f-844a-4a3c5900904f", "comment": "Malware payload (EternityStealer)", "value": "656990efd54d237e25fdb07921db3958c520b0a4af05c9109fe9fe685b9290f7", "object_relation": "sha256", "Tag": [ { "name": "Eternity", "colour": "#271FB4", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652683940, "uuid": "a0b26ac1-267e-4b8a-9c7f-6f39f33b391f", "comment": "Malware payload (EternityStealer)", "value": "e0817176fa7e1875a5d301b47d9a9a6977c39da5", "object_relation": "sha1", "Tag": [ { "name": "Eternity", "colour": "#271FB4", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652683940, "uuid": "9f8b48c8-e9f4-47c8-bc5b-7e8898ec5dbe", "comment": "Malware payload (EternityStealer)", "value": "04625438ac17b9e4c7c6735579fa186aa31f49611450732474102c0813df20ac267131fee971c06f0619f677a2ebaac6", "object_relation": "sha3-384", "Tag": [ { "name": "Eternity", "colour": "#271FB4", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652683940, "uuid": "9686c5ad-d654-450a-987d-1c20a8c5de27", "value": "T11C5523C0447A0C75F352673A43A2630A177DEEE11A0B970FDAEBCBE5E4543E8941ADE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652683940, "uuid": "7d649d9f-4ec9-4c64-ba8d-e75a90c0ef37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652683940, "uuid": "15ccabd0-abeb-4b32-a381-723b44c59ae2", "value": "24576:H1JLyYL/o7VE3yGM/RP0Lj5aFjtEjCZbDHb243iDqK3SeWffYR89ckY:HuYLT3kV0pjCZLb2pDqKCVfYROck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652683940, "uuid": "f1641499-bc51-4da6-80b4-d9aafa57a276", "value": 1394688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652683940, "uuid": "42abbf1a-3141-4f53-a467-fd5a0ad3e526", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652683940, "uuid": "0c8f10d1-b245-47c6-bdd3-6763c15957de", "value": "656990efd54d237e25fdb07921db3958c520b0a4af05c9109fe9fe685b9290f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9a75277-d553-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652731638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652731638, "uuid": "0b9e5f6f-83cb-4c8f-a484-5b4c6e405332", "comment": "Malware payload (Mirai)", "value": "a32ebc5564aeba6da7289b5c9cca9c9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652731638, "uuid": "6dbb2058-8faa-439e-98ad-6b948df1b5ed", "comment": "Malware payload (Mirai)", "value": "658148d47c817a71323aaf1c0c97c2c12746a4618210e5f01e775f7a7a973232", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652731638, "uuid": "541ede1b-975c-475c-9660-bbccff13c4bc", "comment": "Malware payload (Mirai)", "value": "7dbf611fe6999575df3f4ca85841a5235f8465b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652731638, "uuid": "26ba020f-eeb7-4cbf-bcd2-8d97b289ea51", "comment": "Malware payload (Mirai)", "value": "69de051cde45d6f72c54fdfd3bff46fd26bfa51c0704e4676058e754f23f1166c7231814ea229c956e1510fb785793d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652731638, "uuid": "fd53903f-daa5-4f3e-b03b-d521ca643172", "value": "T1C603E15C1B1340DADA2460B9CBC627B5AA5B4D60D442BFB5E490FC018FA1DECBD93AE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652731638, "uuid": "25f8c5a3-f514-49e5-9e6a-5efe1289e211", "value": "768:5+I2QDvkWepgKarejPErjH6mRhJhog/pDr/KZRz7TJgGlzDpbuR1J8:g69rQEvHSYyDz7JVJum", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652731638, "uuid": "89aebda3-1e62-4158-836d-b975625ef065", "value": 37824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652731638, "uuid": "61407309-3bb9-426f-84c5-de6d4490ca5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652731638, "uuid": "0ca78864-ef00-434c-a6eb-fa75564d3e59", "value": "a32ebc5564aeba6da7289b5c9cca9c9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96a1c9f1-d507-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1652698911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698911, "uuid": "51e04171-bb4d-4131-b878-5d4fb37b0ea7", "comment": "Malware payload (Smoke Loader)", "value": "3854c1704bde80921c4ab8b53b35d013", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698911, "uuid": "a1fae05e-11bf-4b31-a750-a84d13f0fd58", "comment": "Malware payload (Smoke Loader)", "value": "65c863db26f4ad804cb65ecf86f5d3b0b7dc961979544fe059192f6caab4c861", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698911, "uuid": "a1397e00-894b-41e1-9dbc-9ff8ce7c1866", "comment": "Malware payload (Smoke Loader)", "value": "4b9ca4c846374f7ddf5edb869b4a59956a111a35", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698911, "uuid": "62ab5249-12e3-4a63-a474-eb7d5967d3d0", "comment": "Malware payload (Smoke Loader)", "value": "bed7e9940058009972886dd652c9862e680c38d6b0a60bfb8865b41a7a8a5912d410bd9a5ba270df2fae2700d69658e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698911, "uuid": "495710ce-7ca3-47aa-a9c2-3cafee6bf26c", "value": "T1945523243BF98929F2B1753D85F3723597E863322B07B35D661122921F127868D836BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698911, "uuid": "bfc7a631-4e1c-4924-b429-6d155a936293", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698911, "uuid": "a2d64ed3-ad48-49ce-b3e3-058e021e536b", "value": "24576:n6kH+O5MMsj/8oJ0HOgwzMIdEyaXC772Q9NXw2/wPOjdGxY/jz:nfHZ5MMpoJOp+MIVai7Tq24GjdGS/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652698911, "uuid": "8205c110-3396-4936-9900-48545a6caa8b", "value": 1392640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652698911, "uuid": "5a8c6962-db99-4a0b-ab29-d46fb8abf79f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698911, "uuid": "4c8e84d3-048e-4fc8-bc7a-ef4ec8055f58", "value": "3854c1704bde80921c4ab8b53b35d013", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d53a7ba8-d4ff-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1652695580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652695580, "uuid": "da94d58b-3a33-4ad8-ab06-f184659c10ab", "comment": "Malware payload (SilentBuilder)", "value": "30f46a9102cdd0184f3b9d1341d32a57", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652695580, "uuid": "2f3dbff9-e648-4e2d-a6f4-33d88d43b0db", "comment": "Malware payload (SilentBuilder)", "value": "6637b3a45ecad7e8b0cca33fcdd5e7f6125de846cd45db5647b2d899157de514", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652695580, "uuid": "d33a4301-0c22-42b6-8541-b000d92bfdae", "comment": "Malware payload (SilentBuilder)", "value": "cbbd77e69ff3bffe8c30b7bcdcd3d2524221a864", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652695580, "uuid": "85b65b83-0c37-4b70-8b68-ac2cb6c001ee", "comment": "Malware payload (SilentBuilder)", "value": "21fdeed9fd1d8f24249e50bd2e71cc24b25c1526ecaf8154d19d513b37d92708aadba78e45bcace25203b1eba63fd869", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652695580, "uuid": "fe9ba975-a625-45de-9335-4aee377909f9", "value": "T1DD734A4AB98AC96CE615C739499743A9B313FC114FAB078B3109F3727FF49A05A0761B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652695580, "uuid": "2052380f-9c04-4a4a-981c-06c3cb2b5d8e", "value": "1536:tpKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg5AezwrMCtvJecvRtbTNFs:zKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652695580, "uuid": "ee2da89c-2395-4471-a0af-e7b819887a52", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652695580, "uuid": "67e83bd7-ec88-431a-b7b2-a78839480a24", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652695580, "uuid": "b283f0ac-1752-4871-af83-35dc6bc30723", "value": "Hd_4.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebd18b22-d4de-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652681444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652681444, "uuid": "245ef9c7-3fe1-4877-8bd5-454b7c4e8e0e", "comment": "Malware payload (Formbook)", "value": "cbff37d66de0f45c1d6db6dc2785d9be", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652681444, "uuid": "89646308-5135-432a-949d-163d00925faa", "comment": "Malware payload (Formbook)", "value": "6663f9e8979421ffa7d446661e560d9e0933282c1d05d29704b6474eb30e0dcd", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652681444, "uuid": "f48f9f87-caa2-4008-8832-e9399ba0ee4c", "comment": "Malware payload (Formbook)", "value": "86411415baec5fb1412334a849f4a6328e002a1e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652681444, "uuid": "b3068a3a-ddbf-46b6-852d-da335794b83c", "comment": "Malware payload (Formbook)", "value": "fe8f66656c4196325cf81c9a97367d483e21535a6064959c0b46a20421835d595656dd1e4a81053cca619c65254ff240", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652681444, "uuid": "f19d42c6-03f2-4237-bc12-88a908f10344", "value": "T1E4B42323DD2E537EB43C07B901B40C6ED8499E16EF9CE12657ACB960AC94E6799CC9C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652681444, "uuid": "a119145b-6040-43e6-8fa1-997eb46b183f", "value": "12288:rH01X+lxn3u91OUUo+zELQdv37TpwmC5t3X/BoSGVCw/w+yb33/dii:A1Olxn3o1H1+znzT49ZoJVJ7mlii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652681444, "uuid": "ba022549-5e37-47ff-9bb3-9caf0fdeb71f", "value": 496717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652681444, "uuid": "c25dcf68-3c73-4471-89b8-7c93d546de01", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652681444, "uuid": "e98e889a-8c05-4238-a674-9905f3e20288", "value": "Purchase Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cdec493-d4fb-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652693579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693579, "uuid": "aa5f440b-331a-4a36-a562-72961671da48", "comment": "Malware payload (AgentTesla)", "value": "a29451b84a19d2d84b347d035c5486a2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693579, "uuid": "3c24b634-f078-4715-8beb-cfbe3616c98e", "comment": "Malware payload (AgentTesla)", "value": "670440cc47b483b5bcbb9017e29e4612196576f99e86ad99280a10a41f79528c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693579, "uuid": "6e2a2500-3d55-4c08-a4ed-b0f81845b543", "comment": "Malware payload (AgentTesla)", "value": "9e18ea4ae36f76cccaca64cd7d1b77ac9b92ac42", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693579, "uuid": "92191a30-eb19-4f5a-8a38-8baef5c7dc33", "comment": "Malware payload (AgentTesla)", "value": "b75697f05c4e04eca00a8886b44687cf75c78b453370d7e959d45d0a02e516dc8bf214e4eb02392486e98624cedfdf90", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693579, "uuid": "adb809a4-30a2-464d-bb1c-7ac8798e029a", "value": "T1EEC46CAC325C75DFC857C532CAA85C64EA60787FA71B9107A067269DAE1DB87CF100F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693579, "uuid": "b67aee22-0aae-4411-9094-cb1691647f7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693579, "uuid": "6b7af53c-3ea3-4719-82a4-369317a6c435", "value": "12288:vO+lmu9as9IUVC/dc6Mj1T/FBd4ZkM8VHa3+Elx6jig1HAP21yLte5KNeACG/:vO+0u9nIECeiCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652693579, "uuid": "8d839064-3430-420d-918a-33395a7f9abb", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652693579, "uuid": "75485898-8dd6-4b8a-9364-e0ef941fcfef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693579, "uuid": "f65ad0ae-1b5e-43a7-897a-4482eca5b4fb", "value": "00187.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1f0bdf7-d4f0-11ec-8e58-42010a9c0032", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1652689105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689105, "uuid": "73751720-59d1-4dea-a2a2-60aaca447641", "comment": "Malware payload (ArkeiStealer)", "value": "60cb8277c933af13e5cb4c4fb2687eab", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689105, "uuid": "6523848c-acc2-4a20-aa77-1a0f2c632aa1", "comment": "Malware payload (ArkeiStealer)", "value": "67309f7d94a21a458e0443dcbdeb8c2d4fb778e19a247dc759d78c3ebdeb9619", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689105, "uuid": "855a3f4e-e174-4baa-9ea2-aca85837b1d0", "comment": "Malware payload (ArkeiStealer)", "value": "52bf792c184e9e2754ae9b648c7b825824a2fcc4", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689105, "uuid": "f53a6b88-d2bf-42f8-a317-ebd43c1a5f72", "comment": "Malware payload (ArkeiStealer)", "value": "8c37811a17f49273f94a3b28dea6bf615d83c95f3acaf3378bac34bcbc622ef1ed1e02fca4217919dcfd92ec94099723", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689105, "uuid": "179defa5-2c7f-41aa-8596-1f85248cdf5d", "value": "T1ABC4CF567754D437C2A229398EE6F778467E6DF02D214603FBB03A3A7E71781AE1070A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689105, "uuid": "f409bd48-4f69-4b78-b278-721f35538c08", "value": "12288:PseUsxBPDvx6qLDkMkUFp6YtuNwlWjXm6a2ZWtkstsw5SIp7a1lHFciLOZ5TnD:0eUsxxDvx6qLIMks6YtuNwkT1ZWdWw5L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652689105, "uuid": "6a3fe18b-6cb1-4a77-aa83-d0376a6ddccf", "value": 557056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652689105, "uuid": "12371ac1-9b81-4d8b-a509-fbcb3d8d09ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689105, "uuid": "395cc88d-a6aa-487d-a805-6f8a612e5471", "value": "67309f7d94a21a458e0443dcbdeb8c2d4fb778e19a247dc759d78c3ebdeb9619", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ffbf9c5-d4b2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652662204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662204, "uuid": "9e678346-06f2-481e-8278-af7c517b8cb4", "comment": "Malware payload (Mirai)", "value": "7ac9d11bab4d27371ebb9b89f483702f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662204, "uuid": "b1ccdf5e-9ad9-4726-82b1-1a4495d782f9", "comment": "Malware payload (Mirai)", "value": "673b29b0cb77a430561b5cb9c427d4d89034da875c2691a3e635ea8969132d0c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662204, "uuid": "d40f0320-fe98-4378-ad89-fb3299c340cc", "comment": "Malware payload (Mirai)", "value": "bac7ab798d2f6c0b2feff570aabfffbe9717f122", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662204, "uuid": "b71b842e-1959-4ec5-8f7d-faf8e573b7ec", "comment": "Malware payload (Mirai)", "value": "6caa9bbe61c1292eef4b6e5760e282286cae2bb3b4f9fb0ff81b7c433d8c80d19c1b0a6e824f74425a9d88e060e2fbb3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652662204, "uuid": "a008438b-3e43-4c35-87f0-4386c0b949ac", "value": "T1BB2329C47482F9F8EC15057C317AE7729EB7F43A703ADDABC39994239815601AA032ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652662204, "uuid": "e30c098e-7bce-42bf-81dc-e87e63edd52d", "value": "1536:SZ4pyHAH8TgbrnOIjuc9qBNcxvkm92kdrkEU:qHAH6arnOIjuGqvivkmAkZrU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652662204, "uuid": "a7532c0d-be6c-4529-ab47-68efcbf6e716", "value": 49752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652662204, "uuid": "a46d8dae-3eb1-42db-a4c9-fd1b9e0a9d9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652662204, "uuid": "a0050dd5-67db-446e-99a3-cfbc4c6bb12f", "value": "TSL33T.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "688d1ffd-d506-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652698404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698404, "uuid": "45eb245b-6237-4e10-b6e0-cabea1b69cb4", "comment": "Malware payload", "value": "e737ddcc08d815db1621f388e2e6aa8e", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698404, "uuid": "e9117096-cb2c-4529-a2d4-70d2a28b7e2e", "comment": "Malware payload", "value": "678165608b9bc029ff701d7b0a383f86de1415b58cac166bb6ee8d23195996f0", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698404, "uuid": "61a6bdcf-5889-4baf-8c9c-3982ac84226c", "comment": "Malware payload", "value": "44bf2916e2db21ed50c4814e0ed3aa32e9cb5949", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698404, "uuid": "be322ff0-a5be-43e5-aa48-31fc520d7fb7", "comment": "Malware payload", "value": "133b32211745c866e3ecbabbc2ef5c06532806d5d361abcee356b4d0be3bfec28021d881354daadf84bcaf160174868e", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698404, "uuid": "bda1d3d2-88c9-4263-9eb7-b05016f40d09", "value": "T146E16E7BC5A7E43EDB29927700841B04E512BD9003963A1ABFF0C99C1D7F2972B75D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698404, "uuid": "446d38ca-6a08-4e34-81f6-c60c412a5571", "value": "192:6zC5+F3oQBsRfhvI7kVJHR2zO/6FYwRDO:qCI3ogsk7apgCrwRDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652698404, "uuid": "aa7cfa44-587c-4007-92c1-ce5db1f3f9d9", "value": 6906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652698404, "uuid": "e38af6bb-7206-4f13-9e69-8a1884cc3c8a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698404, "uuid": "e1ce3645-f067-49d5-8379-f5d8ac3e5eeb", "value": "Order List.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "178efc29-d4f9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652692684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692684, "uuid": "51021df0-29dc-4801-9b60-b2e2258919a4", "comment": "Malware payload (Loki)", "value": "3da9910295fa720e889c9e4c3789b796", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692684, "uuid": "469a2b8a-c9e5-43d2-a537-8502cb9d020d", "comment": "Malware payload (Loki)", "value": "684ed900572f629d01af629c52e9f8a2298ae517dae64c75e44fb0d4a7e592ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692684, "uuid": "18e266c7-e0c8-4199-ba96-104108864b56", "comment": "Malware payload (Loki)", "value": "ff94f4e5a101696f188db5eb29001fd6b16e2de1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692684, "uuid": "6c7ef9fd-dadb-4f9a-a71e-8030fa77c0ef", "comment": "Malware payload (Loki)", "value": "b51fe0837cbfbe88fb25d87f8c4c9eaa3290337f12ce69e0fa2a90e4503b1d75717883095670f47c35219c05e9ce73f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692684, "uuid": "176386a0-323a-4ad2-bb5f-f5d9e8494e31", "value": "T16A94138433EC9239D5BF9778557A01140AF3FA12E912FB3D2D5694EA2CB3F0047E1966", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692684, "uuid": "1fc47740-6fb3-41ac-9fe2-3e6d76d22108", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692684, "uuid": "b41d6593-685b-4a89-b9d1-a07dcebee82b", "value": "6144:gytmQIxkhJ1knHyd/hyd8VukYluc4Z3JhJ9zf5U9tXl3Ahi/sIirO/rQiAwK:/tLPd/ZukU4Z3LAtVBUh6/8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652692684, "uuid": "e5205fdb-ccea-4bcc-bb42-40bb4ab31c95", "value": 448512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652692684, "uuid": "9801da46-69e0-4527-94bb-2dee390d9f7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692684, "uuid": "0029a7e3-6de6-4e97-9fab-be68ce4fbce7", "value": "RFPDOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51edf6aa-d511-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652703090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703090, "uuid": "2f650886-ee4e-4389-b2a4-cb22af20ebce", "comment": "Malware payload (RedLineStealer)", "value": "c75db261dfb036d0c31ff72f2f3399fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703090, "uuid": "133845c7-3f6b-4566-9540-780a66c5fc10", "comment": "Malware payload (RedLineStealer)", "value": "686ba2957984d39710af7ee6e9e1f51c8fd93c65a3a16ec48a33c7c6dc5afdf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703090, "uuid": "668afccd-cb40-49f7-8be6-5b811698d4dc", "comment": "Malware payload (RedLineStealer)", "value": "b5908314126aaeb1f3b56cd3796ccfd08ee8bb6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703090, "uuid": "8fb942a1-be2f-40cd-9153-5fe32702780f", "comment": "Malware payload (RedLineStealer)", "value": "7535bec9b56031f49f0003dddc73240a38290d37e5b5fc05bf914df52b5f6d9c2bc7bf088ff76c6968294b3d09278ee8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703090, "uuid": "ea59802e-1104-4e0f-a307-ee49cf5a0bf8", "value": "T1B564AE09B4AA8432C9B2143116E88BB65F7CF9705F1159EFA3950F7E0F302A55E316BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703090, "uuid": "b0fc0e44-9754-4c6c-a15c-b1612737ead6", "value": "72245472fc6d24482161d3d76552b33b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703090, "uuid": "f33e43d2-09de-4820-871c-5379302ecd52", "value": "6144:hH0ocvOkm9NVUqW7Ly0AOYH00HW0i7lrXei1224SnWCCHsxAyf6t:R07vOkmGpKHNW0qXeix4SnUH2Ayfa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703090, "uuid": "884aabb1-fd43-4f1e-bd14-aedf28bd74c1", "value": 308648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703090, "uuid": "97967f4d-f423-43ef-af7c-e90a01ac9b1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703090, "uuid": "a2b86fb4-d4f4-4f52-a09e-a7c15c1b45c7", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76931571-d518-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652706158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706158, "uuid": "8f0f16ba-5f50-46b1-a85e-db20f5969589", "comment": "Malware payload", "value": "5242a94b5aac56944c173fb5d47f0274", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706158, "uuid": "eb42cdff-64d9-4a64-96b7-a54b0406f8a6", "comment": "Malware payload", "value": "68c27f70f434e977b779ec36d00276f7917ae783116608079e7175cc3ba098e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706158, "uuid": "49f61787-3617-454d-ac0a-0f26123cea38", "comment": "Malware payload", "value": "fef7c004859c82ad4ea5615e6fbb8214bbe47122", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706158, "uuid": "9a45b0d0-8c93-4878-9013-6fabda9f4fed", "comment": "Malware payload", "value": "a0e9374497a3601ea27a88f3511b95338cc7819ca47857920bf5d8bed8b071a1ee6ee27418bc1ad0cf4ccbc9b882a4ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706158, "uuid": "4b5809e1-dac2-4b82-9cbe-3b804ee59ddc", "value": "T1AAD54A4966A860D4DFAA907CA507593FD6B1FC210333C7EB22649A4A5F733930E3AF51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706158, "uuid": "dd3d1d8d-9b71-4faf-b14b-6ccbfdd1562b", "value": "9d8b25cb9dbef470e22c481f96549a42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706158, "uuid": "51deb164-d72b-4664-966c-d85d0743d845", "value": "49152:R81ZeNbCdQhUIElPnoUXkLLRi5YwPITq+A+AMCzr+ApBLhOOrtq:R+X55+AVzr+mBLJtq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652706158, "uuid": "d2152407-2d2f-412f-9616-29f2dd54483e", "value": 2941440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652706158, "uuid": "dcb5ed2e-28c2-41e9-ab0b-818a8e098a8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706158, "uuid": "0650ce16-47c0-4f6b-a4ad-cd8de767fe7c", "value": "\u70b9\u51fb\u5b89\u88c5\u98de\u673a\u7b80\u4f53\u4e2d\u6587\u8bed\u8a00\u5305!MzQ=.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "854023b5-d56b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652741831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652741831, "uuid": "435c6181-a6a9-43ef-8411-6ce3df6037ac", "comment": "Malware payload", "value": "a00961295b3fa8c939ab0ea33d56634e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652741831, "uuid": "728e46a6-636f-4a61-b51c-484a3d06a55a", "comment": "Malware payload", "value": "68e9138ac21e77c7ae2162200bd08f59914811a4dcfd0fd580c2743bf0161171", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652741831, "uuid": "d3ec29d0-1c5d-4874-bc1f-318603020f72", "comment": "Malware payload", "value": "e0cedfced5b9d1c8bcd8ed59808a6d0ded3d5d56", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652741831, "uuid": "ed4ccd23-630f-4864-8fab-30dbefd5e120", "comment": "Malware payload", "value": "9ae07f2dbbd6fb674ef7efc277b12938526ed9ada7e83301592bd805fed6584cddd8ec5780ffe7f2c48cd423faec736b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652741831, "uuid": "2842c972-e62e-4d8c-b2fa-400e6d5006b3", "value": "T1B1F30927F650F156E00385F12961966E281B7C3208849D07B385BF8E3937AE3E9B5B1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652741831, "uuid": "d9ada4e4-3918-42ef-b6a6-fba7de4b6153", "value": "ea2ed766b6f336c331c958cded40a580", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652741831, "uuid": "b290c84b-9d09-40f1-8ce7-fac4315d81dd", "value": "1536:HU+f9cTRjW3QCftXU+f9cT/gpcltYvsbze7Cf9Q2mYuTwuX1KdWQP1HYd6lAccZy:HKKQCVXC2+ttPuT7X1KdWQP1HYde9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652741831, "uuid": "57d7f8ed-df15-4ea6-bc09-f60f314c621f", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652741831, "uuid": "46e16868-d70c-4d4f-89c6-1482f8692e08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652741831, "uuid": "7d48b3d5-b880-4c77-80e8-9a2e00c26f0e", "value": "a00961295b3fa8c939ab0ea33d56634e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7afc1d98-d4e0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652682114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682114, "uuid": "fcd85b80-042a-46fa-91c6-ef1cedc4751e", "comment": "Malware payload (Mirai)", "value": "70125947841edb3f36d5f57caab14f9e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682114, "uuid": "540e4b73-998f-400d-97d0-15b4de17f562", "comment": "Malware payload (Mirai)", "value": "692baa591d69823093c246aa90e6d88263bf2399f7b5254e4035ac5a6e955c92", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682114, "uuid": "2c8030e4-8675-49f1-ab0a-5d51d9c69c95", "comment": "Malware payload (Mirai)", "value": "c4e2ce352f2e32a86479bbb55c4271f88e8b1f1d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682114, "uuid": "be4ae499-6467-45f6-bcd9-cbfd1343a907", "comment": "Malware payload (Mirai)", "value": "a237a3dfbd5e3be14d35e5b5c228c7d1c81fcff6009ef28ce9f64411962f9666f9a600d3fdc0f4553d39d8d7aa956cc7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682114, "uuid": "1a3c1a84-f923-43d3-8fd0-af0731eb6ec0", "value": "T1C8D2E13021176D94D922BD3EAEF2CB8591D196FCD4FD303A54050A79AECBD8722F8392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682114, "uuid": "50123fa3-0c54-48ca-a304-ef6e80c59b42", "value": "768:lW1MGys4ZlmfntR2QoDNMciI2Nf775OZHrUlGa/SCoJ2Qhs3UoznG:lWGhyn2QI3iI2NfWLUNKpvMzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652682114, "uuid": "703eed1a-9e49-4131-8443-f145a2c3a57f", "value": 29496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652682114, "uuid": "74d52d18-db14-406e-ba58-a7841b96217a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682114, "uuid": "0b59665f-f944-48eb-8efa-a5ff37e0674a", "value": "70125947841edb3f36d5f57caab14f9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7401e4c3-d53b-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652721186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652721186, "uuid": "76ccc788-bf41-4c39-bdde-41e143ce5435", "comment": "Malware payload (RedLineStealer)", "value": "51063c6c108280a38ac6b3dc3ee68ccb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652721186, "uuid": "66c92de0-8b3a-4433-99ad-59e8b1ba587c", "comment": "Malware payload (RedLineStealer)", "value": "699609fdcdd9797c0830ae08912fc98d9feb123fbda34a39e60b7b0f5dc0cdf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652721186, "uuid": "ebe6a2ee-441c-4931-929a-4dcb6773650b", "comment": "Malware payload (RedLineStealer)", "value": "612df0a501bf4a9138519480b1dc45bbbb9595ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652721186, "uuid": "6edd5736-03df-4170-83c8-c3a9a85f0baf", "comment": "Malware payload (RedLineStealer)", "value": "caf1748ee29ef06c474810f63a65eb8480b2c5b1d354a07f224907f6bd3860460c9a5ddfe294a5f0c9678c30199a37a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652721186, "uuid": "537a84d8-2916-44e0-b8b4-7828a444a43c", "value": "T142556BABAF15D91FE6033071819C9672540267B12A0FB8936B457AAAD33B1C1FF34B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652721186, "uuid": "101d37f3-8650-4e37-8315-02eb8212fab6", "value": "37a87ba4c777dcd1db50684f6b029f1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652721186, "uuid": "dea1707d-e8cf-4f9b-b86f-941d60723da1", "value": "24576:puhUlUTR8PpuLS9E5FV1NcUxlDzkulfNLidCoNw/KQHPKZDxtoUM0H2vhN9PbIqC:sh/IuLII1Nz/RdpgCyjDFMq2vhN9PbI7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652721186, "uuid": "34677c5e-35cd-4194-a9b4-afc13fbf63ce", "value": 1404344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652721186, "uuid": "917d014e-1aa0-4e0c-ad2c-ca8f31bfe5eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652721186, "uuid": "2af1a041-ed80-4fba-95c9-ff6ff8a4e78e", "value": "51063c6c108280a38ac6b3dc3ee68ccb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e76c5e8-d569-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652740880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652740880, "uuid": "f7f57d25-ffbd-4511-9112-3b503a6b2130", "comment": "Malware payload", "value": "928e51d27089099d62f04b61dcf204c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652740880, "uuid": "02dbbd8e-75ea-419f-9a60-aea8403c7863", "comment": "Malware payload", "value": "6a1a455856b645375f1f4a39d3b35a710279c788e9948f6e5c9f31fdb49490f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652740880, "uuid": "1405708d-8abb-4251-b3f5-20ce63021265", "comment": "Malware payload", "value": "4bd239c1d70c7481e8e5f6f6c26c8e9265761a12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652740880, "uuid": "e645e1b4-c054-4233-bfc1-d192e59d1bb7", "comment": "Malware payload", "value": "2dbd0bfe65748928a28bcbbad0b2198b41183b6ffd440ad59781eed598fd2a65241ef40524ed7005f96e4a5969e20fd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652740880, "uuid": "67763cff-6bbf-42f9-b39c-93542e3e4a6c", "value": "T1DE84C04673A48079EDB79338CC574A47E376B86907B0678F1364436A9F3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652740880, "uuid": "fba44afc-7d6b-44f6-92ce-12238ef750c4", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652740880, "uuid": "5352981f-94dc-443f-b64e-f07aebfebd69", "value": "6144:EbmRW/X22TR72tKbxGe1kesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/1pRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652740880, "uuid": "c879195c-e46d-4e7e-b78e-94cd920d241a", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652740880, "uuid": "fab9d9e2-1857-41b8-a5ef-8bf574833503", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652740880, "uuid": "e814ec99-d471-4be7-b910-2d4da5c79a62", "value": "928e51d27089099d62f04b61dcf204c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74818250-d4ec-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652687257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687257, "uuid": "c98b9ed0-f8f4-4e1e-90df-ea4a262dab6f", "comment": "Malware payload (Mirai)", "value": "d681d9c3acf26451fc664bd3752bfb72", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687257, "uuid": "eeb44948-063a-4e72-b257-e5df1c7a3a4d", "comment": "Malware payload (Mirai)", "value": "6a5b408cafc91d88ed5d19cdb9e6e29270dd69459280866b12712780ebdd2187", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687257, "uuid": "0cab157e-5ceb-4ef5-a5f7-eb076d575465", "comment": "Malware payload (Mirai)", "value": "e077d52e698e1a3717e75e83efb1f76eb2bb696a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687257, "uuid": "f82a0b10-f48b-455b-9837-10e7ce493194", "comment": "Malware payload (Mirai)", "value": "ff0be524d9aa9b3360e73f9a55a5cd6c4f3e614f5a4792a6a47ccea8e2f9d172daef7862f9a68e6d97b5afde4a37ace3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687257, "uuid": "f5eee595-e4c7-4034-aeee-15c609df7ddc", "value": "T167B2C06CD09D0AD7E6ABBD745873D4C667D08F9573624E92B282AF13311B17BA3078C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687257, "uuid": "f7ed9a47-a1dd-427d-9b75-89d8281b1888", "value": "384:ikHfyn+gusDfguCnOvKOF1dskQJA+XvV9nqjZ/bQpfPzAw1M4uVcqgw05VxJI:i2OjCOv/1CY+/V9qqpXzAV4uVcqgw09q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652687257, "uuid": "c2b344b1-5999-448f-84c6-9f6b1fda361c", "value": 23480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652687257, "uuid": "7c92da88-0db3-458b-adef-8ce3cf9fa4e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687257, "uuid": "7aa88d9e-b0af-4169-b19f-1317605c744a", "value": "d681d9c3acf26451fc664bd3752bfb72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "511df6fb-d50b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652700512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700512, "uuid": "50293232-0f21-4d5f-b50d-86b9afde608e", "comment": "Malware payload (SnakeKeylogger)", "value": "983cad323ade648ec1161aa0cd24b57f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700512, "uuid": "e32d19ca-54ac-493d-bcdc-506b6a89a7f1", "comment": "Malware payload (SnakeKeylogger)", "value": "6b2709906a90b8d70e1f315ecf52eb67c9fecd1a65523aa46b4823786ba701d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700512, "uuid": "7d2b72ae-45db-4775-8ea4-c11a10ea2e40", "comment": "Malware payload (SnakeKeylogger)", "value": "579f128123ea7d405f53289961347afbd711f2c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700512, "uuid": "5300c243-bcee-4f78-bc3f-70f97007a392", "comment": "Malware payload (SnakeKeylogger)", "value": "d9c56afdd21d98fba1a17e13a160caccf549f9ff382b3970f06ada0e4b8a2bd3b747b0bd569ac634bdbb2e291e3da1b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700512, "uuid": "77727ed6-237e-40e4-b0a0-368f12b4c467", "value": "T1FAF4F62C3B055E62FC1D9530CD110BB9BB62AF83334199C6A7DF2BCA8B5E1B51D15C8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700512, "uuid": "4d1be480-4995-4deb-88e9-0ea359602220", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700512, "uuid": "16701e2b-fe38-4960-9139-f5cd5c4b4ab3", "value": "12288:tkdxCzqT3kX40lvqcSXUxBXOg6ugar+4zl2Uf5oR1NMw4qdVUxU3NS:tO30/ljeUbetugarzl2UfqM/6UYNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652700512, "uuid": "818ef223-3aa0-44ba-ba20-c38a93ad06e6", "value": 791040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652700512, "uuid": "d04ff580-1c7a-4afc-acd6-9eb842585187", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700512, "uuid": "0027698e-e828-47d5-90b7-94901594d5b1", "value": "NEW-ORDER Q701528501.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b000b89-d512-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652703401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703401, "uuid": "30acbe1c-92f5-4bec-9b55-52f1dcae0b10", "comment": "Malware payload", "value": "a52cf2d7f0513b576b3a9fb5c8e5d4b8", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703401, "uuid": "122272f5-1e58-4eb2-aace-52648a1d7e8b", "comment": "Malware payload", "value": "6b6e9286ad1f93c41eb2a0900e37780ff6bc0614cd5ad4551d38f7f529de883a", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703401, "uuid": "2ded958b-19e4-4e3b-a3b7-cf66a371c851", "comment": "Malware payload", "value": "a5fe5805971e54d4602ebdbea6d8368766a768f0", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703401, "uuid": "4bfc966c-8609-4d86-8074-14d0fd374bb2", "comment": "Malware payload", "value": "fd2c496db766914383acfe7549a4b700b32181cbb3b7aa8bac39e5f3ac97944973fac9f7e07c1dc74e771e3997bbc377", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703401, "uuid": "2dcaf330-d7b6-4718-85b9-c80ff950bd50", "value": "T1512412A13771489BF058C5BD66511A0595BAFD2ACF031B93D8B23B8B23374E36B5092F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703401, "uuid": "572190fb-f3fa-4af9-951b-4dab3b0ada53", "value": "6144:oI3BKNeNi2rQpTFaXbC+QJKyshirfmjsoL2zPQ:o0fvwsXbOshibmooLm4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703401, "uuid": "44320f16-9401-4028-90e5-e3d3d709e59b", "value": 228888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703401, "uuid": "ad968fd8-2f30-4530-8930-12f6dd150938", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703401, "uuid": "1adbaf99-82ad-4538-919d-d75300d6d79f", "value": "Swift copy.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65dcc299-d550-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1652730182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652730182, "uuid": "fa2b8bbd-9ba1-4c10-9966-f7e1e3aaf97d", "comment": "Malware payload (njrat)", "value": "59a9c407da68a4f315b44876873f72ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652730182, "uuid": "acc05adb-ed25-447e-8154-2092d30ef9b7", "comment": "Malware payload (njrat)", "value": "6b799f2474042886d8b3fccfe3dfd08a3d9e3c2dcf5c9ee7dd563f8ebd1e5f65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652730182, "uuid": "9a3f9b68-f664-4498-973d-2b392b764b20", "comment": "Malware payload (njrat)", "value": "ce29397d3322b53cd2e87f4315f2d1da1ee9f3dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652730182, "uuid": "f144cab5-3003-4ccf-bc94-a0051c36a453", "comment": "Malware payload (njrat)", "value": "b46ad5f1fcddcdfda83535e874205cca937adad1f261d1b3c53a95d73098667abada01be0e56589c49f7eecb4e775f63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652730182, "uuid": "dcc1f225-8db8-4d37-9d7e-31b76fdff8da", "value": "T10073D68CB694E174D5FF8BF1F4A1B2890B71A02BA906930F99F154D94B73EC09610EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652730182, "uuid": "25281e57-2f9a-43d7-a49d-99a8be10c552", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652730182, "uuid": "02901ad1-0cfd-4910-86ff-253e1a6d839f", "value": "384:4ZyI7Hn1iDcsyEqtN7e4KWSEJGcuEPzcIij+ZsNO3PlpJKkkjh/TzF7pWnEmgreL:ODHnU4pEqtVe4hmcLuXQ/oxq+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652730182, "uuid": "f9865c9d-2423-4cc9-9ac7-ea39d664cb78", "value": 73728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652730182, "uuid": "cff92231-d458-4d72-9f94-b2e7a2b3ff6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652730182, "uuid": "4681632b-3e81-4cf1-99a1-fde6b1a3d99b", "value": "59a9c407da68a4f315b44876873f72ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d704dc9-d51e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1652708612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708612, "uuid": "59da3f74-e0aa-4ab5-b8a0-4333fd9d4af0", "comment": "Malware payload (AveMariaRAT)", "value": "46bece0e0ae9b696619564b3407f2477", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708612, "uuid": "31cf56cb-f465-49b5-947c-b23d73871795", "comment": "Malware payload (AveMariaRAT)", "value": "6bb096fc82c51dc8f76ceaa0566b4410ad88acea20bcb2141cbac63dedae89bb", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708612, "uuid": "cfb5bb4a-4012-4282-b192-24111aec4da5", "comment": "Malware payload (AveMariaRAT)", "value": "5c926c5f7546afab1776fd16aa33e971c7ea97ad", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708612, "uuid": "57d26127-cd84-4d03-86f0-ade0e80d2de7", "comment": "Malware payload (AveMariaRAT)", "value": "b1ef07a5024d636a85081894dfbc5b285ca47cd8dc5d6fa02ef5558812e379e5a743c5d0a17034646d9846a7c36eb3c0", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708612, "uuid": "0dcb217f-d9ae-458c-af88-d745d3b0beb5", "value": "T128B4E0AC711476EFC8A7C4769A692CB4BA5034BB930B9213944761EEEE5C987CF140F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708612, "uuid": "c07aaab2-f6ae-4aef-b944-b6fba42809a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708612, "uuid": "cdd05a3b-13c0-45f5-86e8-78a15bf0dce7", "value": "12288:0ZWIB1/gC8lCcP7xY+zgxKOu3EvHTOWoFShQ6o86Q:0Z9/B8FlY+zqKjE7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652708612, "uuid": "90af8938-33b5-4ffd-b454-8542a05cefb9", "value": 506880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652708612, "uuid": "24d434cf-d3f8-490b-aaf2-db2cdc593384", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708612, "uuid": "de9d51d9-8e83-472f-98b6-4b767e09ed2a", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7ce44a-d4b3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652662821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662821, "uuid": "12f718c4-5f53-49ce-8a59-567c71747c1b", "comment": "Malware payload (Mirai)", "value": "3015a4c1a6f8fd417f4c418573a80254", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662821, "uuid": "6fa7f046-1547-4f2a-a559-a1d8f52eb1d9", "comment": "Malware payload (Mirai)", "value": "6c0031ab470e73dae3e4966ffd8ef35e459e175f399e3149cb52538646906422", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662821, "uuid": "ba9f4776-8674-4548-b289-c6704ffef41f", "comment": "Malware payload (Mirai)", "value": "216a3521a2258721dac4ae6dc8e3ae81f3a61487", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662821, "uuid": "410beb34-6d67-406b-b529-1e9c84464368", "comment": "Malware payload (Mirai)", "value": "0e5cd4328e44ea7008b0caf6a1565c38d0a4c47228721dd7dbeedd30995bc216a994ec85109bef9c3324d0dcdd092e7d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652662821, "uuid": "2e810a49-2579-41b6-a41e-61e7a263e2a7", "value": "T172338DA5C4B9ADE8D2148E74BD258E788763E100C6932EFEEE4486599047EFCF1583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652662821, "uuid": "c732f2c7-7019-47d1-b713-0e9b3f66db34", "value": "768:waIwqwtOZc5p3hnYep3v0Gldn/fAPs3g58cAlOSpE4rC/oIaNCy:wanqwtYdubxAPs3gvAlZpEyvLNCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652662821, "uuid": "dbeaf406-2fa9-4c99-b7ce-30112bf1db86", "value": 51072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652662821, "uuid": "23fa4350-dec0-447b-9f35-7e8c4d691bec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652662821, "uuid": "8b5f0f5b-0812-4b42-bdd0-7eccfce6c04b", "value": "3015a4c1a6f8fd417f4c418573a80254", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a289421-d501-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1652696313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696313, "uuid": "33a40b5e-6489-4019-a14f-e2064b9a99c7", "comment": "Malware payload (Quakbot)", "value": "4002cc6656ac7a0c0273e0bcd88db127", "object_relation": "md5", "Tag": [ { "name": "green-a-thon-com", "colour": "#E9E599", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696313, "uuid": "17c4ef02-947e-4e59-8f31-378763db463c", "comment": "Malware payload (Quakbot)", "value": "6c87a12dacfc22707b2c5d3e9a9de549398ab2caf959ace70b2f18a4d8498013", "object_relation": "sha256", "Tag": [ { "name": "green-a-thon-com", "colour": "#E9E599", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696313, "uuid": "1aafd1f7-af0e-4be2-818d-d6dbb49accb8", "comment": "Malware payload (Quakbot)", "value": "8f24b006fa39d27a7e3e5bb007adc483236764af", "object_relation": "sha1", "Tag": [ { "name": "green-a-thon-com", "colour": "#E9E599", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696313, "uuid": "4b26c30d-7931-41de-b9ac-dbf417adc887", "comment": "Malware payload (Quakbot)", "value": "4dad70a89b85ab9a892536513a335dd7a6b83ae072bc5b2c3de33a72e863f861b2268ef03e1e9ea2f2a0fc9fcdcef6ad", "object_relation": "sha3-384", "Tag": [ { "name": "green-a-thon-com", "colour": "#E9E599", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696313, "uuid": "2741b0ef-8934-4d41-a74f-9f989bcb5dfb", "value": "T14FE08071D034072CC9E84DAD7045F17798D3F118E101D265B62DD400DB1036FDFA4554", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696313, "uuid": "6eb5c957-19da-46f3-b500-a4a54df77ddb", "value": "3:I59eqNjMJJLNlFFDMfeAuWURKh2FHJAFBALTZHnuFIMFXACWTAEZHn3:IXe2jIn9Mfe8JiHrLTFuFIMFQCWFF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652696313, "uuid": "9e485980-48d3-4870-9094-e64d6d5dd4c0", "value": 437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652696313, "uuid": "38163a5e-03d5-4ca4-973a-2bf394a616f2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696313, "uuid": "116717df-96e7-4000-b021-c3cf8d3a5cc9", "value": "ps1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac03e951-d4f9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652692933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692933, "uuid": "8390b606-e331-4991-865b-5a706e0c6b70", "comment": "Malware payload (Heodo)", "value": "b7a0bba39338e3d7ac2739eea034bff5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692933, "uuid": "99580bba-676e-4cfc-9280-468b258089fa", "comment": "Malware payload (Heodo)", "value": "6d3b5ff68f132ece7f2a1de1a324c0433a6f31b46142c554cbc2497ba540dcdd", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692933, "uuid": "1a0db9ae-9a3f-4e40-877b-c198698df7a0", "comment": "Malware payload (Heodo)", "value": "753e461e6f9a3584c471dc36a996c8b43f88cf4b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692933, "uuid": "5e04a2af-d6b2-4128-b8e6-f028f58b9466", "comment": "Malware payload (Heodo)", "value": "d8accc7eae7ce65f732b84201ffcb8956edeac154f86e9b5e567e6c53ae6233ed277d08db39219132e1da2d2fe066ec1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692933, "uuid": "ee629aae-a094-49ed-9af5-0787de4480fd", "value": "T12B055A35FB6C8492C6A3953D88A34B06EE6AFE840B6183CB1290733E9E777D45C35671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692933, "uuid": "18393d35-6880-4161-86e0-615ba0261b5c", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692933, "uuid": "699ef5bb-8ca0-4151-bca0-2130a31106c3", "value": "12288:Q9983xmoz0/7aG8GkZHFT1YicDAXmvQaZsbNg:A9UcozAWGxGx16AWvVZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652692933, "uuid": "340cdf2f-becc-4233-b6d4-424cb10440a5", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652692933, "uuid": "e80799ff-bf5b-4670-a03c-b9a546f88436", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692933, "uuid": "b34f9492-7eb9-4276-b1b1-f5194b36a84e", "value": "b7a0bba39338e3d7ac2739eea034bff5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22bedbb8-d545-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652725345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652725345, "uuid": "dab2fa3f-7d7a-43ba-b228-8b62116b3738", "comment": "Malware payload", "value": "7b7a7efc35aa0aae4884657180499b90", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652725345, "uuid": "a907920d-668b-4c5a-b008-78f5b6d2d9b4", "comment": "Malware payload", "value": "6e0b0ebf0e009b9390e4d80d47e8ffc2e26bc4bd1b0c980a07e689decb8eb6d8", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652725345, "uuid": "696bf069-792b-4946-9f9c-53027be85631", "comment": "Malware payload", "value": "2606e6adcd9666ceb25b3e8a7b53b3cd9c6d87eb", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652725345, "uuid": "a420223b-4a6b-458a-9869-776ac6fe3ff8", "comment": "Malware payload", "value": "ce291a781e7a0692e24863f24c09a67fbc4e5e6299f2b0ffd1d4985da474235e20ed225610712c051d5bcbf252415b3f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652725345, "uuid": "7d8f3b24-2fb7-4aba-8e93-017abb1514e0", "value": "T1C5C53355FDC6E0B8DD8BD036D084C223E15E03CA914CF67B37A151ACD63BF85A62AD92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652725345, "uuid": "be206fa7-613c-45e5-9e2f-6bc0a5e2ea08", "value": "49152:gbnLTNvDtEjI9/i7I2X1yObUUt2TdhZldPh+okVPHYvnLwxpc:gzLTRtRa8mLbUUt4dhVPhpkVQTIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652725345, "uuid": "aaeafc4e-38b7-426a-b770-4a5fe4702aa1", "value": 2594293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652725345, "uuid": "c4e78975-594f-48a1-8adc-f823b1469a9e", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652725345, "uuid": "25506c06-76b6-4342-921d-4e058ad4a906", "value": "sana.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a0c59c-d4f9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652692688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692688, "uuid": "b928b6f7-5286-42b9-91d9-7abab3b29724", "comment": "Malware payload (Formbook)", "value": "571b43b45c6af7330dbd12563c93d358", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692688, "uuid": "a0a3d73e-6350-4f93-8ce3-23f3b0ec6552", "comment": "Malware payload (Formbook)", "value": "6e149a14c75c1665768edfaf236ec7b983a6a947b8170ac7b62831821a11cf2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692688, "uuid": "3932df00-0d6e-4e3c-9f77-cddb34465ea0", "comment": "Malware payload (Formbook)", "value": "62b021213c626e957103886fda4b7bc154c8ae49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692688, "uuid": "7e918597-2d16-4f61-9251-042e7dddf1fb", "comment": "Malware payload (Formbook)", "value": "4661b9ba3b38e8a6b739cae3227df2d805a4bc6216fd9767b72c2c26ecdf9cb71c8441eb232756f6fd1ab161272ef194", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692688, "uuid": "06b20113-27fe-43ed-ad15-5a0a1c14d778", "value": "T1F9C4BF31734C6B14E67EE77A0150814093F2D59FBF63D92EBDB7098E2909B0257B2A36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692688, "uuid": "d2058996-5819-4e64-83ce-2192df6215c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692688, "uuid": "678e02b4-916a-4800-8eb2-052a259cfaee", "value": "12288:zx3LAUh4BeY0cebi3tIDEwhJ8e6maEAVdgoaic:N396eY0cebidkE+7Edg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652692688, "uuid": "8a9c8b15-ade2-4723-b139-5f7c777181ee", "value": 546816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652692688, "uuid": "719ac524-6d21-4153-8570-d1e94386b3e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692688, "uuid": "6de78795-c160-44a9-876f-417ffc4e0487", "value": "SESINOKS List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef0c4591-d511-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652703354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703354, "uuid": "62cc1e07-15af-4743-9fcb-722220cbc11e", "comment": "Malware payload", "value": "e426c9b6d8a131a0ad811057379d3e02", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703354, "uuid": "da19a966-94c8-43da-8295-959dce9add92", "comment": "Malware payload", "value": "6e14c33b79a4ef7e4898c7ddf997e9223dcef2bcb76d4b20728152f4e8ff061d", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703354, "uuid": "9f56dc32-a4e5-40e8-9f46-8ea2b7c20f97", "comment": "Malware payload", "value": "1202c4fed13f342aa82ecbf6537528ad95630f45", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703354, "uuid": "a9f1c004-2204-4286-a3b4-f48cbf095194", "comment": "Malware payload", "value": "fdbaf951c18b6d07da5001370cab4c24b317b111663d396418d7d62338b06b9c281e3f61aed19eb1ce5ceb297e13d24f", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703354, "uuid": "2567f800-b194-4978-a59c-3236e632eb8e", "value": "T1C42412003FBCD108C0C66DFD941A972586F18D4AEA55FEB0484E7EDEB9B4978E97E410", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703354, "uuid": "e47c0e59-7d2a-4675-aa7b-437884ab15f2", "value": "6144:keJK0Zkz5Y9uOQsfRDiEpCGiYh0eMTripUR:kE10muOQsfnCFbvTwUR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703354, "uuid": "ed4e8e34-51c5-4b26-ad19-19b4c7169c90", "value": 229720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703354, "uuid": "4be6d656-2895-46c3-990f-a3e4672ad08e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703354, "uuid": "d8007df7-7a55-4cf5-961e-4f8af0efceb3", "value": "NAM9282550A .xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2099d296-d4b2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652662205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662205, "uuid": "7cab75ce-ebf2-45e5-90db-80d68faf3b8d", "comment": "Malware payload (Mirai)", "value": "f48a41d0652264a754336cd82d75e614", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662205, "uuid": "4bf7a347-f605-4cdf-ac17-1abe6b43dbbf", "comment": "Malware payload (Mirai)", "value": "6e40619492f4193c1043fbf6a37296caa1da692eae3f8c8d6e8523482b3fdfc0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662205, "uuid": "83980779-5d7e-4511-9ba6-39ac3bfb8ed3", "comment": "Malware payload (Mirai)", "value": "09c42e00894d891a79ba0467682e993c32d914d3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662205, "uuid": "2c1711fc-7939-4e6a-9f47-38e99db72678", "comment": "Malware payload (Mirai)", "value": "d6385de2b2a05937f1d9ab72eaca4ac0af9ba22adea1a17fbd88fed4bdac98ee2a3ed52f75e4f2bfc8003ce26799241a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652662205, "uuid": "b3183410-f3c2-46f8-8271-18082debb3fb", "value": "T187C33B42EA409B17C5D61777FE9F414A3322DB54A3DB330689285FF43F86A9E0E23606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652662205, "uuid": "65e80c9a-ede8-4cf3-8de7-151585c34c81", "value": "3072:tc/BCltndY5hLckPBrPDVpN+Gt4dmxoWM/9xM/:O/BCltnecErPDVpgGWmxjM/9xM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652662205, "uuid": "d3ef088a-8509-4228-8e91-0dc96cc3d07a", "value": 126644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652662205, "uuid": "42e4afd0-d512-4aca-bc40-5c705d47c68f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652662205, "uuid": "6fae7592-ba79-4cf6-a198-c1be419c8d18", "value": "TSL33T.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "561245e4-d569-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652740893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652740893, "uuid": "ba5f37a5-fc76-4b19-b0ea-a94d4d067d1d", "comment": "Malware payload", "value": "e6eee2972df6822aaffb71c7c0ddff23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652740893, "uuid": "2716f607-be92-4064-91e9-cfbc3873c89d", "comment": "Malware payload", "value": "6ebd150057515a94c922c3cdabec883c6425f2445cb0df33fe6e42923cb5f3bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652740893, "uuid": "84d83a71-cdf9-4ddd-9451-bc446e2172df", "comment": "Malware payload", "value": "6972d8e59e9e03ec89f7849532e0267c947cb1e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652740893, "uuid": "95ec0705-a16a-48a3-bf15-f406e881421a", "comment": "Malware payload", "value": "5581aef2e78f7af7fd216570a01f1f0b0f17fbd194c542d2b3b07b5e963b46113424090a3a5a6583081050fd3fd42a40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652740893, "uuid": "17b69fd9-30db-43b5-ba63-61994115d5bf", "value": "T10584C04573A48079EDB79338CC574A47E376B86907B0678F1364436A9F3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652740893, "uuid": "cd330026-9842-4780-9438-d9ff0dfb9bc1", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652740893, "uuid": "d6f65b76-7e0b-41bc-875d-88b5fa0dcac3", "value": "6144:EbmRW/X22TR72tKbxGeokesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/opRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652740893, "uuid": "1dd8a956-f52b-4697-8dc2-8bc04b651c0e", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652740893, "uuid": "b67ab740-5219-475d-a791-ca7a9ce882f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652740893, "uuid": "69e8c40e-7b0e-4f21-a611-4a5877b271fe", "value": "e6eee2972df6822aaffb71c7c0ddff23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52b96fbc-d505-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652697938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652697938, "uuid": "c2e212de-81bb-4bc1-bb79-06753b2e6b49", "comment": "Malware payload (RedLineStealer)", "value": "dc9d8e96671c61c5cb8de64efe469ebb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652697938, "uuid": "e7007bfa-be4a-468f-bce7-36ddb9942cac", "comment": "Malware payload (RedLineStealer)", "value": "6ec027055c0683fd0857340e20051a356f9def7f0ac7e6a3ceaf49152d498046", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652697938, "uuid": "a9b757c9-ea37-4dbc-a744-a50bb07bb257", "comment": "Malware payload (RedLineStealer)", "value": "7c817c5568c03140c43a0d31a1d2f0f711d11f5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652697938, "uuid": "30197b23-63dd-41ab-9b9a-a9156210ff29", "comment": "Malware payload (RedLineStealer)", "value": "d98fa32a99b52e3adc78e34af42c1fae539e2e7bbc7b63d767340b5a906992c4ade008a800f3f6d39a17956d1984cb72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652697938, "uuid": "7f1f516c-6639-4762-9118-a193cb8170df", "value": "T18A74F111B751C839D4A315740975E3B24E7F743226B8848BA7A233BC6F747C1AA7B31A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652697938, "uuid": "45d5c6b3-2c8f-416f-8b72-5b660f157ea8", "value": "7571adbe544c88b5f4f231486e74f9e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652697938, "uuid": "05866652-c8d0-40e4-aa15-efcee3f159a6", "value": "6144:rIGtDHOqtlH6le3cAwJooFQ0WwSHTO9QCNNx8BrT:sGtDhtlaU3cAwVRXVF8BX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652697938, "uuid": "7d19db24-9f6a-49f4-b641-9eba7b5de578", "value": 353280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652697938, "uuid": "049cbc31-d128-4813-b20d-3d42b45c471d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652697938, "uuid": "274bb2bd-1cf9-4761-8db3-fa5b4791276e", "value": "dc9d8e96671c61c5cb8de64efe469ebb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12c3f8d1-d4ca-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652672490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652672490, "uuid": "a4a7ff6e-d2f5-492b-973c-b1f3c1cd0694", "comment": "Malware payload (AgentTesla)", "value": "d9e209df65703fe2e2cf87595101519e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652672490, "uuid": "377f53bd-5f41-42a8-802d-b742f6cb3af8", "comment": "Malware payload (AgentTesla)", "value": "6fb4834a7c2a1258b1b1508a4c8449b00db7149dd2677bd4d9f150304a6b4068", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652672490, "uuid": "eeb4336c-21b7-4f5d-ba52-618fc5052f8f", "comment": "Malware payload (AgentTesla)", "value": "8577afb4a46c34e79f3acbffec1d6b8b07dffdf1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652672490, "uuid": "9eda171a-6c97-4f17-836a-5bd18e03088a", "comment": "Malware payload (AgentTesla)", "value": "ec90dd6126e5706fd3f15b806215afbde01f8f85414ca15dba891724502f71240a135add5017dce66d8548d8a2b71a6f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652672490, "uuid": "99772c8f-0a73-4467-b8d9-02f4ad6769db", "value": "T1BF826B1863D6C773D4BB4F3165E30A409A74E2386937470ED486123FCA1331A0A67B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652672490, "uuid": "21cb4309-f63b-42ee-8cf8-a21a62bfab2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652672490, "uuid": "e5626e74-fb71-4559-afa1-744abfb3d54a", "value": "384:zc5cYVMB+v6y3bLZdkjGjXcOyQSUaepk0OOyd3zhzY1:zfIM+X3brjMOtSUaq1LyJdz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652672490, "uuid": "a2fedaae-857a-409c-a234-5b85dce03bd0", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652672490, "uuid": "c2c97e64-898c-4907-b517-64bc74286d8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652672490, "uuid": "c8e0cb89-ec3f-47ee-9cd4-a9a816639bc4", "value": "d9e209df65703fe2e2cf87595101519e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cda7fd4-d4d0-11ec-8e58-42010a9c0032", "comment": "Malware payload (NetWire)", "timestamp": 1652675111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652675111, "uuid": "1bf1fc0c-a51d-4126-aaea-77e4e867da31", "comment": "Malware payload (NetWire)", "value": "4e4261e8f1a5e3a93b11b5f4d1e845c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652675111, "uuid": "2715204f-b0f1-40aa-a1c0-5151c6cfe768", "comment": "Malware payload (NetWire)", "value": "708a90c4f7fb24fd4218e156ea9063c4212a90ffa5b1237626c0912197741f01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652675111, "uuid": "9fc4475f-46a9-489b-8c83-8db78d4847bd", "comment": "Malware payload (NetWire)", "value": "0a3557ddd81dbfd6e2bf01610048e72796e11f65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652675111, "uuid": "e508b079-b8be-4bff-875a-dc020632dd9f", "comment": "Malware payload (NetWire)", "value": "ce3650b1357e26c29b0a2b0e580e88da4b6a2545606242df71590f630fb96270883be2220a573db3a85ec616b6bcbe0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652675111, "uuid": "f9355066-438c-4c75-aa5f-0b440cd8b0aa", "value": "T13A55AEC6F4A006FFC65620B0419D3B28376C9E60031589D79219BBDB64373D26BFDAAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652675111, "uuid": "8d5b7b05-a45d-4ff6-b74d-b2d92b0cd723", "value": "319ef0e1f809594c11253bdf131f5a3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652675111, "uuid": "c7dfd2f9-9bc5-4466-84c0-99d4164018d1", "value": "24576:Nsc8k63e6B92odyO5lys6vpTugTlunD8CUH3zS7gyEsH2k4QBb3Isa20yZ:uZO6B92ROL6hKgJiY3kEsWZm3If2dZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652675111, "uuid": "b988274b-01a5-4ad5-a33b-6e5b440a04e0", "value": 1336136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652675111, "uuid": "13fd3913-9c8a-486e-b1c8-7a3631e2121c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652675111, "uuid": "e409680e-7e2c-45db-916c-6a3d67fddd24", "value": "run1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cbc0754-d4ed-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652687646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687646, "uuid": "82eb39d5-b42b-421b-b127-5db31d341a5a", "comment": "Malware payload (Mirai)", "value": "c0383889ffa071249ba2a31999339458", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687646, "uuid": "05728b90-8d7e-4ab5-8fd7-3d586c2aaa18", "comment": "Malware payload (Mirai)", "value": "709570a2e7121fe9a3fede0bcee6dabf4553b43a3e934c8aa76d8610fcde5a35", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687646, "uuid": "eac7d338-06c6-4d80-97a7-8778494ce2fe", "comment": "Malware payload (Mirai)", "value": "a07cfdc6f9642da4eae77729ec4740a49943c9eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687646, "uuid": "deb52f77-7b05-4b94-b091-681653e85ea9", "comment": "Malware payload (Mirai)", "value": "11b90f8087e0a9ad153a9da1049f5870a6cfa518caac7a247339b45a9731a41b8cdade44c97019583e5cde80764716d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687646, "uuid": "1f518525-b4f0-4c29-b9f1-59ca67afb13d", "value": "T1AAD2E1946F11A4B1CBB05E7FF9398D457A49C6F8A0D63827120D056CB6FB20753BE183", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687646, "uuid": "f4f3386e-ba53-4731-a9a8-e5cf3da282f4", "value": "768:sDZazqvR3eW0TbL6w5yABfkQGZBgtY79q3UELdP:sDZazqZOfpDB0gqaLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652687646, "uuid": "778b452a-ce9b-4a10-b0b3-61ca41127021", "value": 28984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652687646, "uuid": "de532257-91bc-4f8b-b93e-44426aa4cf6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687646, "uuid": "01b2334e-2dfd-433b-80c0-baf2574cca5d", "value": "c0383889ffa071249ba2a31999339458", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c02b40c-d50b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652700584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700584, "uuid": "e68cf943-fdf5-45cd-8240-3388e3b7eecb", "comment": "Malware payload (SnakeKeylogger)", "value": "340af601667e5204a0391d8067e55854", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700584, "uuid": "aa16abf1-44ec-4596-9274-84078596590c", "comment": "Malware payload (SnakeKeylogger)", "value": "70a4fde5fed98777b972ece79b8c1d7afe5d278539220a743a86cd03e12dc07e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700584, "uuid": "149e4408-c396-4478-b81c-b0983e2f1c7d", "comment": "Malware payload (SnakeKeylogger)", "value": "ce226359e3cebe3abb4d419db86fdda79cf66330", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700584, "uuid": "800666d5-8f5b-42da-aa5b-186a8bf98eda", "comment": "Malware payload (SnakeKeylogger)", "value": "647b4ac4be10fe1472699f34f5b8f553e1160fc544daddb7f10f7f903459da013bf394dda99214304c4a6008f5c8416f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700584, "uuid": "8111236c-1087-4287-b4bc-ab27d1821aa9", "value": "T1A1057D50B2D8EED9E42A12B1C875C4F00371BE0AC5B5D60F29997D8E38B27436566F2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700584, "uuid": "2e67874f-3b6c-4d25-9d14-3377229df63d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700584, "uuid": "50bace24-cfe3-4af4-95bd-395393f29831", "value": "12288:agmzDfxt7J0cifuKlEHpyAyy/HcydMGil6zk123zvyc:aF2VfnaJyAdkyLb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652700584, "uuid": "43570950-b81c-40dd-be26-74a5ee13aaae", "value": 872448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652700584, "uuid": "7f3c0b0e-2ba0-4824-8bf7-858371b35355", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700584, "uuid": "ec9212aa-6944-43f2-9a27-b8d0464a645a", "value": "340af601667e5204a0391d8067e55854.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17e8fd76-d547-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652726186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652726186, "uuid": "55fa2f40-456d-4e0b-9b20-aba982a57094", "comment": "Malware payload (RedLineStealer)", "value": "8c02d37ad4005249499592c211174240", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652726186, "uuid": "95d6b1f2-b70f-4f8e-a1cf-b9687f0129b9", "comment": "Malware payload (RedLineStealer)", "value": "70d481c134cf716d3713f2bc8728d27e73c1a18da2ee389ad7aafdfde299553d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652726186, "uuid": "1cd43a33-ef3d-4c5d-85f6-39d5b76ac831", "comment": "Malware payload (RedLineStealer)", "value": "a49e843c70923b50efaec893678a3c3289829f43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652726186, "uuid": "f97909e9-f6fe-474b-83cd-0efc7226803a", "comment": "Malware payload (RedLineStealer)", "value": "c8b14f716b5dc294bc517b2d20e8753dfc26ba1688b48ffb1ac84de9903ec4dffbf9d50411a9260ff6de05758ad98be4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652726186, "uuid": "b17df2e1-ae11-4ef6-a96a-23179c2c7bb5", "value": "T15D94F112B7A08831D4A11E348875E7728B7BB8620634A547F79097AF0EB33C1DB7576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652726186, "uuid": "74fce430-c4da-4386-9b38-be7d3e9140d8", "value": "153dc3f428c35b5ce77e7e0eb3b25328", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652726186, "uuid": "2b592892-6ab4-4921-b92c-8a596d8abfa5", "value": "6144:07G8D7AnE0HP+ww9fFZgsVou3+y1m+SXWrb/GxiP6LJVy74TbOgNiga3wVfu:sG8DknE0HPJw9osT++SXWP18GcfOgwN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652726186, "uuid": "d987192f-6496-4797-b1ce-0838a050111f", "value": 441344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652726186, "uuid": "8e774361-a59e-4f8b-930a-e1f4178063f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652726186, "uuid": "12ef9566-53ff-4a7b-a3c2-e759fecc98bc", "value": "8c02d37ad4005249499592c211174240.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2af4b3e-d51b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652707655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707655, "uuid": "8e476141-2b96-4ac1-9bd8-4f811d796be0", "comment": "Malware payload", "value": "ce3925e61e2a7fae103cca93382a9964", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707655, "uuid": "4bdf9382-bbab-44e8-984e-492ed7ce3a21", "comment": "Malware payload", "value": "70f44801f243aa51acd17fcfe28297ecdc3ff997b6b6dc641e8e05bc0bf00054", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707655, "uuid": "55eaddce-5d8b-442b-bd07-0e4b352bf845", "comment": "Malware payload", "value": "cfb3a217f166c9970975f12923b326de9873b128", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707655, "uuid": "66fa1b39-50d6-43c3-8410-8cb0fda2a10d", "comment": "Malware payload", "value": "20dca81da1b23ba562e8fb0109ce053b3cf8bca12a573e6d6a3c68e20d02b80cf8cd04b8240c6f021c26e7021ed365c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707655, "uuid": "0fb34163-67f7-466e-b2f6-9999a23e14c3", "value": "T12E75121277E0C5BED5A643728EF94738E2B9FF705A70864F27C0E59D9D32A438829607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707655, "uuid": "e5caf25b-064e-440b-8df6-f4f46d2a3b2f", "value": "29d808dc584dcbbc14d2faf7a203584a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707655, "uuid": "5377c07e-1738-4f79-9274-574b950de01b", "value": "24576:nftQWIbcs9+mR3ahfuXNynSIBhpcKRp2xstRiI930xTA7rkF7pH150:fRrs9+mR3EuXJIBdz26tssGWrSNH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652707655, "uuid": "321fd8df-9dd2-4ffb-b7b3-0752d7665029", "value": 1617920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652707655, "uuid": "8da28e0c-0d73-4de5-822e-da44eee66a1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707655, "uuid": "5fe92b98-14cb-4b2c-af71-211cf77bd7bd", "value": "XCC06XCC06\u70b9\u51fb\u5b89\u88c5_\u7b80\u4f53\u4e2d\u6587\u8bed\u8a00\u530511.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3988f3c0-d53f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652722806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722806, "uuid": "30696276-65e9-4e79-9016-69087a725ec2", "comment": "Malware payload (Heodo)", "value": "d9685824cc799d97eec9fd2dcfea06ab", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722806, "uuid": "653b4380-a89e-410e-bd42-3a1a84271ea2", "comment": "Malware payload (Heodo)", "value": "7131dc780c744b8488bae6ca47b27c2e4b256f778d4e6e63c6206c5ac08c3746", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722806, "uuid": "355838d2-5ce5-407e-9a75-06ec95d13ef1", "comment": "Malware payload (Heodo)", "value": "6e167e06b4422b710e5b324ca7df53b3c9f6d4a7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722806, "uuid": "23b65d5a-4d7e-45cc-bace-b0b177d50f12", "comment": "Malware payload (Heodo)", "value": "d8a37c32c272f9fd90a0cef378fa6ccd54732bb8ddd5e23d8a086f8bb016796f581fe9dbaca99bfb013c2742c51d89d6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722806, "uuid": "60bd6dac-a01e-427b-8623-24a5d0eed462", "value": "T17884C04573A48079EDB79338CC574A47E376B86907B0678F1364436AAF3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722806, "uuid": "9512a6d9-8db6-4ccd-a9c2-d06cd31c0d63", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722806, "uuid": "b2b89680-541f-4654-87c9-e9ebef58a4c6", "value": "6144:EbmRW/X22TR72tKbxGeYkesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/YpRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652722806, "uuid": "069a1ec5-8253-4a1a-b048-8c59c9854d87", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652722806, "uuid": "c1305e81-38e1-4a77-a8a6-77ea8689009b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722806, "uuid": "d26aaeb8-ba4d-4027-8a08-8aed45ab48ed", "value": "d9685824cc799d97eec9fd2dcfea06ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f45873ec-d511-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652703363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703363, "uuid": "0cda1483-fdfb-4a74-9d55-893e88c0916f", "comment": "Malware payload (Loki)", "value": "c1b54707890d62a5b40e63302f70481a", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703363, "uuid": "b8ebabe2-06f2-4e2e-ab0e-dd9c156c7735", "comment": "Malware payload (Loki)", "value": "717adacae9f9e69f1b0415a4a873d8ad45b8ee6ac56b36eebd013c49a9d7c585", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703363, "uuid": "1f1fe18c-6f43-4ff9-a965-e4cb335579be", "comment": "Malware payload (Loki)", "value": "766fd41503100a4d2534092f7f240cbd2b22d113", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703363, "uuid": "2fa8121b-4cee-48be-8f1a-b928587cb1e3", "comment": "Malware payload (Loki)", "value": "0e63f1b2675a5bbfcc3d7225d898b57e1cd00d8dd3f49433d5d8e4caefcc7a5dd92c69977a3db970652f85a64c2e8d64", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703363, "uuid": "53997b98-0715-4ff0-908e-7268bd264ea7", "value": "T1052412BC73B41327EAEA3FB62636668E2991DE28F96E7CD203AD350D44F14D4B341548", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703363, "uuid": "93476b35-7128-4ac7-9142-dd44bf114a70", "value": "6144:UzgjTWD7s8BN5207KC7yQ/Fv+YXp6v0u8pd2zi:PjTgnx20HBdYvupd2zi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703363, "uuid": "4c7d26d1-596e-4ff9-999d-58bc74a29168", "value": 228936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703363, "uuid": "9901ee63-14a8-449e-8d7f-647eba360647", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703363, "uuid": "5d37e734-264b-4b3c-b6f5-eaab35d83b58", "value": "PO No Edan 009 & 0011.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d34ee5-d506-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1652698372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698372, "uuid": "63d94cc9-a2ef-4c97-8c76-e80b9c921d26", "comment": "Malware payload (SilentBuilder)", "value": "15e437f1d8c2d34a65d2f211a65ed26b", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698372, "uuid": "479b0c38-1220-4799-b39d-aaf407437e11", "comment": "Malware payload (SilentBuilder)", "value": "73b166eee35f544ab5032845f7f59f6639f3cf9e49b26aea9a2f616a5d1816d2", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698372, "uuid": "c066d34e-f33a-4c42-ab94-d11c18f1a495", "comment": "Malware payload (SilentBuilder)", "value": "d1f01eff7505998fc40bbb3728312d103d8e663b", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698372, "uuid": "3face125-5c1c-464b-bc39-19fbd0877bb4", "comment": "Malware payload (SilentBuilder)", "value": "86e5b851298e05f7fc7a6945b61871b33282826995b9aa24db9a1c82668182eba7dd0d52f55bd9dcd29311ae9fd2dba1", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698372, "uuid": "a0ac1e61-5061-4e8d-a853-67a46e0197c5", "value": "T1A5734A4AB98AC96CE615C739499743A9B313FC114FAB078B3109F3727FF49A05A0761B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698372, "uuid": "00eae7bb-6603-45bd-b7ef-be846392c37c", "value": "1536:tpKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg5AezwrMCtvJecvRtbTNFI:zKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652698372, "uuid": "ef692cfd-6a8d-4c52-8dfe-d45c7ae4bdfc", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652698372, "uuid": "57d3f6e6-91e8-47c5-8617-0a5f81287642", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698372, "uuid": "cd78f940-129b-413d-9a3b-90e63374fca5", "value": "MAIL_16052022.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fa460a2-d513-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652703999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703999, "uuid": "bcb6183d-592f-4206-b7de-efd9676a7d2e", "comment": "Malware payload (Loki)", "value": "d6b56e2ec1bc23d3b924c5589f25ee1b", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703999, "uuid": "4e96627f-1041-4584-8e38-51adb9e38c44", "comment": "Malware payload (Loki)", "value": "74a3a52867d9bd7ec4a041e44016b84261ff433653b9a90d80b44e8aa16e20fc", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703999, "uuid": "292ded43-48a4-4c00-88f8-fb1a18b877d1", "comment": "Malware payload (Loki)", "value": "ab1ef3c5701c26c1538fe49179e7d9573c4f87e2", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703999, "uuid": "e1343cbe-69b6-4e10-a08e-58aeee89069b", "comment": "Malware payload (Loki)", "value": "84502bb5ad3e84bbb06ca27da0c33391a11aafc43bb646df9809ebbfc1d80f744b3eb06e94055320d67d939dd88cf4d0", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703999, "uuid": "4bd34f3f-d184-4e2f-9d0a-6a74dedc6927", "value": "T1CC412839CEB5013BD2F3C739E4AEAE0195273946961D8E98008053D461B3146F5E6B2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703999, "uuid": "9e0e8d77-1279-4b89-b9cf-96362a6431f8", "value": "24:8O/BHYVKVWAz6o7tn++JplyYC4o0pMISUJcuDi2j+/E4I0aH39:8y5afoxdF+tUJ3rjAIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703999, "uuid": "cf5d56f1-ef02-4cd0-a2d2-f5f7b96f3246", "value": 2420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703999, "uuid": "11a4841d-35eb-4cd8-a858-1dc6069b0221", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703999, "uuid": "6d697d95-2115-4d86-ab10-5255a4432072", "value": "compra de orden.jpg.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c88e902-d518-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652706061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706061, "uuid": "50530793-ac23-48b1-b03b-666dcc5b3455", "comment": "Malware payload (Mirai)", "value": "ec7bb8c3ec5b1172a55404367c6ed679", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706061, "uuid": "3ee05c51-2ba2-4609-9ef8-c2f3887f0a8a", "comment": "Malware payload (Mirai)", "value": "74f302b0513d6c547cf54ca1825e4a31b5a4e93eacca088bde03cc2a1df24a6f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706061, "uuid": "153d9aa7-8409-4272-9117-b12318f68232", "comment": "Malware payload (Mirai)", "value": "4b016cb60da605e2d8ac6c57bbf150753bc3224b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706061, "uuid": "632a25a2-8e16-4770-a615-e3e4410cc332", "comment": "Malware payload (Mirai)", "value": "fb23ac8634b1f492b048c8f29e7c8127dbc63d0f530616ae1ea3e867f2f9b066692f73dd365d1b0fb25715966f98ff27", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706061, "uuid": "83a0f169-0df9-4653-aa16-e488b5a04b7d", "value": "T1FA735B4AE78BF9F0DD050678247BBB35D936A8323134DFF7E7D8B557A952202A04222C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706061, "uuid": "4e6d43c7-6ccb-4962-a016-ef0e087b48f0", "value": "1536:i7iq5f2Oas2QwdvyUpaRAPPNpT7J1S9Atf9s:i7t24wSRAPPNpT7JE929s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652706061, "uuid": "fd1c072c-2d86-4a98-8ad1-9cc1aa9f1c2a", "value": 74328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652706061, "uuid": "d2aa28bd-3f6b-40c5-992d-9ffd0e04a3d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706061, "uuid": "ac49051a-b812-4ee9-83b9-786df83e9645", "value": "ec7bb8c3ec5b1172a55404367c6ed679", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79cd52d9-d551-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652730645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652730645, "uuid": "47ca6905-218b-49f8-ad2f-1eb9d5054416", "comment": "Malware payload", "value": "c5a8c18d856a960eab339581c01d752c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652730645, "uuid": "dd011dbe-8cb9-442b-bf8e-ee4e381f527c", "comment": "Malware payload", "value": "7531bcbb7c97977edc17cb20cba271633aa0173bd26a614920194591242a0675", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652730645, "uuid": "43b233d2-8851-44a3-9b27-95d7dacbb5aa", "comment": "Malware payload", "value": "e22571fe92cb4e484e9618d7989130f6b0fac8e9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652730645, "uuid": "c758bfa8-e92d-4b0b-a68a-368418054789", "comment": "Malware payload", "value": "e49ca1af55375a31401a84c5092001d272fb6d98764d049a696b442cb96fee2196da641f1e5279d08cd8f57d72d8844c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652730645, "uuid": "5435174e-9a05-4e0c-8cbe-da83d8c0cc4f", "value": "T14FD4E0AC326072EFC85BC872DA995C78EA5070B7831B9217946755EDAE0CA97CF140F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652730645, "uuid": "74ca4d2d-6d2c-46fa-ae2c-46d06de70f23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652730645, "uuid": "113375f1-0334-4bf8-a942-d8b2707011d6", "value": "12288:LmDvXM/wrRb22c4BuFlTF9Sf2+YQ5mneTZ8EzheQogXfuzuKT7we+P6Q:LmY/oF22cz3e23QeyPVvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652730645, "uuid": "1c558607-d063-4ac7-83ec-8bf136786bde", "value": 615936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652730645, "uuid": "a28cd88c-f5ef-4802-bb1a-7ac19532a58e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652730645, "uuid": "00735ea2-83fb-44ea-974c-dfc52bc0c26a", "value": "Purchase Order MRQ-5525.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59455eef-d546-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652725866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652725866, "uuid": "f2fa6f20-414f-40cc-b05c-f4048c217a98", "comment": "Malware payload", "value": "576287b42c9454a5380c8751472e7955", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652725866, "uuid": "65051cd3-b665-4b8e-a873-f480808ed9b9", "comment": "Malware payload", "value": "75a24921a24cc348997602a4ce9a172d85d7bb9ba489d51698e7ebf7d0ff5c53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652725866, "uuid": "65622897-e449-4664-a959-a7d0d5bfc2b0", "comment": "Malware payload", "value": "19ea07f61a172d7653a51f0d8f2f872ebea7d074", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652725866, "uuid": "d08f35fc-b09b-43b4-ae7e-4b8a082b4581", "comment": "Malware payload", "value": "65fc4dfa9971c83725333037c06d408ad59b4c46e374a58aaa3d09da4c5cde9b8636f6d91f7fd6e7092347fb51841f19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652725866, "uuid": "8052ab6c-4cac-4709-8502-9f1762295c57", "value": "T19784C04573A48079EDB79338CC574A47E376B86907B0678F1364436A9F3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652725866, "uuid": "0d5417ff-bde6-4447-974b-1698291d69cc", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652725866, "uuid": "4e3e2845-b7b0-42a8-b025-dc899893d287", "value": "6144:EbmRW/X22TR72tKbxGePkesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/PpRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652725866, "uuid": "c14d21bb-8081-4497-b0a6-5a6c4892c7f5", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652725866, "uuid": "481443cd-533b-4f37-a497-a2aa122bf487", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652725866, "uuid": "395fdd69-9070-479c-a929-06c025c83563", "value": "576287b42c9454a5380c8751472e7955", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "746b66be-d50b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652700571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700571, "uuid": "af7375c7-9942-4298-921f-183f63249124", "comment": "Malware payload (SnakeKeylogger)", "value": "a29774dfb50d273c9bb67f64e074132d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700571, "uuid": "a724a380-3424-47cd-b492-e9a1346f0098", "comment": "Malware payload (SnakeKeylogger)", "value": "75c337844d5ddcf92463d4ab13746e20ba16a1364cd64a479e0bcd0a9dac672f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700571, "uuid": "b091baa6-5bca-4780-824c-4b01e9bb25a5", "comment": "Malware payload (SnakeKeylogger)", "value": "2840edbfa742ae550cf71eb0885174e2205a4f0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700571, "uuid": "64a6b453-4f22-4157-99d5-38fa8568f271", "comment": "Malware payload (SnakeKeylogger)", "value": "331259b8e38d5cc2c87e8eab7a062367176535c8a793520866d6faaf9ead32e4d509b2a56107102068b696b177864b70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700571, "uuid": "0368a7a5-aa72-45d7-8e8e-0dd19bf40221", "value": "T198B37D251AEF9D0AC1923B7E49E0F33851E6CED17427DA12C9F1AE0BF925785AF811C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700571, "uuid": "5184425a-71f4-4d59-b8a0-ca1a2ab165bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700571, "uuid": "2e06c07e-dfd5-405e-b9c2-882e134fcd02", "value": "3072:f/qDlHOuTD+8vGY2vVD8p//vPEKlCFRs+pqIlD:f3DwyMvPY7s+qu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652700571, "uuid": "0484ac6f-3853-4b61-8e94-b1e77f2b3e72", "value": 112640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652700571, "uuid": "2057b8c5-fb06-4f5a-93c7-6d1465583bbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700571, "uuid": "7199c991-606d-4596-b3f8-25b53ec30af2", "value": "a29774dfb50d273c9bb67f64e074132d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d8503ce-d522-11ec-8e58-42010a9c0032", "comment": "Malware payload (N-W0rm)", "timestamp": 1652710277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710277, "uuid": "5d7920eb-8bb0-4286-8c20-6385c3fa5aa5", "comment": "Malware payload (N-W0rm)", "value": "a68bfb9d0d305a910b988acac959accf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710277, "uuid": "edbc7f2f-3ef2-43b1-88e1-da893505c59e", "comment": "Malware payload (N-W0rm)", "value": "76045fcd320db3ea6a99ec1ee238471f7098cc4740a4391c8eafcceec91a60d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710277, "uuid": "84dfbcf5-8fe7-4c3f-bb52-a59a06c370ba", "comment": "Malware payload (N-W0rm)", "value": "ca04321138ab7e5104d84763cde77b1d5b29bb87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710277, "uuid": "3a84c678-dc38-490b-81b0-4bb9c505b52f", "comment": "Malware payload (N-W0rm)", "value": "9ce3c3f6dfe2999c8beb8c622b0bf1ce2ca987129be5e9a6cd039e42f9d4216c37fc2a5828f03f2c6a4c3135dd02959a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652710277, "uuid": "9f40b326-8a3c-441c-8bc3-3d39617a3615", "value": "T1BB73E1085DDEAA7BD10C437C809BD3411BB4DD676006E3FB769034992D817A91C636BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652710277, "uuid": "0eccff4f-f378-40e3-b543-67330b18e2f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652710277, "uuid": "7568609d-8a90-4205-945a-fa55be4ac6f5", "value": "768:Pi4pkmhcHaIiyOYZQ8gUJnMycpAl3sm3r9+g6wz8EwZr2gmGm1Nba66YmMGBGWG6:aCgiMVgGDIABsmKdd24IH6RUWGLsUPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652710277, "uuid": "9601d31b-1181-4de6-8c82-12dd8e67c433", "value": 73728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652710277, "uuid": "3cac4767-a7dc-4718-9021-52d217d5a2e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652710277, "uuid": "8f6792af-8614-4833-81e2-32f8ae921ccd", "value": "a68bfb9d0d305a910b988acac959accf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7512f6f7-d4e0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652682104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682104, "uuid": "734c2ab2-7986-49e4-a8d7-ba68305d9137", "comment": "Malware payload (Mirai)", "value": "07f1b3d46114c7d8be4c607281a84924", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682104, "uuid": "69580fa9-03d1-42da-b6be-bc1639fd47d2", "comment": "Malware payload (Mirai)", "value": "76e6abae7e898fb346c44febdef1b6fb338bf46f95ec4d2fc88d68c267a8b197", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682104, "uuid": "86d7aebe-984b-40f3-8ceb-33df15e6199f", "comment": "Malware payload (Mirai)", "value": "5aeaa70bbed84a81b54276470fdcc67ee3f9e727", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682104, "uuid": "2a3ef4f0-b55e-4371-96e6-53c1ffeead1b", "comment": "Malware payload (Mirai)", "value": "59d26a9c1e2af8e1564a059e20d8bd2de029380863a2f86e47081d91c6d17137eea5484a03f6596dce7e77e94ce76e00", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682104, "uuid": "02980e7a-bf8d-48d3-ad5d-57dc6b15f058", "value": "T1F94302C2516B4CE984019A390C488EC8A7CE9DE1C0FB62731B5480F58B89CD7E9B19FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682104, "uuid": "411151a6-bd47-4740-8a7d-ab171734c15d", "value": "1536:SUNmgAZrH233p8jAnxdLFIYsEy5tD6ytA+bJ:S81urHip88LqhuX+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652682104, "uuid": "0944ae40-a008-4bf8-81f4-85d27cfe856c", "value": 57984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652682104, "uuid": "4932e404-9030-4a65-bcaa-11415a135c3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682104, "uuid": "22a3719f-a628-4b95-91b8-fd621ebcb8c6", "value": "07f1b3d46114c7d8be4c607281a84924", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d068e69-d4f9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652692694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692694, "uuid": "9375c646-7462-4828-abf2-a677c80ab63c", "comment": "Malware payload (Formbook)", "value": "81be20d2384f9007103747b1d1cd5e3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692694, "uuid": "6c073095-3255-45a1-a24e-c17b5496cd24", "comment": "Malware payload (Formbook)", "value": "7742139fb0f3ddbfa59f16f86945fd1e77a9cf381255f2e792d19a22d0ad9b7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692694, "uuid": "d934a4d7-54ea-430b-86d9-d49d23db8747", "comment": "Malware payload (Formbook)", "value": "1c2e173a04e134aba21d98cf36f252c0055c93ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692694, "uuid": "fc7cd149-219a-470e-9899-4e0a9fd04f48", "comment": "Malware payload (Formbook)", "value": "67cffb6a0620715de49aa07efa141320a6bea70926bf99d678993cf2c2f1e4b3748ca4cde823ca3a0731ce698010f1c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692694, "uuid": "5704b426-098e-4d3a-826d-66ffea3dd2ad", "value": "T11094DF81D5C046A5EC6A073066374C3A1A67BFBDBCF8E94E961DB4B467B32D35027A03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692694, "uuid": "611258b0-cb38-4173-b360-7b0788747ba4", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692694, "uuid": "ff6fba83-ad99-43a1-a8af-40a88f802d6f", "value": "6144:iYa60taTfJ1PJPkCA6V4iAckqpAqlswFag2jlsSgLs9A61Y5S:iY+abPJ9A6izHbVwqb8s9AHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652692694, "uuid": "1a597dc2-641b-4d76-9759-72de4bdd638d", "value": 410102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652692694, "uuid": "5fae37ae-f0d8-486f-affd-d063d04824d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692694, "uuid": "514adc3f-4feb-43d2-b02d-7dd25007ee69", "value": "two_salary.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34cad433-d516-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652705189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705189, "uuid": "16b2f6d9-6a55-4ae6-8ecb-2c66e1f72b8c", "comment": "Malware payload (Loki)", "value": "62a3e5d4ed5c3edf4f5b2aa432511a84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705189, "uuid": "63910d6d-5785-4fda-96da-332d99c2a626", "comment": "Malware payload (Loki)", "value": "780e7d5477ad9a5ac1e3254a8741fffc7a3274be0e0c986aca2c5438c7ecede7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705189, "uuid": "a430443f-0cbd-4e42-b328-30587fbed151", "comment": "Malware payload (Loki)", "value": "05a066b53dad076bb488146c3e141337f005d57c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705189, "uuid": "d204e297-c038-43b8-97b7-ade491cf49e3", "comment": "Malware payload (Loki)", "value": "ab5da2bc8387e943c1a9b3ad3078ccea52800a35665234d233717058c956dcbd75b16b4c36bb58488eda54a0dda43971", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705189, "uuid": "1245d07b-9d51-473a-b223-363543409b22", "value": "T143F30118B2D4C4A7DCE307713E3A853A6EB9E41E0435D68F27A06E25BD33582D91FB52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705189, "uuid": "9df5212b-fcfb-40c8-b35b-7fde669d64bd", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705189, "uuid": "fe3df049-dd8b-4a87-88b8-671b23579e2c", "value": "3072:VfY/TU9fE9PEtunbz3TAZU3NDpXbbKLf+g71K1251rN2hvpmjMM:ZYa6Vz3TMUdDpXbbpg70Yx2Sj3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652705189, "uuid": "97a09596-a5dd-40c5-81f5-5c2fe416c549", "value": 159651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652705189, "uuid": "58adeea3-9641-4d73-84d2-3ae082eff334", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705189, "uuid": "14da8584-e0fc-49b5-9f61-5c8279153b81", "value": "62a3e5d4ed5c3edf4f5b2aa432511a84.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7107df75-d4fe-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652694982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652694982, "uuid": "be4789fa-c8e4-40db-b42d-a426342a08d5", "comment": "Malware payload (Heodo)", "value": "35b585a5d17d68ce0ec16c59dee32a6d", "object_relation": "md5", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "pw cm2FrCxH", "colour": "#3ED7F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652694982, "uuid": "7737f469-cb98-4065-b167-9c6db402c10b", "comment": "Malware payload (Heodo)", "value": "78a7f0a26d5cb1b13b6dc67fdc247fa0f173564651d434ed4c17cdecb7dff561", "object_relation": "sha256", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "pw cm2FrCxH", "colour": "#3ED7F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652694982, "uuid": "4a278fc6-9f80-40c1-a799-d762d9a1b15a", "comment": "Malware payload (Heodo)", "value": "5a22b9c71adebc2f802401ce1ba70c3af54bc13b", "object_relation": "sha1", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "pw cm2FrCxH", "colour": "#3ED7F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652694982, "uuid": "d6389632-9463-49c7-b2ce-2861a31c0ee6", "comment": "Malware payload (Heodo)", "value": "750e81c3fdbd1c4c9884a3bd04b4e6adf621221e77e7e592d94f8d4ce774a7f5dbe418d5135f6767693f08a52f97da4b", "object_relation": "sha3-384", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "pw cm2FrCxH", "colour": "#3ED7F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652694982, "uuid": "30d05a48-426d-423e-a312-5d9935d2ad9c", "value": "T120517C382EDE1129F5F3AFB16DD869D5DEAAB6B375018D5E0082034A4952A40ED82D3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652694982, "uuid": "42641a58-a412-4a9c-9de9-c32616306083", "value": "48:8mY6xU8cxm7XLXjYgzUmdNA3O4b2dt6BKRv4eq4ab:8mdOUZ1NoO4b2HyKRgT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652694982, "uuid": "b2a17b42-094f-45ab-830d-da01edd4b5f9", "value": 2672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652694982, "uuid": "7c16f653-2ddf-4802-b5d2-3f25aa8cd9e3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652694982, "uuid": "5df142d0-2f55-4b92-9b21-eaf4bea6509f", "value": "Fattura n. 8139557 del 16.05.2022 lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f88f71d6-d4fe-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652695209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652695209, "uuid": "4c8e3cbc-08a7-447b-bc76-5d3efd585785", "comment": "Malware payload (Heodo)", "value": "62c5f8e080d304289186db9ac89b49ae", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652695209, "uuid": "d8c62db5-64f6-464e-aa6e-71414d4c9411", "comment": "Malware payload (Heodo)", "value": "78f1e4bd9fa6dab2b9bbe593ac2cce9edf541d03c878e2cbd7e5780ca4ff6567", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652695209, "uuid": "240b4df9-4852-48ee-8b21-5f97bc0c57df", "comment": "Malware payload (Heodo)", "value": "86f9d88dc1d25f7ce3d8a0efd251aec3b7ed447d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652695209, "uuid": "e5f16cc3-b735-4440-add8-837049572df7", "comment": "Malware payload (Heodo)", "value": "f7223f6ec6605bcf2aaa98707e3055651d3f142eda6ed1481f2d02f996dd1a8fa1f65a77046c85a7997ea81ebcce91f1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652695209, "uuid": "c3dbbf87-688a-461d-afc4-813680d1f9d2", "value": "T123055A35FB6C8492C6A3953D88A34B06EE6AFE840B6183CB1290733E9E777D45C35671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652695209, "uuid": "c434cd1c-97cf-4412-80d8-57e0135bd613", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652695209, "uuid": "5e209306-6f23-4527-bf28-7d23fa48aac9", "value": "12288:Q9983x+oz0/7aG8GkZHFT1YicDAXmvQaZsbNg:A9U4ozAWGxGx16AWvVZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652695209, "uuid": "b667f56e-a6f6-4568-8670-585e40a73702", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652695209, "uuid": "1f8ed1a5-4af9-4980-8488-bf399eea6b53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652695209, "uuid": "ef070ea2-f2aa-4b60-9061-d01b80fdf8bc", "value": "PMnki.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2452a6e-d52f-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1652716164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716164, "uuid": "1f4b47af-e196-4b1a-9233-f02538273349", "comment": "Malware payload (SilentBuilder)", "value": "e0012f1a56d608571d7a14fa434916be", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716164, "uuid": "af13bd97-dcdb-4267-a1b3-dcd7b4fd8a8f", "comment": "Malware payload (SilentBuilder)", "value": "78fc6e02ed8b715bf93cbcbfcc6c663341e772e15bea06ec44a6e79404d0cb6b", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716164, "uuid": "9e9861f8-6d7c-43c1-8b74-7b1d400e6d36", "comment": "Malware payload (SilentBuilder)", "value": "fef1fb5ed3f4399cc62a42ecf015a849bd1be827", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716164, "uuid": "2d348906-6ca6-4409-8b8e-0fad0e9e8ace", "comment": "Malware payload (SilentBuilder)", "value": "669f25bad7b266159ced0a2d6de1312a16ee55b29572b988f2c5c007993ad7fda0ee46adc641368e3be00ef1866d0b4f", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716164, "uuid": "905503e0-6be7-472b-b039-4c5ed5f6e745", "value": "T1F6734A4AB98AC96CE615C739499743A9B313FC114FAB078B3109F3727FF49A05A0761B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716164, "uuid": "f9ce5bb0-5405-4304-8c3c-749fb27e5683", "value": "1536:tpKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg5AezwrMCtvJecvRtbTNFM:zKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652716164, "uuid": "90a89bdd-4467-44ba-ba7e-1612c73544d8", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652716164, "uuid": "a74e6f76-e12f-4444-b479-0fe3a776584c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716164, "uuid": "fe193699-8469-4dfd-9696-d90377c35fb1", "value": "allegato 1605.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "930a443e-d4f2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652689885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689885, "uuid": "f8ea7ac6-94a2-4142-ae26-9a1bfc27ec3c", "comment": "Malware payload", "value": "ae9e458d8f85020fb71906c1e7434b95", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689885, "uuid": "a7ab39e0-82d3-4f2e-bede-8a749c7c05f3", "comment": "Malware payload", "value": "795da586390233720c1220d563439b17af5bb1c02cfdb030dfc12898a98f34ff", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689885, "uuid": "10aaff66-01c8-4a4a-b96e-972f065006bc", "comment": "Malware payload", "value": "14f0fdb069bf0b89d7a4614b8fb54d0581cbf9a3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689885, "uuid": "916638f3-de46-42a0-bc25-a00404a92e0e", "comment": "Malware payload", "value": "c1efe4007a3fd997d37b355afb643517e66c79b78aef2bc46e65060d94227ead85a8c61b9b29b23a994f5ef5188730fb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689885, "uuid": "37cdbb5a-1794-4ca6-91d8-858a100eca48", "value": "T1768108B9925C09A3EB2C4BE3E20C7C5E8C50F107D1DB1445B3BDFEB1032B9D6691A55A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689885, "uuid": "796a1343-cff4-4d11-bd45-582c9b09ee4d", "value": "96:+21Us/WuxEPq5ON/0YeKTwVu9YiBqGe+xQi+IzRFhAcpt:ta4WuxEPq5KcYjPBRPxQiBhzpt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652689885, "uuid": "4bd03353-8fc0-40a1-9691-fbd3315289f7", "value": 4044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652689885, "uuid": "2d84ef74-0282-453a-9d20-61304e47a772", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689885, "uuid": "23beba50-3e78-40ba-b112-f701abbe03a7", "value": "Updated Quotation Offer QM 102-5+L | PP LION.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceddc16e-d50b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Vjw0rm)", "timestamp": 1652700723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700723, "uuid": "c11aebbf-d8e1-4ccd-9564-515b6c152b0a", "comment": "Malware payload (Vjw0rm)", "value": "dc79f798365ff9d078fc62deeb6af93c", "object_relation": "md5", "Tag": [ { "name": "DESKTOP-group", "colour": "#6DA2CC", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false }, { "name": "vjWorm", "colour": "#C8DD21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700723, "uuid": "bccae996-788d-4a0e-a2e8-908c66692259", "comment": "Malware payload (Vjw0rm)", "value": "7972d3a4d5b4f89c6ee1d91b0775165329e83dfbc778790d07f926695b52f738", "object_relation": "sha256", "Tag": [ { "name": "DESKTOP-group", "colour": "#6DA2CC", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false }, { "name": "vjWorm", "colour": "#C8DD21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700723, "uuid": "d5128f29-79cd-431f-9e6d-2318b99aa273", "comment": "Malware payload (Vjw0rm)", "value": "99b202015670e9561c561216d3d323369aef619c", "object_relation": "sha1", "Tag": [ { "name": "DESKTOP-group", "colour": "#6DA2CC", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false }, { "name": "vjWorm", "colour": "#C8DD21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700723, "uuid": "37f684e6-44dd-4dab-91fa-6372089da512", "comment": "Malware payload (Vjw0rm)", "value": "21c8048744fb45ce2b56052a48df73749a51ff62a5bb15a48c4ff3eb6d57c6435832b01202da8c79aa4cb47239a9efe8", "object_relation": "sha3-384", "Tag": [ { "name": "DESKTOP-group", "colour": "#6DA2CC", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false }, { "name": "vjWorm", "colour": "#C8DD21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700723, "uuid": "31611485-403b-4d16-9b78-fd06315d1d89", "value": "T12A95C98A2744C891D85BEFFF7E31F1E0E0197DCAC7C12999F754B43CE888525AA88791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700723, "uuid": "8e8d91f1-cbb8-40c8-8af9-9cd4204ce6b5", "value": "12288:U3385KklV3cF+lf1ok9pewx2K/YHI6xbmetdWcTa7rSlq3CmL3TAeVK/V1UlOgs7:6+d1l4dwyIplqeQw4a2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652700723, "uuid": "25c1ae38-a8fe-46cb-9de9-026c1b0c749d", "value": 2032889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652700723, "uuid": "82c9481f-2e2d-4d2f-8d5f-3618a79fe660", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700723, "uuid": "a843d21e-e351-489d-84fd-d968c9519b09", "value": "SOLDES MVTS INT CAISSES.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "527aad24-d51b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652707386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707386, "uuid": "a56cf4e1-cf37-444f-a4f1-ecb80f133f54", "comment": "Malware payload (Loki)", "value": "c8754f2afbf6eb4611e54fae8dace9aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707386, "uuid": "6c6ceacc-9f12-47de-8c0c-a8c463936d0b", "comment": "Malware payload (Loki)", "value": "7aff91d1c7793540c5f041eabe6611d0c6882e8d152db95c9302102dd4514e87", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707386, "uuid": "e64dd608-7782-44d2-8080-16791f7084a5", "comment": "Malware payload (Loki)", "value": "f2d1d02340c186d83a7418bf19d43f429234e72b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707386, "uuid": "9fd1d1a6-e886-4d8c-aa2e-f66a2db6e936", "comment": "Malware payload (Loki)", "value": "1f725d5338b3be5700d02d6b20e67781a52ee2a9cbe2b387ef658a57f1d61ca477af9b8df57789b6bdee42859d38a498", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707386, "uuid": "b67f67af-518b-49fe-a98c-06530ebce000", "value": "T18AA4134467F88362F2BE2BB0B57B016006F5F5514AA3D26D1E86D0B60D36F88CF6176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707386, "uuid": "5d6d82d8-1044-4fe6-bf12-ef8e9fc933d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707386, "uuid": "79b382c8-56d6-4146-ad9b-ffaec0f2c8e1", "value": "12288:PK9th+FzQSqg8Za7Mrr+GW9XfqpJRJonYbgMEzfR:cUQBs+SGK+JRJzEMm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652707386, "uuid": "6080c59d-da7b-470b-b940-153c6364d082", "value": 455168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652707386, "uuid": "4888a7fc-e2c5-4bc1-b0cb-63469db8d1d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707386, "uuid": "80f61e1f-7412-4ebc-affb-e0a99ff0b759", "value": "c8754f2afbf6eb4611e54fae8dace9aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79939f4e-d504-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1652697573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652697573, "uuid": "78f6371a-d1e2-409e-ade1-8425b112928a", "comment": "Malware payload (Quakbot)", "value": "2485ba570d09cfa09e268b4368fd37f5", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652697573, "uuid": "597c593c-e7df-4dc9-8ca5-6719e697c6db", "comment": "Malware payload (Quakbot)", "value": "7b265f068c1485a453d3ab7ad30bc1709760d5162fa641fd4996947b4d642f96", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652697573, "uuid": "0c508b66-4cb8-4903-88d9-07d676d30f4b", "comment": "Malware payload (Quakbot)", "value": "c41feb509aba6f702e2ec5d0955b85090f135208", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652697573, "uuid": "b9cd0317-c5e8-47ab-8850-37f921053374", "comment": "Malware payload (Quakbot)", "value": "944b9d3c2f74452fc82a0bd131ff6d54daa53e57bf5183d69d219b487b863e6e4ce5e04ec961e7eba1b93862e6a2f9ef", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652697573, "uuid": "ab3c456f-9144-491f-b03d-c3eb565cd106", "value": "T179F4AF22E3D04C77C1772A789C2B7768A839BE112D7899C72BE42D4C4F3569136362B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652697573, "uuid": "5b72a0da-23c8-4ae1-bcaf-27e4b67b6593", "value": "df2c97204ed982b8b3e7393fd2a71059", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652697573, "uuid": "a0258edb-086d-4395-a313-b43c1bf1f361", "value": "12288:lD25c7bMl3XyN6VqX1bFJf44pnlG2LniES2DY0HfyHHsPNfvZRzsvBn:98Aw3CowXrJf44pnw2Ln1jY0HaHHsPNw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652697573, "uuid": "b7443c54-51cc-4bcd-801e-1fcba1d86442", "value": 726727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652697573, "uuid": "543c6f1a-60a5-482c-b0dd-5fe3d4cdbbae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652697573, "uuid": "c68feb50-433f-4b31-8ca2-b9dcdfa298ae", "value": "7b265f068c1485a453d3ab7ad30bc1709760d5162fa641fd4996947b4d642f96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13461fbc-d4f9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652692677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692677, "uuid": "3817769e-79b3-4133-ad83-c08b2b23d602", "comment": "Malware payload (Formbook)", "value": "82eadc3f910bab1b63e667423980eae9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692677, "uuid": "bcc3af1d-91ca-424e-ae7b-6b5c9e8afecf", "comment": "Malware payload (Formbook)", "value": "7ba9e2fe1065194e83229074e0a54f98952bcd640582fc3453967cf189dbe583", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692677, "uuid": "b821fbbf-2e02-4272-afdf-5973e3ec7bf5", "comment": "Malware payload (Formbook)", "value": "d1574c8045c104aea3134067c703a8215f6bc79f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692677, "uuid": "008a4ee7-276e-45bb-b607-6617368e93fa", "comment": "Malware payload (Formbook)", "value": "4bb45115b1e00b630b20d5b83c9d80a1e4efd968f320d0468d75e07adfc1b2c6ee1a58e9c16e5ade87e9dfaed55a7cd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692677, "uuid": "e4778a0c-3fe3-4207-8c16-2d4d97b17d24", "value": "T163F4C598311875DEF76FC471CDA55C68A7E2746E432B4132A053E7B9AF0C9B3DE060A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692677, "uuid": "e53f5501-48a1-4517-bdff-785706b8f2b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692677, "uuid": "6eb3f951-3715-49e2-8629-625519c98a74", "value": "12288:cQNsKVDhwm2HDPPWJoWmEUZxyguGTA2tNSni4TTBFS5gZe+Czm/2YGERZr2Rs7PO:dDVCHDP/7+2tNLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652692677, "uuid": "ff5aa8d8-317d-4bcc-9afe-0815298267e3", "value": 760832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652692677, "uuid": "71158126-e0de-4d9d-a0be-df3dc92a2db9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692677, "uuid": "c2066c2c-cd03-439e-9721-f7e3971db557", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "193e9116-d506-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652698271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698271, "uuid": "6c3bcbe0-7e47-4846-a6f2-74c2ce7fb46f", "comment": "Malware payload (AgentTesla)", "value": "0bef74936e070cb5c0dc09098a37454b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698271, "uuid": "90b677e0-a2d9-4f57-8717-fd3c7be8fcbd", "comment": "Malware payload (AgentTesla)", "value": "7c995e143ae79e393513d3d3af5a2f86ea154ed96fa585ac98aa88838fb505ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698271, "uuid": "2e7a8d0e-5242-42a8-b2c1-338731b63650", "comment": "Malware payload (AgentTesla)", "value": "cf6970d30f67934bd837462465435d6b233156e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698271, "uuid": "3fb7ced7-931c-4386-af58-e47e68db4fde", "comment": "Malware payload (AgentTesla)", "value": "745d3be23a5c8ddd0c936ef54da422192e5951121952786d3d54269e5c583c606a966b1792b02efaf91d0453483cb69a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698271, "uuid": "cf248335-7915-4a20-9c7b-5d5fd1cd84e1", "value": "T179942330169E4E41BFD0A72849D93B2473D8D1F90D78FAB7D0E61EE2369429998F7093", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698271, "uuid": "748ab715-c7a4-4d0b-8c5b-34bae3e4eb13", "value": "12288:QDhzWpsqBAMI9ph6Cs8uAZnwcpgkvgRZfp+:2zWpsqBA79GCs8R9pVS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652698271, "uuid": "4d1dab48-f6a4-44c3-a04a-ea47530977d8", "value": 416567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652698271, "uuid": "7517fe6b-2d65-4dd5-8147-8d49441899d1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698271, "uuid": "57f2bdb6-3a94-4915-b5c5-2c7df37e6633", "value": "PO.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c04e8808-d4dd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652680942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680942, "uuid": "e3aee0fa-ae49-4684-a22c-13c5d6058cb4", "comment": "Malware payload (Formbook)", "value": "8b4075c3d912ac2927c4d531c0ec86ec", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680942, "uuid": "f8774de0-5dea-4d07-be48-272bf014080f", "comment": "Malware payload (Formbook)", "value": "7dee779c2ee91064166683d4ed96b0ec7f30536bcb4a5619f7c2e45e4189ee06", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680942, "uuid": "3c98e1bd-566e-44c9-8a88-1fd3fe2424f6", "comment": "Malware payload (Formbook)", "value": "702d5794096bba801448f7f1257ca1c8407a4360", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680942, "uuid": "89dc5090-c483-4781-8e35-180ec56544ad", "comment": "Malware payload (Formbook)", "value": "29c6ceba18253f80a2d0dbf83f902e06d2583fc6392645874803923adcd986beb83a21e31f0677521e3c445e2b11cbfb", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680942, "uuid": "cf5a6455-52c9-4999-89ad-af8576a8322b", "value": "T146A2E1BFEE6D9502B6970C1B057162CFD9D5425382A852ABA121F3351E30E1D7D47F4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680942, "uuid": "17bb7a2c-aebd-4aeb-b944-2225d2c8a2f6", "value": "384:N0lJ2gGBxjwsjAiQqpMgRgN5V6rPXU/gta1L7NiRu9tnnf2frTjafN3jr5c1Svoo:y8ZAiQeMgRsVAPXUIYD/bf2fLeLgco0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652680942, "uuid": "6ace5eaf-d7fd-4355-ae64-7ea779312b2c", "value": 22446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652680942, "uuid": "e4e7b766-ec37-4173-8857-b896ae6c24c9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680942, "uuid": "06a1ad06-b7af-41ca-991f-0019ce014592", "value": "DHLReceipt AWB#16037605046 - Copy.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe60de9-d518-11ec-8e58-42010a9c0032", "comment": "Malware payload (YoungLotus)", "timestamp": 1652706013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706013, "uuid": "a65fdf88-e48c-451f-9864-bc5283acd0a5", "comment": "Malware payload (YoungLotus)", "value": "01ca48b073743e7f525c3b5969009c46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706013, "uuid": "30a13881-9614-4741-a091-e8d8e2328fcb", "comment": "Malware payload (YoungLotus)", "value": "7e2d96a16f1c04dd0906f90ba3a827b55e35dc616ea21a6dfbd3c596f47b22c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706013, "uuid": "ac0d3b2f-da28-40b8-a21d-a247c38edf69", "comment": "Malware payload (YoungLotus)", "value": "c8a313930ba09eafd7a5d36efa20fe36b0030651", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706013, "uuid": "c32dd899-996d-4ab6-8409-e0fee99c9865", "comment": "Malware payload (YoungLotus)", "value": "65ef4778b6f9a9a23008876d6a7fcc9c0c82cc0ffd77a6df4a9eb2d73fa469db7b5f75912da12e3b0886d9c206f94f1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "younglotus", "colour": "#8CB710", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706013, "uuid": "4e06495a-100d-43b9-8474-72f61a4eb707", "value": "T1A5D59F00E106E01ED57701BE4EBF721DB15DAF640305B6C7A28C3E6D5BBA8E1793A46E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706013, "uuid": "0101fb0f-dcb9-49c2-b7e9-9d1711b8ee1b", "value": "92580736950a4e490c70c5c6a137f563", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706013, "uuid": "10ed7d5f-49f8-47b5-bb2e-71a1021a6560", "value": "49152:XJ0X3jngai++GwmnJxMzNxxFiMw6DHWMZDXt:Z0HI+bnXMJN1FpXt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652706013, "uuid": "619d73cd-3e54-42e0-9bf5-aac9319611f0", "value": 3018875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652706013, "uuid": "5b6819d1-f142-4a91-857f-5c5265aa57a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706013, "uuid": "88b493ad-caca-4ef6-848b-daa3869c1763", "value": "\u70b9\u51fb\u6b64\u5904\u5b89\u88c5\u7b80\u4f53\u4e2d\u6587\u98de\u673a\u8bed\u8a00\u6c49\u5316\u5305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c2681f8-d51c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652707805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707805, "uuid": "46c22c09-852b-457b-abff-96053c132375", "comment": "Malware payload (AgentTesla)", "value": "8d729f6e813c2a6ae46eba9b84d9c110", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707805, "uuid": "4f6d02de-88a9-4407-9555-461866b7133a", "comment": "Malware payload (AgentTesla)", "value": "7f6474b3249cd79f4d83b79c52e0413c7169baab6f692169596d1ce24f5f47fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707805, "uuid": "76b5772f-ac61-4507-97ec-5dedc1ab7504", "comment": "Malware payload (AgentTesla)", "value": "0c26febb53b543b49f397a4a12be9c00c466dcd6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707805, "uuid": "b8bdf239-de2a-4802-9b3d-6b7ea3ff5527", "comment": "Malware payload (AgentTesla)", "value": "b54ecaec65ad9587e69ec684d714a93e85bb915c7b01502f1166a55ce1ace453d7cb104d05181c76e5754c6c67dde430", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707805, "uuid": "adec4adb-29ff-4529-952a-96addebeaf5e", "value": "T1DBD47D9C365C75DFC85BC472CA985C64EA6078BF6B1B9107A027299DAD1CB97CF200F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707805, "uuid": "222cc512-1eb5-45c6-8b38-949a8f9d7f39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707805, "uuid": "3cd31d73-dfda-455f-9ee7-ddc6ed32512e", "value": "12288:GUO3u9Lv2Ff3ARFq4RLEeadm6yEHMr6A4FQuq4l65xyW5SFq:GRu9T+Avq4RLRvr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652707805, "uuid": "3f171b71-9140-44ab-b466-6593a287cf89", "value": 619520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652707805, "uuid": "e733bed7-4c26-4f88-b304-d5d763509835", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707805, "uuid": "a1c6846b-9bf4-4800-ba28-d55d8128cc1b", "value": "8d729f6e813c2a6ae46eba9b84d9c110", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "456107f2-d512-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1652703499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703499, "uuid": "3e8e7e97-92ce-49e9-990c-564e684cb8f6", "comment": "Malware payload (GuLoader)", "value": "64a65a269652c6afd022a72064cc9afd", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703499, "uuid": "2fa04cfd-abd8-46ed-8768-891cfd7fdd40", "comment": "Malware payload (GuLoader)", "value": "7f67a211a5ca93eb384c111b21905b4a0b5224b4a0fc07566cc4b1e51afb1067", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703499, "uuid": "d0e5f721-65dc-4180-8edf-d475d55b862c", "comment": "Malware payload (GuLoader)", "value": "c07a5741b3f15e8c3020a008f2adc2691e8a5fd8", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703499, "uuid": "0dc703d1-b6d4-4bda-a739-81597f8d650e", "comment": "Malware payload (GuLoader)", "value": "9a84dfb75ee06296654d83ab8fea5f9405ebf31ba857239864cd5b2f3cb4f912c6a5a1d18f4e5a7a6b588a405e7be78a", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703499, "uuid": "d43635b0-a9c8-445f-9e6f-a369d54a89d2", "value": "T11D34675149F2EFC4C2FD3D9FCF1A4620B2409DA9A2D7F1489AA101BD7FD76D9431A2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703499, "uuid": "5a040b1a-c315-447b-9d63-8599bc3d3cf3", "value": "3072:I+GQvBlvPK5EkJUbobS4perfCffXZstCjAuAbYnwboa:FVvBE5EkycbLperafvZsMjcga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703499, "uuid": "64d72114-ae9b-4338-8550-76d9aff7f250", "value": 243266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703499, "uuid": "e6136064-a6d9-4989-85c3-d4ab8f303514", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703499, "uuid": "6e5a52d3-02ae-47ad-899f-30e2ef4f2ddf", "value": "ARRIVAL_NOTICE_BL_NO_607847370.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c4cafdd-d4ed-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652687673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687673, "uuid": "4179228d-8b43-4f1f-a965-b27d18fe1eb1", "comment": "Malware payload (Mirai)", "value": "020ea422c4d962631aa0fcdf0a91687b", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687673, "uuid": "4831dc3b-e14b-48f0-aa8a-fe41baa5f39e", "comment": "Malware payload (Mirai)", "value": "7f71a0c3bc0faa51161fccab6f19df33fe99a07025e64c6e53940d32625550bf", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687673, "uuid": "2b3c3556-36ce-4c07-9cf1-7fe0853bf0d4", "comment": "Malware payload (Mirai)", "value": "6e6c2b5038fd784078a11216a4bdfaeec9d33f7a", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687673, "uuid": "bf9788bb-b28c-4cd4-8e7a-cbd1a74ddd86", "comment": "Malware payload (Mirai)", "value": "665123f3a50c04de87bb3b21253ca9988ed0302db800a10042775a7edc6c32583739e3065c48f0885f3136cf7f0a4629", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687673, "uuid": "f93a80bb-435a-4d52-ba98-c069f8a38ec6", "value": "T18DB2E1A5E1884B3AF8BF4A34552BC11C08873F8F5DAF34791DE251A2964B7EE3D51930", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687673, "uuid": "f85af54f-4d64-4e83-ae56-9851eaff21a3", "value": "768:5Fi7ScvtZpQdaG84vCfTyIzRyg5lZs6rsNsMx:Li79tj7D4vayuRygrZfgOMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652687673, "uuid": "f4b0833d-dbc4-4d65-8915-fcf1a1806c27", "value": 25252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652687673, "uuid": "2a3497f3-feae-49ad-b811-74d9473a6f51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687673, "uuid": "98299d83-7c42-455b-a2c0-b70c75ab7e6b", "value": "020ea422c4d962631aa0fcdf0a91687b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "712c77b8-d4d8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652678661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652678661, "uuid": "55b8c44b-27c5-4c11-afda-c7d8c469c7df", "comment": "Malware payload (Mirai)", "value": "2992f5c1ee207a1ddb270937db30d687", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652678661, "uuid": "738ee6cd-2171-4bc3-a681-fc39ee0035f1", "comment": "Malware payload (Mirai)", "value": "7fa271e035f133424b8f02d7592ef6fb97eb5d059e82407cb3743dd517eef988", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652678661, "uuid": "fc9ef1f1-f835-43ef-aeee-9851a8c7d761", "comment": "Malware payload (Mirai)", "value": "b0a65b3c2434f9cc35ec99dd4a43f0243eca9a59", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652678661, "uuid": "fe4ec4b7-919b-435a-bad9-369c9a2271a6", "comment": "Malware payload (Mirai)", "value": "256a343b1a9aca22fb9cb7166a37dd8ba14b87c064ca40f6247d2946005676ddd8b6f6f0585418d555319195af002a2a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652678661, "uuid": "eb3b8163-ceb6-40b3-8b85-923a2b44cfc9", "value": "T187C2D031D3CA6E60EF2FEEF00D9A96C47BD32F9525B4CC96B9004F5325216269E40EE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652678661, "uuid": "61390b8f-7e8e-4b5b-80f9-e84b32e381bf", "value": "768:TKoPNOdrMc+RX9oevobzhFpu4gTW4uVcqgw09V:TK0OdZCGPXIc4u+qgw09V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652678661, "uuid": "07e4fb6a-29c8-404f-aefc-54bde4d70ac9", "value": 28192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652678661, "uuid": "6ec345df-f4e0-4e2a-9505-c690a181898e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652678661, "uuid": "b051bcbf-dbe5-405a-a86a-354866a59974", "value": "2992f5c1ee207a1ddb270937db30d687", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96d8d2eb-d529-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652713514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652713514, "uuid": "c35b4bd1-5fdf-4ef7-9c2f-a47978bd6006", "comment": "Malware payload", "value": "b56f023ddaed50a756e22127b6c0c7a9", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652713514, "uuid": "1670bffb-432b-4dbf-9c22-851dd7ff4394", "comment": "Malware payload", "value": "7fd3930a5af9c2a6fe92d0cc2b202a67722522027cf84970ba7203cd304c85b9", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652713514, "uuid": "4b0cb88d-a18b-439c-9c89-6b67bd4c6bfb", "comment": "Malware payload", "value": "1e00ae0a2a38785fff4e2177b6d8a606e5951f67", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652713514, "uuid": "a4559ed1-34f4-4cc5-a631-83175bc30457", "comment": "Malware payload", "value": "aadc6cf8b969035fcb364f242d77336f7ccb5c1f8d5d46c01122068b005e41d5fb5cbe60827e6b3a0878ce5ac53fcde2", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652713514, "uuid": "ada3363c-65b3-417c-96fe-1b6b84c79655", "value": "T19B53EB5D272CFA5DD600C2759BC0F00C6B9B729FC2F8222F352E44954B476C2A26A3E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652713514, "uuid": "06336b8e-37b9-4621-bbf8-391fb0dd16fc", "value": "96:5H3nvM5XvG8nb6MPnlsgeSQfmbTiHHiDV:N3vafHbDRzQfaTwCD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652713514, "uuid": "ae40dcdf-2982-4491-8030-512611b4d1b9", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652713514, "uuid": "3b71cfd0-c86b-46fb-8365-9fda8cdcf2c9", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652713514, "uuid": "cceb9873-02d7-4910-95f5-83abdca3551d", "value": "XVPUHUXIISL_#615430.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20b2fddb-d4b2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652662205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662205, "uuid": "38440957-2206-4a75-93de-9a7fe98fc2a5", "comment": "Malware payload (Mirai)", "value": "bdca92414ecaf666f51eda4ad3f5c196", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662205, "uuid": "d39f77dd-8ea8-4bb3-9dd8-5a13ed0d177f", "comment": "Malware payload (Mirai)", "value": "7febdb3e6b00c401be82317eb97191f2e4b5dffcc13d43223d88be51ec212c03", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662205, "uuid": "e94fd898-e0e5-4d88-bb5a-41d3cfdc0eb0", "comment": "Malware payload (Mirai)", "value": "ef2a00bb135512b45e0e49557438097f90500cb2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662205, "uuid": "21d2da54-186a-4c5d-ac0c-c67fe963c215", "comment": "Malware payload (Mirai)", "value": "6e31b40913e4e00429c410ea24e0f2710fd0b25e9b155f267b3524c86c795a802d0c5ee796b256d5e73105504d39c22c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652662205, "uuid": "a4b4be2f-3030-4e9e-9b07-6546e0993bba", "value": "T18CD32A09E7A04797C6E537FAFA8A128E73228B4473EF331AC92466F43BC1B9D5D61015", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652662205, "uuid": "fa267411-0bf4-4e49-8760-a3be9c84cfc0", "value": "3072:HJJY0dWaklbnxQ3DuYEC+MRO3OLQInM/9e2+:HJJrMaklbnxQ3DupC9LLQIM/9l+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652662205, "uuid": "7428e5e3-fc97-402f-b7cd-36b949f1b25d", "value": 140488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652662205, "uuid": "d2cb7fd5-654a-46b0-820a-5b4bf7f559b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652662205, "uuid": "12922ecb-f2a1-4ebb-8461-369a1cbb70d8", "value": "boat.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f29a45a-d544-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652725097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652725097, "uuid": "10e0e371-1375-4ecc-81f8-8bab9a85967c", "comment": "Malware payload", "value": "55c7fa409e7cd6bc467f29865a79e3c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652725097, "uuid": "4406caa3-df81-4f7f-8c61-229915e76714", "comment": "Malware payload", "value": "81162cf2b42e4eac915924af3619432a854f9ee5f587501a647403b8681f8b04", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652725097, "uuid": "100fab0b-c6b5-4c67-be5e-87f52bc4eda6", "comment": "Malware payload", "value": "972d0f209cb10f7dd7cae794256f7b80c98e6c97", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652725097, "uuid": "e90b2b5f-4317-4305-bf63-7c49bb476c9d", "comment": "Malware payload", "value": "ac9e81c0a7df10ecad8cf87821ecb643b00fefcc37af95142c95ad4b10ed710d60084a09a2c138ff467cdd7f2663ccca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652725097, "uuid": "26475a9e-e4cb-495e-a3be-3805b67f6c3b", "value": "T1FE44C002B7A0C875E09A1E308475DBB2973BB8321570954BF790676F1FB33909AB6367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652725097, "uuid": "e17285a1-060e-474b-bfbf-acc89d44536c", "value": "1aa8a0bb9714464b5f28dfcf2c93afb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652725097, "uuid": "c35f5163-5f62-479a-9897-0db2e59dc71d", "value": "3072:yo+8vqG0cSJ4WjE0H7+jZsk7GAD4Bf/Sd9rcAesxkgaBChUpZa9uD6Vdyhk+:jycSJVjE0H7hk7Gtp/kRbiga3wVf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652725097, "uuid": "85b0d110-0154-4a76-960a-95872b5d3cdf", "value": 273920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652725097, "uuid": "17448e02-1f6e-423c-8868-bd8ecfcdf623", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652725097, "uuid": "b2cef47d-5ea2-44a6-b93d-bad0ce9ad0c4", "value": "55c7fa409e7cd6bc467f29865a79e3c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "711b0387-d506-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652698418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698418, "uuid": "69b83ef5-691f-4224-b3e9-bce690cb6652", "comment": "Malware payload (Formbook)", "value": "68008b69bda8c11bc2c1e9bf52d66215", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698418, "uuid": "94587122-a068-4969-a566-49b37ef6765e", "comment": "Malware payload (Formbook)", "value": "81374254e8df6989212388746baed67b0b0a63160f129ba530be4a45806290b5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698418, "uuid": "c4a51117-60db-46d2-b63b-7592457b664a", "comment": "Malware payload (Formbook)", "value": "8a221f41c5db314ee4d9d22035ae573a3ed5a409", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698418, "uuid": "cf856c84-a054-4f15-83d1-f0fa8b5320e1", "comment": "Malware payload (Formbook)", "value": "bed92aecf3575803a7d84eb6712764e6bd068b225b3ff27c8e3ffa5747caaf7dfe9bdfaba6c4bf3bf9b9ea4c098203f8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698418, "uuid": "2d96eba3-fcac-4432-856a-83cce80ac523", "value": "T1525537F75388D960E93351B3F8550230E64F8B4A1C985132FE3BDE0437B65424EABE9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698418, "uuid": "10e81567-812f-4006-8809-97252f658d85", "value": "6144:SYa6PipODPZQDAT3FfD4M8IqBsP9G+dyOCThu9Z0oPc:SYlipODP0AT3FfT8IquddUu9Z0S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652698418, "uuid": "4bc58357-2160-4018-9d0a-0eccce005ee6", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652698418, "uuid": "be90b13e-56ff-4888-b875-99d8b9560ff3", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698418, "uuid": "d8332f4d-8a69-438b-af34-5dbf178ac2b4", "value": "Products Catalogue, With Specifications.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6149ac0-d53c-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1652721727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652721727, "uuid": "0305108f-d71d-47bc-bfab-c68db0152c6b", "comment": "Malware payload (njrat)", "value": "88dcbf426dba95a264c87fa0239e955f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652721727, "uuid": "0ad9506d-fe9b-45b0-8cb8-fb5f9be5a491", "comment": "Malware payload (njrat)", "value": "81833f5962fbaf1c2ee0770dd38375d9e45766dd8e0aad4455e7863a7d5dd3e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652721727, "uuid": "bbe0d80a-ebfe-477b-a38d-91db1e85965c", "comment": "Malware payload (njrat)", "value": "90046bae39f31d9b919a09c0663d59621b76c1d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652721727, "uuid": "c9c08c4b-bc21-4770-bb6e-0dd02097175c", "comment": "Malware payload (njrat)", "value": "f8f692fffa2c674bc81c77f0c3d33964408f7e9fe2e9c6f7f84d61224e7ce1e4a176c495a1aa989b90855d04e1ada08b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652721727, "uuid": "455715c0-56eb-489c-a5ff-6d8a825e2ab4", "value": "T12783E412369B4E51CC28677D54EF0720CFECAB83363FA7996F9812584FF12934E91689", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652721727, "uuid": "61f0785b-0b29-4c60-b914-7b25dee6d6c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652721727, "uuid": "67969edf-695e-4b9c-81b2-1b7fa9e764f9", "value": "768:xIbeZpWfmuMBADksHTQbZIlZINdSbt5z6R2TUT7ENJcv1wtHVZp+Y9GkvKGOZrJr:wuuMBOEdSbb6vY012ToYrGrN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652721727, "uuid": "bad16f1a-7eb6-4d89-ae45-87ae9018d3a7", "value": 84480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652721727, "uuid": "7524bda7-267d-4ac5-8172-d836d6cb05f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652721727, "uuid": "65612804-9105-4f42-8ddb-618df2287f20", "value": "88dcbf426dba95a264c87fa0239e955f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20c538cf-d4b6-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652663924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652663924, "uuid": "63b12ce8-ab4b-47ed-9003-b0b6a7483d98", "comment": "Malware payload (AgentTesla)", "value": "eedc15b9e8f531456ebf9c01442c5487", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652663924, "uuid": "7991a2f9-6f9b-4c49-919a-ca97531418f5", "comment": "Malware payload (AgentTesla)", "value": "82a216069aa4c363845a1e64a4df37bd6f97643cca8849ac144e120fdb2411d0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652663924, "uuid": "9d35240f-0eff-4f46-91be-abc7eb9afa1b", "comment": "Malware payload (AgentTesla)", "value": "7fb0472ef384adadb80aabeea19757fe78e8a5e8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652663924, "uuid": "c24400a6-ad21-4735-96b7-f72c69276af0", "comment": "Malware payload (AgentTesla)", "value": "e42cea9a8845afe5287d6155ca54067b66c11be87227379f169682d3e64fecf150a4bd5d76045ea3bf7ffca0069338ec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652663924, "uuid": "ea67f47b-8e6d-4e84-a80b-3e0b92f3610e", "value": "T1E3D47D9C365C35DFC85BC572CAA85C64EA60787FA71B910790272A9EAD2DB47CF100F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652663924, "uuid": "5bf75770-1c55-477f-9f89-d8c213a29ac1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652663924, "uuid": "2c365b65-1cdf-4835-8170-c276d82db19f", "value": "12288:Gp1Wu9JGp7IaSE7VQCkDS+ozDD2UBYc5IYwQQG6m4MSuwgmV0Sz3POzv8Ypfx:MQu9JV9E5QnS+/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652663924, "uuid": "fc2af454-33c9-4a69-a6c9-35b014f6ef2d", "value": 620544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652663924, "uuid": "c85ec78b-cb6d-449b-ab4e-7d37416c7584", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652663924, "uuid": "353f7d8f-b567-4f74-a359-da335c2aa00d", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5151f1b7-d519-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652706525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706525, "uuid": "53afdd3c-47f4-485c-ad82-858c64f3fd26", "comment": "Malware payload (Loki)", "value": "1d59af51150a8ec3f40d9ac397c15119", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706525, "uuid": "9512ac8b-4305-4b0f-bb37-7c4ee1d19e05", "comment": "Malware payload (Loki)", "value": "82bad855f93e4c83a4c31ae2b11e7a9cb0e7802b665aa7ed789d3c4a1f4182dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706525, "uuid": "8a65f99c-f23b-46cb-bddf-a0811b6e94fe", "comment": "Malware payload (Loki)", "value": "549a34caa0985cfd44534d17c0347ad1d1b6d262", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706525, "uuid": "19db676b-cf7f-4b29-a35a-98e8f78ffa54", "comment": "Malware payload (Loki)", "value": "98f4568e8c4254a8641ae26e5d7e836da9e8fed709dd505f2dd16c8651a6fc98cb53653b0c2bb18a054a3ede71e49009", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706525, "uuid": "ad948e6c-aeda-41f4-9029-aaf2bd018cc9", "value": "T1F9158E21A1C5D659DF2A73F2DE9D8C3122A7ADD54052C2AAE17A33B58972317DC03B0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706525, "uuid": "047a3c14-088a-4f4e-a226-ffc01a2e614d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706525, "uuid": "160f34f3-6fcd-48cc-aa5a-d52ef80cabc9", "value": "24576:DxVKAC+6OKpLeoP0MAfkxsBwoyGKnzRLsGKAC+6OKpLeoP0MAfkxsBwoyGKnzRLz:zKAC+6OKpLeoP0MAfkxsBwoyGKnzRLsJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652706525, "uuid": "6b7f7d14-6fbe-42f1-90c7-f026f8e00ae1", "value": 894464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652706525, "uuid": "c438171d-91ab-43b0-8782-89f094528798", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706525, "uuid": "8b117331-df2d-4693-b35f-b7379ec2f799", "value": "1d59af51150a8ec3f40d9ac397c15119.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0deb4a10-d514-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652704265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652704265, "uuid": "1639a1ad-2561-4e6a-beca-2176a7821c0d", "comment": "Malware payload (Formbook)", "value": "574c237ea44f968817d3525cb856e26b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652704265, "uuid": "9ffa91d9-5511-492c-9e1b-0fa1d7522b5c", "comment": "Malware payload (Formbook)", "value": "82f980f9c0e7dffaff12f27756975e9e551f2ffd432d6854d37106adb27ec0ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652704265, "uuid": "9be753d0-3157-4524-b10d-4f005dc75ecb", "comment": "Malware payload (Formbook)", "value": "f6b523f309257a61cb037a9487a7a4d44be00184", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652704265, "uuid": "da8d8fe9-47de-4ca9-8519-c6d8e9afcb06", "comment": "Malware payload (Formbook)", "value": "be71c704781890fd3fdc4ee15329e770e3deb091264a5e1a68cdf132cb8fcb8500cd59988df2d6aa6cbc21dba9f6b993", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652704265, "uuid": "f1f0a038-99c5-485a-a964-41941cd13207", "value": "T102E4DF9766804001C9CD2630DFB8E9B00BB15DDE59F0A64E9AD47CA3BBFF6CB521146B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652704265, "uuid": "f3855b37-a71e-452e-b9c1-98883d7adae8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652704265, "uuid": "188702de-8212-4fc8-8297-a1222f3a4c62", "value": "12288:P78LLCgzaucw9KkCucSM2IHdPcyFqcTHANG37X:PQLLCgtcqCucSLIH9coqcTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652704265, "uuid": "71e9c8c1-bc56-46f7-a028-e98a79c6710d", "value": 676352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652704265, "uuid": "202c200c-0f18-4a51-a1ca-e4307ee28585", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652704265, "uuid": "64a2bbba-0a36-4ac7-9e98-4803a3376fab", "value": "574c237ea44f968817d3525cb856e26b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b2b339c-d50b-11ec-8e58-42010a9c0032", "comment": "Malware payload (MassLogger)", "timestamp": 1652700529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700529, "uuid": "05d9f0fb-8cae-4a77-b34c-eaa15322ee1c", "comment": "Malware payload (MassLogger)", "value": "0fd9bcaa792903ae7662e3128073156b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700529, "uuid": "20c669b8-9d83-4d56-aafa-604915dca53b", "comment": "Malware payload (MassLogger)", "value": "83b3062792f6ce57b86f6dae63f593d9bf87d37e6700c882e9975b3306db815c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700529, "uuid": "a820a87c-78b9-46a9-b8a4-baf15b90d49b", "comment": "Malware payload (MassLogger)", "value": "cdf1091a53aac3ab46edefa50e2bea1afe109f8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700529, "uuid": "68cf5dfd-7372-4809-a0bc-cc33af6ebebc", "comment": "Malware payload (MassLogger)", "value": "72c20860c275b52c5b45d30297f2b5af27741d123d55e92231d25746cdcc1d99f7bfbb97664d3ab7e39a2f9479d561d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700529, "uuid": "e54c8cb5-d955-4710-b8b7-eb965e46b786", "value": "T11FA4C0C1F12081EDEDAA1772642B0D9209A32CBDE5F5D11D71F976227BF72A3401EA1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700529, "uuid": "9dc3ef53-9bd6-4b57-b2ba-b5b24cc0c22b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700529, "uuid": "5d06ff19-2b0e-49d6-817c-1c6b242ab1c2", "value": "6144:BOtItWVqB0tO7spBfdjq+cyquyFkhjSAv8/ouz6X7FBzSih2WSv:BOlW0tTldjiBjsjSAk/907FkU2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652700529, "uuid": "8f26554f-5bf4-47a9-86da-5757874938ca", "value": 486311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652700529, "uuid": "f4d2bcd4-6db1-44f3-8447-a41eba73e194", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700529, "uuid": "f43a9080-aa65-4cef-9fb2-e654e9868198", "value": "440987654323456789098765456789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecea06df-d4db-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652680157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680157, "uuid": "f8e11ee3-9096-45a3-8830-449ddfdddc09", "comment": "Malware payload", "value": "03311d2c01c42f1d982a73eadb7816b0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680157, "uuid": "674bad17-36b2-4fed-a437-82625ffa2020", "comment": "Malware payload", "value": "8482c25850b9d388eb7d2fde0ddb253dcf1834acfc6c56daa5cd81bba922a038", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680157, "uuid": "0f72e3a5-bbd1-4544-bfec-6837f169c381", "comment": "Malware payload", "value": "7146c7445e3ed63f3a954af9d2a2f6cede212ec7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680157, "uuid": "cb550897-4bcc-46d7-98ff-24bbd3503a88", "comment": "Malware payload", "value": "8f5399eee6a96d5a817b37fee7256eac673721c30818f3260324955d0c16a5b306be6ec9e9e95527b513e7df5346906e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680157, "uuid": "a906edba-84f8-4a6d-8a92-653ef709bc4b", "value": "T1C392247EF28A8F88CB07D2D4110A3F862668F91C93D9D4C6A7FCF734694599F9622530", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680157, "uuid": "3191e335-4da0-4764-9c6e-32398f5a92f5", "value": "384:O9Z+v4c36fZoGds3oKsETKzsakEtohmK3cVQ9/e7P:OKvn3CuGdRKsETKzsa9tohmKsK/e7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652680157, "uuid": "770a3f22-0373-4823-9793-ea13b0c22074", "value": 21059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652680157, "uuid": "a38aa958-b3df-494c-bfd0-34e205cc8f4e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680157, "uuid": "eaacc170-fbdb-4291-96cb-e776c1dddf7c", "value": "KTT Offer (in EURO) for size 2.00 mm InvoiceNew.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b943555b-d4f0-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652689090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689090, "uuid": "cd12f90a-ce1e-48f9-8960-1839ecdb37f3", "comment": "Malware payload", "value": "158d02a00f57057725097a338c6f95a4", "object_relation": "md5", "Tag": [ { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689090, "uuid": "fbd9b5a9-9926-48eb-9038-206b2081a5f4", "comment": "Malware payload", "value": "8486ad1fcfe7f59aa9543c2efe7179b34fc5f955f15b1d41710a1c77685f8da5", "object_relation": "sha256", "Tag": [ { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689090, "uuid": "b7eda7e5-022a-4de0-91a0-e0baed099af9", "comment": "Malware payload", "value": "fddc71841ab5f3438d69bbe0b6b5d5d9e500dc6b", "object_relation": "sha1", "Tag": [ { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689090, "uuid": "f106189a-c4fa-404e-8fb1-5b72856b38b6", "comment": "Malware payload", "value": "56ff6063f8fbdb4162b19e91d3a440c379ade5bcf14da89bc906b6303d697fb457d5cc226a64b135c5872ddccf11014f", "object_relation": "sha3-384", "Tag": [ { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689090, "uuid": "f60497d1-8f22-4ec2-b680-f9409da5b032", "value": "T1C9532A45BBB0EA7ED0B6063B4EA1C771067AB950ED75820770CC135FCCAA2A41F71B66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689090, "uuid": "e83d74f9-9c4f-4717-8fa4-1613c10a0d6f", "value": "768:JEDTn2m3TurzOekMlm7+ZEP5sxxPTnlIXnOWCG+3UBudymnwYR:WRjazOeki1ZA5mlIXnS3/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652689090, "uuid": "a4db723e-0472-481e-a5bc-55ba327c335c", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652689090, "uuid": "6cda3a86-71c7-4cce-8210-d37d241497b4", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689090, "uuid": "862be693-a638-4ab1-b240-458bdc2c4af5", "value": "8486ad1fcfe7f59aa9543c2efe7179b34fc5f955f15b1d41710a1c77685f8da5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c423b1ab-d547-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652726475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652726475, "uuid": "17453612-ffe6-41b6-a8d8-416794d3ec7a", "comment": "Malware payload (RedLineStealer)", "value": "e12239b6acd6e72a129fe01e25f1ac00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652726475, "uuid": "0a09cfdc-a72d-4238-9c11-bec3e0564864", "comment": "Malware payload (RedLineStealer)", "value": "84db59e67c48037c5f3ae84320de881d96e919eedfe0fd86c8b954344fafe9bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652726475, "uuid": "c81cc0b7-b8b7-47bd-b646-fd98a63c67d0", "comment": "Malware payload (RedLineStealer)", "value": "48d8b76da743d50a367f8b757db980f5d9f22d02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652726475, "uuid": "b3ae0f94-5e07-42ef-85a1-ace62959bed1", "comment": "Malware payload (RedLineStealer)", "value": "de3f7f267e1c6e64ea6b7e19a89766d2a4dfcf2754c3ea0b0660ba72d2a4a6f4b1f1a9262400230f27d671f5c44a7344", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652726475, "uuid": "6270a0ef-9c30-4eee-b03d-07b181c2aa6c", "value": "T12A94F121B7D0C830E0951E7455AA97B2DB3BF8321634A94BF360676F1FB3390A6B5316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652726475, "uuid": "9031da98-3c4f-497c-8c5d-6c85c384c860", "value": "153dc3f428c35b5ce77e7e0eb3b25328", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652726475, "uuid": "288df396-b896-45d0-962f-ab74fc4be7a2", "value": "12288:6GaD8uE0HsnG5jg/5TMz/AvQ8iCwo4jQb65Due:6G2E0HsnG5c58/Ijwo4jVNue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652726475, "uuid": "3c9c0220-d31e-437d-8083-324339af073e", "value": 441344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652726475, "uuid": "e9e7a36a-fb5d-4879-a4e9-88e518955938", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652726475, "uuid": "35b5d274-af8c-4cc4-8a87-0fc549e6dae6", "value": "e12239b6acd6e72a129fe01e25f1ac00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b80b7f-d519-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652706561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706561, "uuid": "eb35589a-c33e-4c2d-aead-c5bf73d048df", "comment": "Malware payload (AgentTesla)", "value": "a07c2370526c9e6cc9646b0cc8d31f4b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706561, "uuid": "17e66125-538b-4c72-8a5e-70ae6bf43cca", "comment": "Malware payload (AgentTesla)", "value": "852b15cc9310439586f10b160ef91f8ad1d034aac3968a930205476dc474ea7b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706561, "uuid": "6b371d18-8580-47f2-9a6d-929d3a249f03", "comment": "Malware payload (AgentTesla)", "value": "5b07f3c400abb89663f05a5796c21b9c25fcfd83", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706561, "uuid": "32dbe684-cd7b-4cab-b1f5-44aa97670aa7", "comment": "Malware payload (AgentTesla)", "value": "59155cef7a33a65650093e5109e0a22b770e88fadcd4daf036e4566689b864c5325ccb005ef91f2a6917a302d5a6f23b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706561, "uuid": "0c0bd7e3-b01a-4f3e-9b28-c52e87d23bc9", "value": "T1CCC42340A7FCC525D6BA13B6A775082412B0F966D556F33C6DCB80CA5CB7F84AA20F87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706561, "uuid": "118f848b-13ed-4838-8716-bd560d91b3ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706561, "uuid": "5a187eef-bca5-4e6c-a9a6-67e28677dc23", "value": "12288:GlbaV/DVAAhNLUZmlCO6ZldOQENPdWV8P:DFRAAhpUTfdj2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652706561, "uuid": "8ffb5074-1b75-4259-ac07-cafb2a830a75", "value": 562176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652706561, "uuid": "6824ead1-2ee2-4763-a5f6-ab509924b05c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706561, "uuid": "39850f12-9b33-4cc2-ba84-d82699fb0ba2", "value": "a07c2370526c9e6cc9646b0cc8d31f4b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3ea95bc-d4e7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652685269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652685269, "uuid": "461ae9e4-8ca8-4d4c-9e09-bbfbdb5603b7", "comment": "Malware payload (Loki)", "value": "f151564283ab534fb2a0bf71d9a6ff2d", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652685269, "uuid": "88e5a8c0-da80-4e98-9a07-d219c32f0de4", "comment": "Malware payload (Loki)", "value": "85a3337570282d52fffcf91b2cbf5e8064a81265beffa155baba6ca8d6ac2993", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652685269, "uuid": "9f221060-c5f7-4798-8d44-833c5de8df5a", "comment": "Malware payload (Loki)", "value": "cb38295acb4130c7b03aa3959ea139b94d99cafd", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652685269, "uuid": "87b9aa7f-6728-4c47-9e6f-9c9ad5a89d47", "comment": "Malware payload (Loki)", "value": "7804678f420c181b8a10de0223abd8189e6f60ee057befb3fe9bfc2bba89b75bab1f50cbbee3b75f7885d712786b9190", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652685269, "uuid": "5f7f4ac9-8560-484d-90eb-61bd910304a3", "value": "T17E24128F79C9E003D4F5AA3E65F53BA9CC2BBD961919F4F6050DF904ABB4C8118A1B24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652685269, "uuid": "37f3a130-45e4-4b6a-94cd-5f9b7ffb8679", "value": "6144:LqzkqqjzHsYhYwOSL9pVgWJ22pYxcBfACXqvSQx:WzkdfHHRvS2ocBfna9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652685269, "uuid": "f0e00ac8-fd32-4117-8654-76fa55ba80fe", "value": 229096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652685269, "uuid": "a5221b61-3092-48b1-a6aa-fe539b79aef1", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652685269, "uuid": "0cfa33ab-18b7-4af7-980c-a9f916c70c4e", "value": "swift.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd14d3c2-d4d1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652675782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652675782, "uuid": "fe43ea8b-db24-4e7b-8ef2-6231392e5c20", "comment": "Malware payload (Mirai)", "value": "4015c86a189c0d8d6e0447361e7176b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652675782, "uuid": "57d37e86-65f9-4005-8d3c-2dc180e74a07", "comment": "Malware payload (Mirai)", "value": "85cb43c45bb11ef33dcfce022da047b727454bcf7b8fc868295b6c74d15f219f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652675782, "uuid": "be22924c-3357-46f9-80ba-81a1196b6108", "comment": "Malware payload (Mirai)", "value": "ddce0935c358bc62086931d6f2f0ec7de86e1311", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652675782, "uuid": "69740c9b-ae14-498a-a536-f2b06fcb0b36", "comment": "Malware payload (Mirai)", "value": "e7888bdf33b28c7447d1d214696d7f800132d871853a79d3b55ab44583bf69a8b6fb3bf4e736326e53b506d60ef990ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652675782, "uuid": "c0a04699-ed95-4ab4-8c8c-c738287e47b5", "value": "T109E33B86EA408A13C1D5277BFAAF014A3322DB55E3DB73068D185FB43FC6A5E0E63645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652675782, "uuid": "542e14ed-1466-437f-996e-9efbfdc12b50", "value": "3072:t1a5fdUEjnBGrYkRaaWgV9mrsplDKZUmQBKXAVanlX+F8JyvG4hLnAVIl+3jJNx1:tc5f2EjnBGrYkRaaLV9mrsplDKZUmQBq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652675782, "uuid": "a42220e5-c5e6-47d5-8318-e359a5e1ef24", "value": 152486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652675782, "uuid": "97dd3826-d1c6-4160-8935-4571dbb649b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652675782, "uuid": "644e37b7-df4e-4255-a93f-85f29da68b5f", "value": "4015c86a189c0d8d6e0447361e7176b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe616bc4-d4be-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652667731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652667731, "uuid": "f52f4a60-8ede-49ca-a3d3-ec05c4e06933", "comment": "Malware payload (Loki)", "value": "6a05c77f9e12b2b5845e23dede07a287", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652667731, "uuid": "e8d197cc-fb43-45c0-9a7a-b94b765821af", "comment": "Malware payload (Loki)", "value": "8608a2727d01fa86f426b7043b9ede0f9405f1345c429603abe10b87def35a08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652667731, "uuid": "53a9516b-6d68-452b-baab-a85e1fa69266", "comment": "Malware payload (Loki)", "value": "4df12075f9ea429480b507723d7130b0c61c1516", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652667731, "uuid": "7241685b-ed1d-4bed-b28c-b95db426bf98", "comment": "Malware payload (Loki)", "value": "5fc6ee00bfa25ccfff6fb466aa19722c6fc28856b1a05d921c8b2b53aca3b56fcf0e47401c1669f70fd192423434fdd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652667731, "uuid": "f765249c-7609-44ae-8285-1acf856f2ca6", "value": "T105941384BAEC936DC1FE15F8323341680AF2B506B622DB7D0D9760E62577F878F50A16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652667731, "uuid": "5f6a6fda-47e8-4a67-917f-53a5069a0e6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652667731, "uuid": "64be8a47-f472-4d57-9eb0-ce8cc936eb55", "value": "6144:mQIRe0Dwic0GTblQFK5mtBO2uJIYoV2mvFWAFgFf46Ey0pBqzpQE6DFQZ+Iw8Sag:Ge0sgSc4MnuJIYEBFgFfcfpQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652667731, "uuid": "ea0cc6e4-0f71-4cca-bf48-1f082e27f581", "value": 443392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652667731, "uuid": "df4cb5d3-1e84-43e6-a721-dcc8c7fa9033", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652667731, "uuid": "7c4074da-90d7-4823-905b-460b8f65d978", "value": "Urgent orders_pdf_______________________________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b9066e-d50b-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652700649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700649, "uuid": "be799122-a305-43fa-ab78-f5020ba6b4ab", "comment": "Malware payload (RedLineStealer)", "value": "4390c848f1a47817398972347ff515e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700649, "uuid": "38df80d5-963c-4471-b575-be254ea999a2", "comment": "Malware payload (RedLineStealer)", "value": "86208fa6788a2eda3d727dee6727ac5b78d1805a782f76486e2e709f8ba694bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700649, "uuid": "d3eb9a2d-7098-47fc-9bbf-8c2bc503a8f9", "comment": "Malware payload (RedLineStealer)", "value": "8424c0c9a173d6969667cf84dc1b82c9be389829", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700649, "uuid": "bfde39f7-03aa-403e-a432-ee5837ff3876", "comment": "Malware payload (RedLineStealer)", "value": "34d4d55e810b3332aaa98cf5b0db46940d50f7cc8fff022157c2ababdbd6fd3caf6f19aadf694d1022da87d017e46efd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700649, "uuid": "7ee0bda7-2613-41e4-bc9d-cc396895eead", "value": "T17C15BF4076598B26E1EE373BE3D7144407B1A6D30E62C78DAB4E77D24862253AC1B36F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700649, "uuid": "2715d37a-e795-47c5-9e3e-6142f36e18d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700649, "uuid": "ff42ff80-b136-4a9a-a84a-859c6d1a8530", "value": "24576:DG+ADlbehmxkg1YZtcPzLUe/5HVW3WqZW507xnSujs7:DG+ADlbYmxkgOtwzLcZTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652700649, "uuid": "64a74f66-207a-456c-823c-0cd0a094a905", "value": 927744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652700649, "uuid": "4a8552fd-6e9c-4c9b-a04d-b87159bab00e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700649, "uuid": "0cc271f1-1763-4fcb-99d6-bfca1d3ab1f2", "value": "4390c848f1a47817398972347ff515e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf8ee48c-d511-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652703274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703274, "uuid": "a90e89e3-9625-4a0c-8f1f-5d019f688a0e", "comment": "Malware payload (Loki)", "value": "39d99fc2ce2267de40e980a0e328d8a1", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703274, "uuid": "323ea533-e573-47ee-84a8-e3e45faa1a21", "comment": "Malware payload (Loki)", "value": "863bb40f2d4380b5c410503cc96e0bb2c4b03ce88baf17c24c3ce350b0515d2e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703274, "uuid": "2e4ce162-b6a1-44d6-b3ea-0757061cba1e", "comment": "Malware payload (Loki)", "value": "372ee2ec84971c8ef201971e62a360957fa429c9", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703274, "uuid": "b76e970d-3c96-412c-8b36-76a5483c6a1a", "comment": "Malware payload (Loki)", "value": "7b85f691e52edbb6337b99bd83d2ea330d234a624a92ed6d4210cd7a86dbd8c0cb27070946242cb47e722895dacae216", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703274, "uuid": "3f6b5167-d525-482e-900f-58772659e98b", "value": "T127241201A2947313C6597B377B50FA338408DE0356916B979C7EB8ED40B7ACF9961C3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703274, "uuid": "520f8319-6902-41e8-b795-946a5f91f984", "value": "6144:Ej7teUblLFvw0EgBY25msj38CzLXit+AsPa/hAW2u:Ej7tvw0Egi25mswI1AsPa/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703274, "uuid": "6eb0f971-3cba-40b6-a647-37adc8baa8f3", "value": 228888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703274, "uuid": "7f6af58d-3c76-4393-a4c5-9e404fe7c71a", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703274, "uuid": "a4f28398-1fda-4031-8f88-0899591116c5", "value": "Order_0770.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3f216b2-d512-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652703738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703738, "uuid": "067aa616-7d32-4d6d-b7f1-150a9412f839", "comment": "Malware payload (Formbook)", "value": "c89fd26904db465f16e6436253dfaae9", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703738, "uuid": "1056d078-0331-481f-9abb-6a1a2e868360", "comment": "Malware payload (Formbook)", "value": "868924cd1783e9e04d9a137dc3a150d332ffb85315bf29c0fcc9761d635bb432", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703738, "uuid": "f85fd60b-5fb2-404e-a3ff-70392a321922", "comment": "Malware payload (Formbook)", "value": "6abd7f98b4dbe22d8b7feb4e1af84eb379cdc313", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703738, "uuid": "ce787111-574a-45d5-abdc-c399fe2fd64e", "comment": "Malware payload (Formbook)", "value": "9f77953ad605e82fa77f9690c749d2ebe325ca24882084a3aac7f6898886f7ce5d78a001b914e184fb9b0943c59bb78e", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703738, "uuid": "7009db98-b4e0-4354-8071-5b187e1e3195", "value": "T1F2A45F2C7B051EB2FF1F897045110B34BBA6BF83724099D7579B28CA876E1B72D15C8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703738, "uuid": "b7ebf93d-85b8-4fb8-87e7-cf6304344254", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703738, "uuid": "5123012a-7ce3-4608-830b-3d7f5da3b32a", "value": "6144:Y212PJhhN1YjHTLlfFIixWL8HWW1u7JNZYIM6I/r53be9Y6pby52J93Bj:Y2mpNCj/5mWYq6I/j6g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703738, "uuid": "1cfd475b-e1b9-4d7f-b944-bb81ac558c2b", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703738, "uuid": "4c3f7435-0204-4d5f-9a9f-33763b38f032", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703738, "uuid": "31448577-5546-4e41-8705-aee3caa836cb", "value": "DHL_29028263 documento de rece\u00e7\u00e3o da compra.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e4e877-d528-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652712999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652712999, "uuid": "05425f89-dd08-4399-b8e0-f30d0b14e366", "comment": "Malware payload", "value": "bc6aebd82e26a55f9a83e7159a4e7ccf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652712999, "uuid": "45e2b44f-a674-4f5c-baf3-2b6ca488ed9b", "comment": "Malware payload", "value": "86b14f7fce72e405b7de5d901fe88412a9ca16fa7f646c68c4631ba15c131ba2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652712999, "uuid": "bc032302-6b1e-4f47-ba72-17f41893099f", "comment": "Malware payload", "value": "2b289cac19f9de8c684a3dc220a8e2327738816c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652712999, "uuid": "366bfe71-6db4-4cd1-a1f6-1ceab89fb49c", "comment": "Malware payload", "value": "1952f8ad86d9c00f107c462487e93233a72aac596a0779ed0f32193f8c3c912f72c0e7a5de4595776b3eeb33d8339d15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652712999, "uuid": "5ac2580c-e56e-427d-9059-fe9de1d4f44f", "value": "T1CDB4D0AC722476EFC857C576DEA42D64AA6074BB530BA207981345EEDE0D98BCF140F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652712999, "uuid": "98aece3d-2dd2-4d7f-9d8c-466b78f74385", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652712999, "uuid": "ef40241a-958f-48e3-81c7-1239ff172042", "value": "12288:RVthr79n5J4dLdq5mYixzCgXBzErxJ37yAnXdQ:br7ZYK5mYiggx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652712999, "uuid": "945dd2dd-b9e7-4146-80b4-2247ea48f282", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652712999, "uuid": "3d7c87f3-f972-49ea-8013-c2e714b5182d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652712999, "uuid": "d833108c-1f08-4962-910a-6ebede57af62", "value": "86b14f7fce72e405b7de5d901fe88412a9ca16fa7f646c68c4631ba15c131ba2.mal_", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d74dff3-d540-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652723403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723403, "uuid": "8f109637-10ca-43d9-a7d0-f2180e3936ae", "comment": "Malware payload (Mirai)", "value": "570158c5b97627a0a4a1b82093a268c2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723403, "uuid": "0244076e-086b-4d09-b771-10a2bd3290b0", "comment": "Malware payload (Mirai)", "value": "86baa7be5eae4cf964332a947e08e91b050904fa5c2808083c0a7b29af06f8d0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723403, "uuid": "c510b143-be62-450e-a4a9-a1b50a68899e", "comment": "Malware payload (Mirai)", "value": "c789b79929d552b11505ca12cfce64fcc34d28ce", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723403, "uuid": "737e7ab1-c847-4eb1-a58b-873bcfb771b6", "comment": "Malware payload (Mirai)", "value": "39978f4ca5c7e29e7ef3eb02efe854331fc05fe005b99de4d1fd5060a40ca97f61b2ad06c08ae3dbcde931b8d02f5c0f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723403, "uuid": "04b6c7f0-25bc-45dc-a232-56653796ae2b", "value": "T15E032F8CEA69A77DC3E173FFE79912CE623A07D86BD3B525CA35414937C8354A825230", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723403, "uuid": "2353752e-c29f-48e5-a9d8-9dec5632c9c3", "value": "768:dE39XoQlrr6osPEGwu50OiCDXb3/jabED6uT/14:dE39XoQlrrGMdqvLL2m/14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652723403, "uuid": "6c525471-80dd-4dfb-8bb0-5addf1e6b596", "value": 39739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652723403, "uuid": "8d8108ff-b8d3-4359-8afa-7c5a00e5eedf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723403, "uuid": "9f586375-e46a-414b-b83c-9d274b07514f", "value": "miori.arm7-20220516-1750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b9218a5-d512-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652703429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703429, "uuid": "d701aa65-242f-437d-acb6-ce531ff65f3f", "comment": "Malware payload", "value": "048ecc4433b54fa65728e214d0d6fc57", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703429, "uuid": "d7c82e00-85e8-4228-bb45-f4cb1cf5ff99", "comment": "Malware payload", "value": "86cd178f74d4acfaac552714d1daae57dab2697c0ef51faefc74ee9787813caf", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703429, "uuid": "323ad992-d7c4-4b66-92df-783932a2298d", "comment": "Malware payload", "value": "b37f894b0fe75c0eb6a1848b65ece85ddd573ad3", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703429, "uuid": "eaef81a0-94ed-4ad0-bc5a-e0d5e2c14d15", "comment": "Malware payload", "value": "6ba87cb20c8ca1aa80cb37f8e4ee7cc7074a8ab884b4575ab5049b5b316e900c2143307e18f902d58668453187588c8e", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703429, "uuid": "447d2226-2e9e-42e8-9c2f-bb8e64aa873a", "value": "T18524122F72B47D59F0B45A32A1C8D32A4C6ADE3AC77494F332E6B02D6B32575160132B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703429, "uuid": "808f6ac4-2796-4f33-b85d-671812f70d47", "value": "6144:oHEQQs36ukdW1Y5kXoaXy2IhZT/o05tsS:WEQQoRS5P/7s05t/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703429, "uuid": "078fffaa-2edd-4f7b-997e-69436fe35b80", "value": 229048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703429, "uuid": "19eb44f4-b487-4078-b468-4cb50e873458", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703429, "uuid": "3f78f13c-5360-47a5-a28f-5c53941fa179", "value": "REMITTANCE ADVICE REF0000360261.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a4bf8d6-d519-11ec-8e58-42010a9c0032", "comment": "Malware payload (MimiKatz)", "timestamp": 1652706433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706433, "uuid": "7a440066-1121-459d-be51-112b392e71cf", "comment": "Malware payload (MimiKatz)", "value": "f6af8bc93dce19394a82f59d045056d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706433, "uuid": "ec0e7d92-1c4f-452b-b331-97c04954c367", "comment": "Malware payload (MimiKatz)", "value": "86e69b16379a3aa41a658af413ea71364341da11e2f7d724dcefeac6eaa504ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706433, "uuid": "bbcdf11d-1644-49a0-bf25-80beebbb6bfb", "comment": "Malware payload (MimiKatz)", "value": "e1576fdb246ad87c9403ede37c7006f397822fab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706433, "uuid": "3ee416bc-fe6b-4b0e-845a-62c11b589d53", "comment": "Malware payload (MimiKatz)", "value": "9060898751d8645ff4d615a49019f7379ab17b7b6a38df05c46236e7742b8aaee3dbdefcf3a1ebc41953cf80e54c01e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706433, "uuid": "c6265e6a-67fc-400f-b1d2-fbe4bb90f777", "value": "T1F5062383F6C2C071E86500B944669AB60E766D3257BAD5F36FD07D2ABE702D0EB31247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706433, "uuid": "96a48a53-499f-4218-add6-bb88d84bafc8", "value": "1ff847646487d56f85778df99ff3728a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706433, "uuid": "d802b4ae-c2e1-4667-91be-c66a65cb1390", "value": "98304:Q06FOznLo0+Dd6uxc8M0thVtcFO+U6QdK8KIWx:Q3F6n80W6uG8M+zcFbU691x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652706433, "uuid": "1b078b9f-28ca-4f9a-abce-79d143cebb6d", "value": 3811402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652706433, "uuid": "f14d1b3d-857c-4ac3-a5e1-12d58d30075d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706433, "uuid": "7241a63d-04b4-4da4-bb0b-a7c95f98f747", "value": "\u70b9\u200d\u51fb\u5b89\u200d\u88c5\u7eb8\u200d\u98de\u200d\u673a-\u7b80\u200d\u4f53\u4e2d\u6587\u8bed\u8a00\u5305 (3).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "385ecaa0-d4ee-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652688015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688015, "uuid": "9c8622a4-367a-4dec-90b6-0ce6fa0c974a", "comment": "Malware payload", "value": "de5712de822f231153037632a60dcfb1", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "pixelmon-pw", "colour": "#765B0E", "exportable": true, "hide_tag": false }, { "name": "pixelmon_pw", "colour": "#378CF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688015, "uuid": "5678720d-d415-4506-b5fc-e4e6e17e04c7", "comment": "Malware payload", "value": "87211a5e4ca82a23b732305796446c53f3ba5cecbdf6ae46f687a164530529f2", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "pixelmon-pw", "colour": "#765B0E", "exportable": true, "hide_tag": false }, { "name": "pixelmon_pw", "colour": "#378CF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688015, "uuid": "0134925e-b614-4598-9701-94fd3622cb50", "comment": "Malware payload", "value": "dfa91725f04083b9d85abc0f0e09d115d1a78858", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "pixelmon-pw", "colour": "#765B0E", "exportable": true, "hide_tag": false }, { "name": "pixelmon_pw", "colour": "#378CF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688015, "uuid": "5735276c-a5f6-4d33-9f09-32420a4080f0", "comment": "Malware payload", "value": "ddf6755a810c04ea6da164529367212d84d32969ca6c3a8a2ffbdaefbe341e41973b1156b7d96f6333a5c7f7cc7fd4bb", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "pixelmon-pw", "colour": "#765B0E", "exportable": true, "hide_tag": false }, { "name": "pixelmon_pw", "colour": "#378CF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688015, "uuid": "00994be9-eda5-4456-9604-98adaeb4fb4c", "value": "T14E518A34EF964279D7B28B71EBE99A03A7967903651DBF4F4201330D509D101E8DEA3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688015, "uuid": "4cdeb629-b86a-41c7-b260-000bde2b692f", "value": "48:8TyspfO+Ss7CN1359Vn9e+foJpkNMT82r:8THcN13z/HfoJpcMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652688015, "uuid": "2585769c-de7d-472d-be78-4bcd9d862826", "value": 3009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652688015, "uuid": "696124c2-ced0-40e2-886c-e51e74236913", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688015, "uuid": "f8cdca31-2498-43e3-bb7e-6df0485e36a2", "value": "87211a5e4ca82a23b732305796446c53f3ba5cecbdf6ae46f687a164530529f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e013442d-d4fa-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1652693450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693450, "uuid": "1d3d6253-d1f1-4d6d-903a-f4df08894384", "comment": "Malware payload (Smoke Loader)", "value": "35f2cacee9bb895992c50602e6f06246", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693450, "uuid": "6da220e0-ffe9-4ab2-a5b4-377345f85b9c", "comment": "Malware payload (Smoke Loader)", "value": "8752c84ad17a1e91baa4d124090654a3a5e00f6cd576c764583f52dfe6e92206", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693450, "uuid": "da679b19-7e42-4a0d-8853-13a2b7d9eceb", "comment": "Malware payload (Smoke Loader)", "value": "8e3ac87a25fd53d740d943d9ec8092bc6d7a3fba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693450, "uuid": "5c1cf56e-f768-486e-974a-177abfd6a639", "comment": "Malware payload (Smoke Loader)", "value": "9053d8c5d4dc5c063ec4f6de9e10fb37b767ab21e44d8b97cff7add57a43dc80ef2be5720d3186b2ae203712b99bcda6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693450, "uuid": "154a93df-dc3d-4095-998c-578bfdbcf3c9", "value": "T1B424BE11FF91D035E09216304570E7725EBB78320675998B37A42B7E1E703D19EBA37A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693450, "uuid": "e77095d4-00f9-459e-9b25-afd978150caa", "value": "7571adbe544c88b5f4f231486e74f9e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693450, "uuid": "ed53eb17-1c13-4437-aeb5-3bb6bf509d73", "value": "1536:1dA+L4e43HdGbuDcxqtcvRQo6DJ4YYmfvJswebH+nIn1yzspVfR9jJX1Kk8/TjR9:TA44LdoocEJ4HDR1L/JgDjNtZ41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652693450, "uuid": "0ae9b25e-2a29-484c-8b60-2f110c341a3a", "value": 219648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652693450, "uuid": "dcccc187-ccb1-442b-8869-884f8d379b93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693450, "uuid": "0bae037a-10d3-4513-a73c-10dc32ffa75e", "value": "35f2cacee9bb895992c50602e6f06246", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0bac7b5-d501-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652696485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696485, "uuid": "4b7f21bb-dd89-44d2-a6bd-6c7e77b69074", "comment": "Malware payload (Heodo)", "value": "9d5e543ebbbccfbe7293482eeb4e3450", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696485, "uuid": "52ed5abe-2c08-4022-b581-f6d3766fd198", "comment": "Malware payload (Heodo)", "value": "877ca925c5d91341f356cb6d05f5f3568774cffbfd0420ba18e6e6f9d4be0dd3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696485, "uuid": "728f33ab-dcdf-4a6a-899d-1521b54fdc75", "comment": "Malware payload (Heodo)", "value": "44cef0bb3e668171e66442650b4e4610500a5f67", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696485, "uuid": "571a36e9-6308-4a57-a27f-148ad9a16949", "comment": "Malware payload (Heodo)", "value": "f7f4301b299521831037190fd2fc2d53de4261d524249b8f628928a677eea9d2bbf87f0ab02ea3d8bfc81a7516559b35", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696485, "uuid": "8f2911ff-9a7b-4bbf-a9e6-abe604b74a96", "value": "T123055A31EB6C8492C6A3553D88A34B06EE7AFE940B6183CB12A0733E9E777D45C35671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696485, "uuid": "3beb4275-6547-4d89-baf6-fa9c0a400153", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696485, "uuid": "e68757b2-074e-4ab6-aea8-80ff0b744656", "value": "12288:BeI3xGoz0/7aG8GkZHFT1Yi5a8kL37eGfv37:cYAozAWGxGx1Na8kLqGff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652696485, "uuid": "d7ed799d-bad7-4f50-abd7-261c8ab3a009", "value": 800256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652696485, "uuid": "340f6e08-ea39-417e-96d5-52fce43ebe16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696485, "uuid": "22b5033f-f548-459b-a37c-cff18be73c24", "value": "9d5e543ebbbccfbe7293482eeb4e3450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f6f3af-d51d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652708227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708227, "uuid": "6f5ea7a6-f002-4ae6-8064-f8b869bcbea3", "comment": "Malware payload", "value": "b1bebacdc1913cbc1571a740b224e455", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708227, "uuid": "fad27685-379e-4005-841c-829793e890cc", "comment": "Malware payload", "value": "879ed7e70f3065461580484acb99e57762c9c86f1a92acae280fdfecf0f50cbb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708227, "uuid": "46a2c9bd-e8ee-4af7-ab79-f86bdb69fe84", "comment": "Malware payload", "value": "d74ea5ea99dd8e989fec414224a79b4e2ff3fcfd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708227, "uuid": "fa9ae3e9-ceb0-4e22-8c7d-8f0cedb1b31a", "comment": "Malware payload", "value": "c8674d1481488a0e539ad996a0cf3910217feb4bd21b5a46ff654ec8088d3cb57142a49a7ca8c9ab942d4d9f3f1c4921", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708227, "uuid": "fa315d4a-bf91-4f4b-b5c8-c5ef14762545", "value": "T1F3B41214B3EC8225DAFA42716B3D050112F3F5226522F7285E63D0CA1EB3E479F517AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708227, "uuid": "ba0df5ca-bbf6-4a3a-85d6-38d8cf488028", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708227, "uuid": "ff20df50-1adb-4ff2-9727-4d5a1a524f1e", "value": "12288:gSEdQ+2KFGX9EiCGqaM7qFHZ38d8VBRJ7JtVXU:MdQ+pFGXScHZskRJ7hX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652708227, "uuid": "a1f6e612-3bc1-4b7e-bdc4-68e911efd693", "value": 531968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652708227, "uuid": "e078ce17-35bf-40f4-9812-4d47fcf5c400", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708227, "uuid": "28a4fd4a-21b1-4d7f-a19e-62167fde3c65", "value": "b1bebacdc1913cbc1571a740b224e455", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ff98918-d4b2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652662204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662204, "uuid": "dbdde231-5cf4-493f-8597-1e8b9d228c11", "comment": "Malware payload (Mirai)", "value": "37f918b6f7c90fb48de8f2fb166c131e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662204, "uuid": "da7ed194-3655-4a06-98a6-eb1381b3bc33", "comment": "Malware payload (Mirai)", "value": "87d221e8d6d9febb1a3686ba541bcb4db63e4a507150e5fb921da0a93e222f7d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662204, "uuid": "705c3bcb-d7d2-4825-8570-3655f7cfc882", "comment": "Malware payload (Mirai)", "value": "93703255f1a8528d0e0c97e1fc24ff33bb8019bb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662204, "uuid": "30364b13-bf5d-436d-b435-c1116bafb423", "comment": "Malware payload (Mirai)", "value": "73d3ef7737b1f330825a284950e30fa3e221bb93a349995ba5aae53da36d34f43e10ba387f2084f59559cca738645cd9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652662204, "uuid": "4300b842-98c6-4e0b-b89c-a87dfbf3b52d", "value": "T12D23D64661F2E2F7EA0B20F17455B752A139E23530ECA817DF400D76F52690AF2927EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652662204, "uuid": "303cf689-cb75-4a27-b809-46068df4a976", "value": "768:cnPi4dD0EkjglRuMIJFf39j5EzRg9fKCUZYFRSz49D8dtlVHIu:MPi42jclsM8139ezRgVKFYFoG8dtrd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652662204, "uuid": "538f040d-b744-495d-8a6f-0556c51300d2", "value": 46812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652662204, "uuid": "5958578c-87e9-40b1-928d-9d97603d85a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652662204, "uuid": "ee6fb203-3d2d-413a-b09a-e084a3db6a81", "value": "boat.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab4d9738-d4d1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652675752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652675752, "uuid": "b4508a9b-1a4e-45f0-8b75-4959f09ab4c6", "comment": "Malware payload (Mirai)", "value": "5fb7d7b659825d333853511a81ab687e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652675752, "uuid": "77cbd96f-9e58-467d-97ad-e95cea14fb93", "comment": "Malware payload (Mirai)", "value": "87db6756ba6fed4bd5870a62c83b434e8602d8b7922148eb5b1c7da87894f80c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652675752, "uuid": "df9b7bdb-f24c-49a2-8263-1f0ac2dd4ccc", "comment": "Malware payload (Mirai)", "value": "4e5a088db6a0880eddfe68b97fa55c546e2f1b01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652675752, "uuid": "c7fe3d95-534e-45c0-b292-29ceecffdbfb", "comment": "Malware payload (Mirai)", "value": "0d4af71cc8e522ccabe4cb881f04df920cb47449a927f7b2fe0159928d6e71992e7e78bc67e17c717af4fa6ee3f565cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652675752, "uuid": "35d3243a-1dee-4925-8f30-4cca16f5592a", "value": "T135734A0276288E4BEAD60AF1253F5BE483BFED8025E4B584680FD7464635E37458EF8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652675752, "uuid": "dc9e6e61-708b-4d78-b983-40d6ebb3ceed", "value": "768:x0zlipKQt/M9Kr902YECVNoIdgxI+B5vTemF6m3PpT5v99/sllk5MCs7/nLDJQ0W:6iYQtO6VCbWFdT1ik5kvm04/V5yDOGub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652675752, "uuid": "dcfc57f0-1b9e-41a7-b1be-967eb2070d14", "value": 74660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652675752, "uuid": "84d3194f-2642-4f24-95d4-eb5445d62c51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652675752, "uuid": "563aa0df-0ac8-44d3-aefe-4566b14ec723", "value": "5fb7d7b659825d333853511a81ab687e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a2cc55-d512-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652703744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703744, "uuid": "c7775c6f-c163-43a3-93e2-2fca36b098c0", "comment": "Malware payload (Formbook)", "value": "755fb8021aa591392bf35a077cc1cc1c", "object_relation": "md5", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703744, "uuid": "b6df17b2-ea3b-490a-bf72-a18e097fa936", "comment": "Malware payload (Formbook)", "value": "88133a48392aad7e165f4865ea94c81fab70ecc280c2474a0a8da47036bd1135", "object_relation": "sha256", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703744, "uuid": "6934dc50-8172-4346-88a6-ef921064485a", "comment": "Malware payload (Formbook)", "value": "4976b84ca802c148b03807f61728c057c6531cca", "object_relation": "sha1", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703744, "uuid": "af013f73-d1aa-487e-8feb-9844fbaf1a26", "comment": "Malware payload (Formbook)", "value": "fdbd7085267af805d29ac6c41d8c0995eda8e01db82f4e4cb828aeece8431d40617cc503ffeebe66ee71a94d7dc102d6", "object_relation": "sha3-384", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703744, "uuid": "f145c9dc-769a-41b3-8b55-8c8578052cec", "value": "T1A6D4811C7B054E72FE1F857058110B34BBA2BF637680AA97678B35DB87AF1672D05C88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703744, "uuid": "789a2878-9f71-4979-b3fa-6027d423b3ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703744, "uuid": "bc12dad1-21b4-4123-bb46-fac85bdf140d", "value": "12288:jt0i2GaHaGYmwXsdgFyl5Leens34TtjclCV3Li09zDT:aGPGYmwX1ALeens34Txn3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703744, "uuid": "53694cd7-6271-491d-b7f0-a743d3c1ebae", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703744, "uuid": "9de86448-fc6a-4b89-8bf7-370da50b1382", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703744, "uuid": "a2db0507-9f72-4876-b4b9-d84c8eb01a1c", "value": "DHL-Quittung _6368638172, pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8d3fa30-d4e1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652682620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682620, "uuid": "4fed8ef3-4b4f-4aa0-b9e1-ace227afaddf", "comment": "Malware payload (Mirai)", "value": "8846edddf1667b83a122a53936dcf414", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682620, "uuid": "04fbdf27-541f-4452-9d47-fc6d6457333a", "comment": "Malware payload (Mirai)", "value": "886e008550803432fafabed6ebaa7b158bf6925ec514a41c8c17c83b1e3bc077", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682620, "uuid": "3397eed9-e722-408d-839e-4e6f012e7170", "comment": "Malware payload (Mirai)", "value": "d2dd50bdf67bd51fd2a9bd99f5d158a7b8cfdac9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682620, "uuid": "76c34d1f-4954-4c26-8f0b-026c68d6a7ce", "comment": "Malware payload (Mirai)", "value": "c1d7a55d23649eff888f4fbbbfe0cb0740e6eefa1f29dd5d21083fd4bcb2de8e7bcca6b8d020a16b587a3b07169851a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682620, "uuid": "8ac15fa3-4844-45d9-8e43-9dbd5625f31f", "value": "T146E2E151E0EC0BC9C4BD617A056BF50FA091F01AB0A2DDDB68D4F877574CFA61D2CA51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682620, "uuid": "fb0ecb20-16d1-4840-b05f-676a4b845dc2", "value": "768:NhImGhyQ/biPh65y54VRaqWQF9cUSW0fILcjVLp0nbcuyD7UHQRj5:DGMQuh65o4VRsKOUSW0Aainouy8Hyd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652682620, "uuid": "7d2a9679-f6b3-4061-885a-517dfae1763d", "value": 33276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652682620, "uuid": "4c21b212-0a8f-4c73-99c4-acc305d1634e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682620, "uuid": "7ce6fea1-619e-4d4b-b0e7-ce04f6342b41", "value": "8846edddf1667b83a122a53936dcf414", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "109328e8-d4f9-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1652692673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692673, "uuid": "eb499940-71d6-4b97-a759-7130199f0724", "comment": "Malware payload (GuLoader)", "value": "26803de315a204d9b7d0eb6ba6fd5c3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692673, "uuid": "682e7f6d-4199-445e-a74b-e2a1ba23f0d5", "comment": "Malware payload (GuLoader)", "value": "88abb37c027732f2a724f83a90159604b7025db87702ecce5192cfa0416039e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692673, "uuid": "5f543c92-2716-4986-b24d-d116895df8ec", "comment": "Malware payload (GuLoader)", "value": "6c7b443afd5a5255c31315c3622f386db9cb77d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692673, "uuid": "313030cd-c482-47cd-8b48-68418014e2bb", "comment": "Malware payload (GuLoader)", "value": "2d8fec27231034da8f43bb3abd40fa0ecbaddce516b0c44596849f8101a8416ef74c137f3d1bdc16b0805d4fbb638510", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692673, "uuid": "19942baf-f898-4977-9516-bea6d9d13628", "value": "T16884BFA63F19C811D39194FC6622E2DD99B66D102BA98662F3F13F6B752CF437D0D202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692673, "uuid": "10ae9098-efc3-489b-839c-5f106cc586ce", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692673, "uuid": "3933da19-e31d-48e7-8395-033b05828938", "value": "6144:lYa6FhyPsCD05Fo1v8/skt2m1r5Rp3DuafLM1I6HPbz:lYve10/s42kO11bz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652692673, "uuid": "94a2bbf7-a313-4f5e-9c06-66bf3b76f88b", "value": 384704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652692673, "uuid": "be1a21e5-6e77-44a7-9bd6-c95a8cf78091", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692673, "uuid": "b50a1713-396a-4c6b-9b94-ab16683b1ec7", "value": "PO 150938, 150939 & 150940.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a85f8f88-d4f4-11ec-8e58-42010a9c0032", "comment": "Malware payload (njrat)", "timestamp": 1652690780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690780, "uuid": "c27fe9a5-503d-413f-b345-e3127c413e65", "comment": "Malware payload (njrat)", "value": "6989b69ae4f70a65521f129a6972cf01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690780, "uuid": "150253e5-672d-4c55-935f-fcf06f66a9c4", "comment": "Malware payload (njrat)", "value": "8906e44faee2782e38a03ae864dce60400927c43688e4d2649219b5699e6ec7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690780, "uuid": "dfbb5cfb-e01a-47c3-873d-8757555f7d78", "comment": "Malware payload (njrat)", "value": "c9fedcdfe9a65ba35a83fc80c843b8d26e7d8a5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690780, "uuid": "68a8dfb4-872c-447b-80ff-c00061fa4bac", "comment": "Malware payload (njrat)", "value": "fa3297de28fb4390e7b7d39d84529760c40fd3d30f963a133f5c443cc5c37c8d4d495f4e08200a7890c6c52a5f7befcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690780, "uuid": "9dbacffe-d6e3-4e3d-abef-021642c4ca95", "value": "T15573D64CB694E174D5FF8BF1F491B2890B71A02BA806930F99F154D94BB3EC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690780, "uuid": "35f5bb43-ba14-49c5-8624-71584938c6f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690780, "uuid": "ca9838ea-b43a-40d4-a655-75d6bf327c6f", "value": "384:6ZyfVYdM9qIyrcAZRIWAEZEwl4DNzcIij+ZsNO3PlpJKkkjh/TzF7pWnjmgreT0c:YlCwFrRRnJE1LuXQ/oyq+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652690780, "uuid": "72bd6476-c298-4b55-a107-dff819b6d416", "value": 73728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652690780, "uuid": "7e1d0b2c-cc69-4e56-9247-4edf91f71af9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690780, "uuid": "4f5b04ad-56d9-407e-95d8-0060cfde2b1d", "value": "6989b69ae4f70a65521f129a6972cf01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba627cd-d538-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652719803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719803, "uuid": "667d5716-eba3-436b-b225-98bc747429ce", "comment": "Malware payload (Mirai)", "value": "673c645067c20d83b8d25ed40a05ccc0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719803, "uuid": "eb7c1363-c067-4305-981f-3536abe91de8", "comment": "Malware payload (Mirai)", "value": "8972dc399709b4023757c1bca570eaa5950ae3150a6d13b24ac46b20dac2bb44", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719803, "uuid": "191611ec-e552-48a5-bc47-fa0d91d00075", "comment": "Malware payload (Mirai)", "value": "fe088221a68779769658cc218d2eed71c943420b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719803, "uuid": "19932771-3762-4dc0-9eb0-2942d15e80d1", "comment": "Malware payload (Mirai)", "value": "3b1f0517f3f306c726b2d493cbd9be8f14cc3f66455321f44c1077835940cc801656f2cb1b2890d67fccdd45f6b3f53f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719803, "uuid": "086a7fc0-e098-408f-b636-162bb17dbdd0", "value": "T17BB2E1BEF1758E68F650D03326B8C89AA082F79995999A8DD291DC57292B3193033FC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719803, "uuid": "17c890c9-a3d1-4920-99ce-dcb300702871", "value": "384:MbXcnZ4Dj8/hG1TV6qtYI/0FvusRAy7Q1c61ZAEizUeSZHTVUv3y3:N4j8/hGlV6o0kyz7sypS5xUK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652719803, "uuid": "5a30a65a-139a-4345-a788-6059b3f2ba4b", "value": 23616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652719803, "uuid": "7c309c82-b97f-450e-90d2-8b03164de7a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719803, "uuid": "57556064-5c09-4a1e-b56e-d1dfc801afea", "value": "sora.x86-20220516-1650", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98381c15-d4d1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652675720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652675720, "uuid": "41aaa084-1b72-491a-b2df-99add89079ba", "comment": "Malware payload (Mirai)", "value": "a575626dc90f9583fec2221455198e2b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652675720, "uuid": "bf33c535-39dc-4b42-a887-465be3de357b", "comment": "Malware payload (Mirai)", "value": "89798ba94107ff4e02b4787788f5cf64a4510d3959f3d19f6fa4fafbb3a34b04", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652675720, "uuid": "8503a00e-ce89-4201-acbd-00717edefebf", "comment": "Malware payload (Mirai)", "value": "b00dbfd3d42571828de0a78a3b4a13b422e55511", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652675720, "uuid": "dbfbd2a5-de90-4cff-87bd-beb6c10d5583", "comment": "Malware payload (Mirai)", "value": "8b87541e4dd36cc826420e123b246b17b30a41c04cd0d21b5c5baeff3d5f26ed21ecac8c5e71a756fdbeb556852d289f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652675720, "uuid": "5643e2ea-d4a4-47f9-bf86-48a46c195f98", "value": "T1ED63F9827C81AA3AC7D017BBFAAF109E3350ABE8D1DA7253CC154B5176C650F0D67B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652675720, "uuid": "8547a618-07f1-4551-b2dc-bfbefd6af375", "value": "1536:rvpMPHug5RlFyZS/l+UAuYkpzg0FS0ykFShYceZWYCNqxuM:rBMPHugc0lFSKcwcU3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652675720, "uuid": "64b2cbc9-cda2-48ca-83b4-5e1b9cef525f", "value": 70872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652675720, "uuid": "5081d0c7-39cf-4930-9e38-6f5fbf1d21ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652675720, "uuid": "7e73cca9-76d9-46b2-8cac-f8a058ed362b", "value": "a575626dc90f9583fec2221455198e2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "636c2fd9-d4b7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652664465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652664465, "uuid": "97ca4bca-304b-4bd1-a1b2-6a60400d1bf4", "comment": "Malware payload (Formbook)", "value": "5714f2783f8f9ee0f728070a72300534", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652664465, "uuid": "e3b5057f-c425-4525-b6af-942683302b91", "comment": "Malware payload (Formbook)", "value": "89a9b77261ed533dbce028de014c1e6b35ffae6419d2c9dc12178bfc49f7e5af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652664465, "uuid": "f40f9ced-c753-428c-a1c7-60f5e2c2bed0", "comment": "Malware payload (Formbook)", "value": "50d17bb2dd02c0f53676ff051cf463b07cc1be91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652664465, "uuid": "dc3b8657-cb49-46c8-a42a-9180ee465eeb", "comment": "Malware payload (Formbook)", "value": "1c52cbec2830bc440f442d2c7b66feb2676fd0d0432d00ce5e6f3e4b42992f6bde30f0c5cc26c9ed55822003012edfdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652664465, "uuid": "b85e8210-d524-4cdf-87a9-4b2a1a49e84c", "value": "T1E925AF61A1C5DA59DF2672F2EE5E8C3223A3ADC50051C6AAD17A33B68572357DC03B0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652664465, "uuid": "6cd71076-3c0e-4688-8973-592b2726295a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652664465, "uuid": "ca3d5a9b-f969-4929-9a47-88fffe628b79", "value": "24576:7jI2PNKAC+6OKpLeoP0MAfkxsBwoyGKnzRLslKAC+6OKpLeoP0MAfkxsBwoyGKnm:7jIqKAC+6OKpLeoP0MAfkxsBwoyGKnz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652664465, "uuid": "a43412b3-c670-40b4-97f0-ea69ed476fa5", "value": 989696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652664465, "uuid": "5d7214e0-2816-4866-9b89-c61c1a6c065d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652664465, "uuid": "b4e32887-6ee1-46d6-960e-e833c902ce1c", "value": "INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ed177c-d4ed-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652687655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687655, "uuid": "4689f883-0159-40a0-85c6-abf83b3aa6f1", "comment": "Malware payload (Mirai)", "value": "d8ea3bfb08de3dc0173defc00772caf3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687655, "uuid": "01460abc-ef42-4734-8eeb-a28eab7002ff", "comment": "Malware payload (Mirai)", "value": "8afba0d36bdedb0a08f334d9bbaf001d9ad1e4391db516cc85cbb70b117fcfcc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687655, "uuid": "1194c546-2ad1-4fc5-bb7d-e2984ba87d83", "comment": "Malware payload (Mirai)", "value": "04ebceed1ff0b6ba0fbad77b39ad5fea36508cc1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687655, "uuid": "879ee949-34d4-47a6-81fc-c50c42d5e31d", "comment": "Malware payload (Mirai)", "value": "46ccf2f808708e66bc7e1108e28145e200a735e65e98e16d870b28987be858f203b081fbca4b5ce02805fd990f60d027", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687655, "uuid": "3a16c6d0-ba22-4ca2-84e7-b365e307402f", "value": "T174535C34AD392E26C0D4A57E21F78365F2E6234E65B8D61D3C760F8EFF14A8068172B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687655, "uuid": "bce0c331-0111-4284-9cc9-d588b3a4257f", "value": "768:+VoUo3KSybT7h6pbaeoH4+Y5ZcVpKcogAWsyoU9twd8U4EO3mO+WGkz:+Vno3KSybT7h6pbaKcVpKBgAvyHfZkM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652687655, "uuid": "45023132-8ca8-4351-97e9-ffcb650e3176", "value": 62616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652687655, "uuid": "26d554f7-b074-4c07-be21-ced367fa3ed7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687655, "uuid": "6c209375-4f0f-47aa-a8dd-1d652c41d49d", "value": "d8ea3bfb08de3dc0173defc00772caf3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "639aa805-d512-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652703549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703549, "uuid": "cad9b65a-eb93-405a-b1eb-16c7bfe9f613", "comment": "Malware payload", "value": "278be31e57b284a909bfe295c1424c50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703549, "uuid": "26aa328e-b5ef-4a82-a93f-f19dd487b746", "comment": "Malware payload", "value": "8b23122d08b2c1a1d8217a51a156c68cefb2cdab4ffc58aceb048d21fbc54354", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703549, "uuid": "412b5360-cfb9-4c1e-b049-b19222b7f881", "comment": "Malware payload", "value": "7bc917dcce186d2ef2b05d5e87670e95d0121ce1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703549, "uuid": "2e72573f-2825-4f17-b97b-9d1eac95c0c9", "comment": "Malware payload", "value": "da44d93963def18b93d1d3e6b2c4d0d814d5c56eebb9b3fb90f861194282e00bd2f1948ab113c3dbf7f10565d7112393", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703549, "uuid": "fb78f9c8-f265-4bcf-a077-e78b1c6ee7e7", "value": "T1F4251202FAC189B2D6B11932497A7A11997DB5300F24DB8F93D44D5DAE316C1BB38FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703549, "uuid": "8fb4f143-1af2-43c1-83a6-a11307241fde", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703549, "uuid": "356bd143-3b3f-4e90-8c8f-fb89daa76df0", "value": "24576:XhvJVJdME7X+x55TxJZfG+5niTNBf+t3/T9sW9H33wqfS0ly+Y:n3dsrTxJPoEuS3Akl2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703549, "uuid": "17a219f4-362b-470a-9cd0-d6f277568c6e", "value": 1042256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703549, "uuid": "33d75a3b-58a4-43cc-9a6a-e14ff233a16d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703549, "uuid": "73da4311-c293-4ad6-9c37-287d2e62de15", "value": "Bekliyor Odeme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "341b7625-d519-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652706476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706476, "uuid": "7bb65783-18ab-44db-b863-bda84f14e132", "comment": "Malware payload (Mirai)", "value": "a9e108c90c57d673130497871123453b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706476, "uuid": "1f6d5e6f-6db1-46b7-9647-75e310425b82", "comment": "Malware payload (Mirai)", "value": "8b69d3bea0c130945d47fff38203e6a48e4f524390184a9eafa378982c1eae98", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706476, "uuid": "a5b18411-5f0a-4b62-b593-05be96a1311c", "comment": "Malware payload (Mirai)", "value": "92fb5e78f9a660e6a4e0f41a9cb2c7df87b9d3fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706476, "uuid": "31d2bc03-bbca-48b9-b23c-8ff9856ee9ae", "comment": "Malware payload (Mirai)", "value": "5bb45c2e6b373e19a4e7bce69e09933292df410dd660e0a9c37699c8047770be4ee643e4df87a0849bbfa8609dfd9271", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706476, "uuid": "9e823c99-bbd8-41c7-ac69-93487072400e", "value": "T12E732814AD7D2E27C0D4A13E12F7C716F2E5360E24B0826E3D790F8EFB54790A9466B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706476, "uuid": "dd01246b-3b07-460c-a548-1bf0c551ea07", "value": "1536:C0GOL5xSf75nuTRn7eNph+/IY/Whcrye6KtmgFZFPZwJ:p5L5IExY6LMcrbt/bZwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652706476, "uuid": "c40bf09d-0f8c-4037-9cde-524d5e362e7c", "value": 79544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652706476, "uuid": "1a610c80-7d39-4e21-9170-3f6b5d7d6f3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706476, "uuid": "68528a2c-139a-4547-9061-4f024820b85b", "value": "a9e108c90c57d673130497871123453b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "539f7d47-d539-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652720273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652720273, "uuid": "700fa0c7-2758-4be4-90ae-0a0c9acf09ba", "comment": "Malware payload (Heodo)", "value": "5595509a09bd1e51a4fc62904d106676", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652720273, "uuid": "18b61158-725a-4c78-8d38-3aeedb096bbc", "comment": "Malware payload (Heodo)", "value": "8b9f1a13c6473780251861aa94c56a061b0b355a4d1440e09c6d1a903a3efcf1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652720273, "uuid": "e0668b22-13fb-40eb-bce1-c520662fae59", "comment": "Malware payload (Heodo)", "value": "5e3136483c4eab86d31bd621825c78be129144ec", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652720273, "uuid": "bbf88c5b-5238-4c4e-8b1f-5df1ff51f441", "comment": "Malware payload (Heodo)", "value": "e308edfa66ddebcac1d7c9ba42cb55063cedc82eacde8b0f2b2841f59dd2c06fcbb7469b620fcb23cb62af94d7b5c493", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652720273, "uuid": "2d864c34-0143-4f88-9827-d822865f5af0", "value": "T1DB74C046B3A840BAED678338CC535647E772B45A4B70A78F13244379EF2F3915A3A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652720273, "uuid": "c2c9ab4a-0f69-455c-96ab-84bcde0f46d6", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652720273, "uuid": "05b2a7dd-1f17-4eab-a4e1-77146c2c88d6", "value": "6144:Es/2WX22TR72tKbxGebkr2rlsy+vbEFXYvlx6xJkUjnKd:Es//Gi7/bgDvQFXTH9Kd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652720273, "uuid": "2128af80-b5a8-43e0-8b37-14a96a77773b", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652720273, "uuid": "c174df2c-f040-4287-a14a-ff1a69d0029c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652720273, "uuid": "f11c3f55-f272-4626-8b5b-9ff53f7182f3", "value": "5595509a09bd1e51a4fc62904d106676", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0630c1f1-d542-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652724009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652724009, "uuid": "d8e8f32d-b6fa-4929-97aa-ca765c798614", "comment": "Malware payload", "value": "2cf66158722e1202ad8d10289f240362", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652724009, "uuid": "ab211d70-1665-4185-9703-67d1f358014a", "comment": "Malware payload", "value": "8c9e6bd1e05ac20d07e61456af2e5e551577efa961f6ebe5c80e2427bd176d2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652724009, "uuid": "65eab831-3bd6-44f2-ac17-4a7192b89903", "comment": "Malware payload", "value": "8abf1ca96d36abb07db3f043e96a12d7045b07fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652724009, "uuid": "0143fd38-6fc5-4d89-887c-b9ecec21ca45", "comment": "Malware payload", "value": "2e9c64e6a29a00b2fea99bc2eb6c448ad503cfc19e5e98df803357125d9da53e889a72de9705b18e48d2d0e01cee3eff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652724009, "uuid": "a1d38f4d-7300-42a2-9f69-c4a934aac033", "value": "T1B784C04573A48079EDB79338CC574A47E376B86907B0678F1364436AAF3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652724009, "uuid": "c6041c35-938d-411b-94e6-c4b226d52c4e", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652724009, "uuid": "553c2337-69b1-4d6b-84e9-7043d957d0a7", "value": "6144:EbmRW/X22TR72tKbxGe0kesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/0pRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652724009, "uuid": "4ef8644b-c07c-41cc-b241-e309ee21ce55", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652724009, "uuid": "28623d0a-87f3-4931-b17b-8327911fb24c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652724009, "uuid": "40271bdd-19de-4201-93bc-2c4624bce0f5", "value": "TgX4lzNEA.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e410574e-d511-11ec-8e58-42010a9c0032", "comment": "Malware payload (RemcosRAT)", "timestamp": 1652703335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703335, "uuid": "9c7edc34-1a0a-4c2e-b365-5a2537923e79", "comment": "Malware payload (RemcosRAT)", "value": "eb70896dfecd729dbb5bc19e429b7194", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703335, "uuid": "deba3a9b-8b86-47ea-a325-bb5de4925452", "comment": "Malware payload (RemcosRAT)", "value": "8cb94f618aa9f2f7ee556c171d02648fc7579673be18dd6a275826ef60720ebc", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703335, "uuid": "a4f9ec3f-5b44-4026-941b-1c5d050f3377", "comment": "Malware payload (RemcosRAT)", "value": "dfdd6b6b706be7b5272c62a3809ba28a28ea7cbc", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703335, "uuid": "ed2eab9b-0c2f-48bd-8c17-8e150d9a8550", "comment": "Malware payload (RemcosRAT)", "value": "585a861d2de9775cf6f58d57b47bb0047ef443c942c6493ccdf3c62e2e1a65455e0c007a8ece10f0b597301bbd8c04fa", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703335, "uuid": "ddc35274-165e-4bc9-abae-c927d8754878", "value": "T1392412483F3694AFDBDB9E344435D0662C67DE238FCB521704AA367C6138C252EE2293", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703335, "uuid": "65d4f722-82d6-46c5-8c06-b7d96e691342", "value": "6144:0a3q1UM6Gx/caKhdlNavB3KTb5yyKmzy7ZIEjXoM:0coUMzl1cNavB3KoyKmzxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703335, "uuid": "d5c6e76a-8e7d-4321-8bf1-f1807a49cfa2", "value": 228936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703335, "uuid": "ff160d3d-0c07-4098-91b1-8796e73c17cf", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703335, "uuid": "c833d6ff-1fc5-424a-858d-b6aa550d64ba", "value": "NEW_PO-INQUIRY_LIST.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b9f13c6-d512-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652703455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703455, "uuid": "a2c5e747-b3bc-4041-8b61-685082bff238", "comment": "Malware payload (RedLineStealer)", "value": "ad95c6a895478d0fa99462f69a710190", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703455, "uuid": "446c203a-7722-4ff5-884b-f8d892f9d53e", "comment": "Malware payload (RedLineStealer)", "value": "8cf21b1b10b6793c5cf45d16bda93cd71e1171559068a156bbaa68d1204cb9f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703455, "uuid": "e63e5584-5d6e-44b2-ac36-bfce1c0a6df7", "comment": "Malware payload (RedLineStealer)", "value": "ac93857e5ed2ef6bccd3a9538359026806fcc593", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703455, "uuid": "1a733306-ffae-419a-a8d0-67f09bd02529", "comment": "Malware payload (RedLineStealer)", "value": "d805abbd087bb4d6733d31d2bd731b4fe094e30f084c7b64d1a730e540d303ab378f59184db7e2b411a4a25048bff549", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703455, "uuid": "f8787907-a302-4135-8478-a4224ec0e2b8", "value": "T14F94F112F790CC35D0861D3084259BB29B7BB83266726947F7906BAF1FB33509AF531A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703455, "uuid": "eb09be72-13de-46d5-9d1a-442b4699afac", "value": "1aa8a0bb9714464b5f28dfcf2c93afb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703455, "uuid": "13d0daf9-a18d-47e0-a0db-3e2e347ee157", "value": "6144:hAGCDvLJE0H1GVTyGJPsganpxsDwqg1xoPjDeiga3wVf+:yGCDjJE0H1GhyYPnDR+MDTN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703455, "uuid": "ba6be440-b865-4c17-980c-0ece14216ab2", "value": 410112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703455, "uuid": "cc62c508-d791-49a6-a4c3-e14e56bbb974", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703455, "uuid": "460fcda6-3aed-44b6-be9a-8a2734083a72", "value": "Offscum.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "599a6bff-d4ed-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652687641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687641, "uuid": "bcbc2f39-22ab-47aa-ae5a-0dd4be8ed65e", "comment": "Malware payload (Mirai)", "value": "ec30d5fb94d0d600c59cc08a74ecbaa5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687641, "uuid": "6ce4095a-aabe-4e9a-b553-ad8b6e3aae5e", "comment": "Malware payload (Mirai)", "value": "8dc39cabee9be052d4ab0fd8a2fbe7c7ce20c6bb166505454d874e800de25206", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687641, "uuid": "aeffb412-0bf4-429d-9000-079bae3ded19", "comment": "Malware payload (Mirai)", "value": "1d2e0c55913955b250c634ed81d7f56587326594", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687641, "uuid": "d79a14cf-eb1a-453e-9c86-778efec02659", "comment": "Malware payload (Mirai)", "value": "02482d018dc4b760787d922cc24d8d9de5a2a1981c32d5329994a74b8c195d3bc853655d89e4238bd925f687d2e767e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687641, "uuid": "5b78f76e-507f-4cf8-9242-54a7d6a7c78b", "value": "T1A3B2D0DC5B118468EA6FC17D8EE517A4AFA40BB66582CC473558F1E27F8B8F43C42E80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687641, "uuid": "18d064e1-92ef-4914-94e5-c45ef63b3812", "value": "768:1Ztjn4pBIUUPOFStadA91jXJsJgGlzDpbuR1JNN:1ZtjutUH91yVJu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652687641, "uuid": "4e462a0c-5efe-466f-811c-bee441b0aced", "value": 25420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652687641, "uuid": "16609183-73df-4b59-aa7f-1adf80242a29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687641, "uuid": "523c286b-a056-4298-8302-2523ff61765c", "value": "ec30d5fb94d0d600c59cc08a74ecbaa5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5c150ad-d52f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652716169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716169, "uuid": "e68b120a-7830-479c-a97d-4426b3515efa", "comment": "Malware payload (Heodo)", "value": "f4133ebdff5bdab6db4b5cc89794d772", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716169, "uuid": "994d9f1f-a8b3-4a57-899d-ef80d3599e43", "comment": "Malware payload (Heodo)", "value": "8de0ce1f89655a2a4991a4fa7095a8fb5106e8cba6e8eee6759a2bb2bbb4dc41", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716169, "uuid": "7a0ca533-de6e-4b81-ba64-83bd5e9bfcf0", "comment": "Malware payload (Heodo)", "value": "922c2a4e0f70a06e9f53f5da2410dea490d4efb8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716169, "uuid": "63e91db7-fc0f-4321-975f-2361f6c7250b", "comment": "Malware payload (Heodo)", "value": "2dbc1521f3f8a23d42170f0f615f1da5faf83347780db88e5229cb808c8c596a44314901be0ccba7c8b189d985a93ee8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716169, "uuid": "1b1ea206-800b-4410-b02c-a55f19b9610f", "value": "T10B734A4AB98AC96CE615C739499743A9B313FC114FAB078B3109F3727FF49A05A0761B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716169, "uuid": "2cd7c508-79a4-4a46-92df-a7893ef12749", "value": "1536:tpKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg5AezwrMCtvJecvRtbTNFM:zKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652716169, "uuid": "387c8f78-56bc-4cbe-9ca5-8b6b4a148871", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652716169, "uuid": "044ca4a6-10fb-44eb-ac0e-cc24f98dca01", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716169, "uuid": "d0b0f0de-98a5-4e93-879a-0674f65c51e9", "value": "d 17151.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bfeaf1e-d517-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1652705711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705711, "uuid": "071297b0-e7d1-46a7-abc1-758afc9f6c6a", "comment": "Malware payload (SilentBuilder)", "value": "8c75f5f6516de76fb196e06811e99544", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705711, "uuid": "66bc7f72-ef9d-47d9-9afb-9ba80cda9c88", "comment": "Malware payload (SilentBuilder)", "value": "8ec4ba22ca47d0d26ad0468679dff04236413e1c0a1c14aaa2165f2c6cd9e433", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705711, "uuid": "ba35e02d-2db2-48a7-b02c-8fac68841e5c", "comment": "Malware payload (SilentBuilder)", "value": "a926bf0ea3cbefb2a6d1fa0ceba0d735239af3e8", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705711, "uuid": "babd5066-086b-4582-b369-c0da0a8258a9", "comment": "Malware payload (SilentBuilder)", "value": "d3e81482c06c2642c7e57b0ddba4d542f3e2a37ce4a9a5bc951af70277759958b71a989a57a87ef72e12d0e9f8b66ca2", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705711, "uuid": "b73c30db-44ca-4c49-ba74-730b0a281b75", "value": "T127734A4AB98AC96CF611873949D747A9B313FC110FAB0B8B3509F3627FF49A05A0751B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705711, "uuid": "a10f5966-c53a-4f5d-a662-83e2747dfbe5", "value": "1536:tpKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgCAezwrMCtvJecvRtbu0X5m:zKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652705711, "uuid": "034ee3fe-dcc0-4e4a-8363-470037f72bbb", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652705711, "uuid": "2e75621b-c8e9-4d1a-8666-6eed8d04fe4b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705711, "uuid": "7ed268b6-644d-41a0-bd8b-fbfb1cdb6b7f", "value": "UP24191041952552894870.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "397bf165-d51c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652707774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707774, "uuid": "01aba98c-1322-40ec-9139-45ee598b81f6", "comment": "Malware payload", "value": "fd88575a9953c58e4102e95728d0a2e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707774, "uuid": "adf5c4ad-60e2-49ff-8289-7ea457eb40d7", "comment": "Malware payload", "value": "8f417664ec8502b41a4b1708d10d7fa2fb1896643f81a74645f9c72c6c8d4a97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707774, "uuid": "ca7016c1-7e9e-4904-b1f5-6c30e52ac0fa", "comment": "Malware payload", "value": "8a9eb05d4ec50b3269bf73e0202734313e6eb6d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707774, "uuid": "6458a679-d293-4bff-b71f-60493c0ae276", "comment": "Malware payload", "value": "175d9a390421753b6746bcdb9c3f9e7bf2a48c46fb10583ad0afcbfdbedfafb065f41a493d840326437d903c85413fc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707774, "uuid": "0f374bc5-8b7b-4faf-8c14-dbfd4019d2f0", "value": "T13906398622B944E8E4B6E8B4882B4A17E7B1B845073587DF01B5669F0F376F16D36333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707774, "uuid": "a7bd53d7-e448-4641-ace8-b1b193122f7e", "value": "96823372f7c0fa6569091c3775118bad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707774, "uuid": "6fb2a706-1747-4906-aada-9a7911b1c2db", "value": "49152:q02FpPi9Gw9as5IWoT2UxjQfrO14Gw6w0UNFa9YE7GqmyQb1WFlQmR8yK:0FpyNFa9YE3QbUFl8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652707774, "uuid": "2e4688a1-eba1-44c9-a093-7e5629ae3818", "value": 3696128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652707774, "uuid": "65909836-8ce3-4111-95e4-d63f1fa3233b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707774, "uuid": "99feee3b-777c-4e5a-91e6-7e5e4b2c32d5", "value": "\u70b9\u200c\u51fb\u5b89\u200d\u88c5\u200c\u200c\u200d\u7eb8\u200c\u98de\u200c\u673a_\u200d\u7b80\u200d\u200d\u200d\u4f53\u200d\u200d\u200c\u4e2d\u200c\u200d\u6587\u200d\u8bed\u200d\u200c\u200d\u8a00\u200d\u200d\u200d\u5305!MTI=_1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "541a82d3-d50b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652700517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700517, "uuid": "01eab7fd-6736-43bb-b4cd-1fdceb24ab8e", "comment": "Malware payload (SnakeKeylogger)", "value": "8f7c10228455ce4827464b2a905e6128", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700517, "uuid": "9436cd63-65cf-4a1f-ab80-462ea527fc19", "comment": "Malware payload (SnakeKeylogger)", "value": "8f9c13afde6d56ea7a73c6182da5a6bf960dd9101894a5e4280f4545375250b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700517, "uuid": "7519caf5-3b44-4ad3-a1a2-841d4edbfe64", "comment": "Malware payload (SnakeKeylogger)", "value": "7312254500be6eb2e5852e0a15d3954d0734452a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700517, "uuid": "90873084-459f-4220-bd56-29f7e68d0473", "comment": "Malware payload (SnakeKeylogger)", "value": "63dbdd7b2913f565e32f2d7b0aba69a70ce402f6bdd642e9f2b06beb789c0961255d5dc752318f196b155f4bb07401de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700517, "uuid": "aa7bb549-6b36-4386-ac12-4277ac479e0e", "value": "T1BAF4F000B6DC78D0D89ACB781D52F59005B5AC5FBD62ED1F2EA7398E6932B011231E7D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700517, "uuid": "d34e7133-6c84-4aa9-80e7-eb0039e2d31c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700517, "uuid": "e7c0e9a7-f239-421b-b4cd-7ddbb38060c3", "value": "12288:Pu9m4vz3vZC5r9to3DO7HSGkCRDB2bC71x1Tw/O3jgAduJ/:Pu9Pvz/Qxo34HSLI4qlTwWTgAdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652700517, "uuid": "9374a8eb-f564-4758-b952-7a31cf0d429f", "value": 768512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652700517, "uuid": "2554d1a1-259c-444d-840f-d5940dfe1189", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700517, "uuid": "1052e67f-3500-4ca5-9dd1-2eebc22ef522", "value": "requirement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8437f687-d4c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1652670962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652670962, "uuid": "1db48a2d-a2d0-414c-baf3-ae99e88e8fef", "comment": "Malware payload (YellowCockatoo)", "value": "4750b764c38c6b0b3f28ede944fdca2a", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652670962, "uuid": "68317414-d133-4f89-b927-7c5d5cb68fda", "comment": "Malware payload (YellowCockatoo)", "value": "8f9db949c11d775ead140f4e9198a1dad03eb12bfcbae43e852613dee573aec9", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652670962, "uuid": "30da3943-3507-4991-81a0-ebea202836ec", "comment": "Malware payload (YellowCockatoo)", "value": "7d1245d59feecae546a02c62149d78c6e3186de6", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652670962, "uuid": "26193cd3-bed5-4745-88c3-b8be3d180a59", "comment": "Malware payload (YellowCockatoo)", "value": "f8c7c1fab578da1cedd9677586aa48433283e205f5d18b327210ab703a21292127e11a376b6fad3dcb6283de8289f13d", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652670962, "uuid": "991c379c-8a99-43dc-80e6-8e2c3f396f9e", "value": "T1D695236F68016F49C324D5EB0FCF99343EAB06BF9E91BB13B9126453EF80489B019957", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652670962, "uuid": "df45320e-43ee-4be1-b7c7-7113cbf4aa20", "value": "24576:mNzm9qNVpPDh9AMxEWJvD6wtSCl2DHiMYflV0eQQ4x7Ij379dW/d2CYXj0sXomtN:Im9qVHDEfdd3sV1QTURAcCKloiRaDmR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652670962, "uuid": "72f9802b-b5c0-42ba-b4f3-63a469e0008d", "value": 1946952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652670962, "uuid": "e1a3d844-ecde-46d2-823a-4f0905b85265", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652670962, "uuid": "2a48c680-e8e0-465b-a6ab-724f9019f260", "value": "What is a sox.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db7d0ae-d54c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652728397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652728397, "uuid": "e28b1054-a056-4c49-a165-4f21010614aa", "comment": "Malware payload (AgentTesla)", "value": "a19b6206919a5f688b2ca197590000d8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652728397, "uuid": "defa39ed-0ad6-401d-9e7e-cf648bd39a7c", "comment": "Malware payload (AgentTesla)", "value": "8fc66679e063f1fc886223ae11e44b8c61835ee4a831af3abc533f8c8ed30cd2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652728397, "uuid": "d17dcd9a-cfc2-4949-8eb6-47ca2400a2b3", "comment": "Malware payload (AgentTesla)", "value": "fde7756e1dd646dc3644b69065f84140e7c0ccb2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652728397, "uuid": "c9510cf8-6f14-4e65-9b2b-1cef16a55553", "comment": "Malware payload (AgentTesla)", "value": "ab33e3779324b9ec22204750ca3c3893044c16772cb3ba325f79c0702292d8277b8e4e506b69b068ca580b7057cd29de", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652728397, "uuid": "40bb896b-30e0-4c1d-804a-97c51208cce0", "value": "T190E4C044772C2907E54EDA385992BF0C42708DAEB653E30BF763F87E6D2A7409E4531A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652728397, "uuid": "1712cfe1-a110-4835-8b16-a32dda562fcd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652728397, "uuid": "f41a69af-30c9-4b9f-a10c-ac14ded40753", "value": "12288:4RlXPVKDlBWFN7/1hX/fKB2Ss1WFFHH+HHHHHWHVHCUXGHnHHhHraH9HMx9SYR1t:WlwWFN7DX3KB2AFHH+HHHHHWHVHCUXGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652728397, "uuid": "7ea15d8a-340a-400e-b4e5-cd83d2129fc1", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652728397, "uuid": "47d84a97-c5a8-49e3-8b18-b260b21476bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652728397, "uuid": "f9b413d7-501f-432b-8fb9-e7658d8e7e36", "value": "TT COPY (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "561848ef-d51b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652707392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707392, "uuid": "be050819-d224-4f72-a7fe-60dcb9641fdf", "comment": "Malware payload", "value": "7708e712889b239a508ed8f4339f1d0b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707392, "uuid": "9ae76652-792d-4e90-a6fd-1f03bf0b86ea", "comment": "Malware payload", "value": "8ff19d8ae3d48bed91963633eaf4fe35d96eca6c6bfa0dd4fe4cc54b4492c2d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707392, "uuid": "6f4f3d48-07ef-4fbe-8000-d92bd9cb4822", "comment": "Malware payload", "value": "fcd1d1ebb53a5cdecca4c6d94e565ebeac9e6077", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707392, "uuid": "9f40a65b-4304-4612-a836-e7ae4707b787", "comment": "Malware payload", "value": "412cf67041cce166d5c5e6b90ca5667f62a5599b2a97d562964249a2fb72a4deb8edbccbfcbff79d0c8031ada1c9b3f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707392, "uuid": "1ebb13bb-8d96-416b-a727-920e2c7790e6", "value": "T15CC4E0AC721472EFC85BD575EEA92C74E62070BB931BA217901745AD9E0CA97CF180F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707392, "uuid": "82a70f69-d3e3-4f54-8fd7-8afa4bd0bd49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707392, "uuid": "4a15b51f-2bcb-4859-8b8e-a849bacfc205", "value": "12288:csjp02oHQqT5XlxmxRHdRjqitY441Rc4pIH5Avz6K6Q:5owmAHdRjqi+4eRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652707392, "uuid": "0f52b329-db36-41d7-bfc4-dcc954285c1a", "value": 576000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652707392, "uuid": "6b624bbf-969d-400e-b0a2-7a5cfb749d7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707392, "uuid": "2751d0d2-d402-40f2-8047-e51336b51d48", "value": "7708e712889b239a508ed8f4339f1d0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efa246f7-d4f0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652689181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689181, "uuid": "6409a28c-e386-4183-836f-e86746ebf3b0", "comment": "Malware payload (AgentTesla)", "value": "73e2ca422b5283684e4cecda46f6edee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689181, "uuid": "7841ca60-64c5-4765-aa85-9a4b9f408025", "comment": "Malware payload (AgentTesla)", "value": "900a063103812fe372312c706c1faa00a8275efae23ffc62aff7810f3af29f68", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689181, "uuid": "f3df15af-bf00-41bc-b2fb-0eb14e5a7c9e", "comment": "Malware payload (AgentTesla)", "value": "9e1f9c6f73663744eedf1c18cf29ab9df133ba91", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689181, "uuid": "86ce4fd1-4bab-48dd-89e7-1cd814943840", "comment": "Malware payload (AgentTesla)", "value": "552df8678326ca2c60874c076ea93df12fa2375cba36a1ae3dbd49495ff7cb73391b4261448bc43507e4a1f6c26a60bb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689181, "uuid": "3b1b5385-a5de-4ef9-804d-3f10f484c631", "value": "T18BD4F0AC711472EFC89BD8769DAC1C24AA6074BB531B5217A81745EDDE1DA8BCF100F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689181, "uuid": "076ac8ae-5241-439e-8b3b-1ef01e9e7e34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689181, "uuid": "27d0d7e0-eec7-4954-9959-1fa7c1a1b97c", "value": "12288:bk3y1Wo034yaTdjkFgs6d/fWYZ+85deWggH+7E1eLl9VAOWorJq3G86Q:bJo4yCYCDZfWYZldesd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652689181, "uuid": "b1f57e2e-785d-4899-9a8c-7ebc1dea38db", "value": 630272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652689181, "uuid": "34972873-af07-4e86-a8eb-069defc83dac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689181, "uuid": "e34af48f-14f2-44fe-888d-637d787772bc", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c1eef3-d4f9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652692921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692921, "uuid": "dd48656e-8a26-4321-91c9-2a846245034d", "comment": "Malware payload (Heodo)", "value": "96fd4f85a9697ec252ebba98ce071d26", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692921, "uuid": "c7f69d6d-6d70-4101-b3ab-15dfe2021850", "comment": "Malware payload (Heodo)", "value": "906e7bb5573610c8e90b5276c32b759e836f1e102caf1124ff00deb3d2d6e908", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692921, "uuid": "da2c74a6-3b87-4905-8bfb-fb96d7f2d178", "comment": "Malware payload (Heodo)", "value": "0aa0c781e12033cfc4ab3dc88f237528402e571f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692921, "uuid": "028e0775-1eb7-4ea7-bf11-5805674b3a3a", "comment": "Malware payload (Heodo)", "value": "e09db482da11ff4461ea6bc3d0ebd4fd04322686859e082969f3ac2f04d9fa78ed0c84056bf33d732442333b40c3e124", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692921, "uuid": "52c4ffab-df0f-45f3-9a45-a3abb5933e66", "value": "T1EF055A35FB6C8492C6A3953D88A34B06EE6AFE840B6183CB1290733E9E777D45C35671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692921, "uuid": "eba57099-82b3-4ed9-af73-9ae2561b15dc", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692921, "uuid": "866e1609-fde4-4434-beed-2ffaced26f2d", "value": "12288:Q9983x0oz0/7aG8GkZHFT1YicDAXmvQaZsbNg:A9UuozAWGxGx16AWvVZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652692921, "uuid": "35830a74-b181-48a5-b4f0-5ad2c7adddd4", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652692921, "uuid": "5ce4d839-5b40-4cfd-a98e-37da7558bbbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692921, "uuid": "67bbe6d9-b3b7-49ca-8ae1-1e688d53ca1b", "value": "96fd4f85a9697ec252ebba98ce071d26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3389c7d2-d53e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652722367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722367, "uuid": "a90f80c7-4316-4d85-99a4-d9623c97351e", "comment": "Malware payload", "value": "7cb17155fdedcaa1a61e68a6b7e47163", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722367, "uuid": "c5372d92-d96f-4753-ad50-abc8851b0f9f", "comment": "Malware payload", "value": "912fc02f852a25231859ee7db52514bff980e5163e009c531f804ee88759ed70", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722367, "uuid": "520584b4-61c0-4f2c-8c26-38541c125987", "comment": "Malware payload", "value": "84b14e7d92e79fd3cca08905a6f8b20ddb899b62", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722367, "uuid": "c0057d3f-efbb-44de-9915-5267659f0493", "comment": "Malware payload", "value": "fa71461ef7e781304278d55b45b632504e16213557517a68216725fa61d0d8233378e1579a21568a1cecf83d918727da", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722367, "uuid": "268f471b-7479-4064-bced-3867ab8d468c", "value": "T1B0A51227F6699957C8F2D33321B4223614374D198F83EB862D497BFE68B79E84B452C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722367, "uuid": "8dbb1097-3e29-484f-ab97-87be2878fa35", "value": "49152:F/YduA73mMwtBC0wyOCW44NtuCrwPWNa3osU8x9P:dYu23wzC0ICWznrmWlsFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652722367, "uuid": "87e8d220-a4ee-4b8f-b87a-70cda8bfd881", "value": 2068690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652722367, "uuid": "b8d06769-c02d-451b-80b1-92197755e774", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722367, "uuid": "9022a6a0-6f98-46ab-bb58-ec9e700e9841", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3885e697-d55b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652734830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652734830, "uuid": "5ce8158b-b691-4464-a035-09606dc17e9a", "comment": "Malware payload", "value": "1072a4250161a22f7e44ff22a92c8876", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652734830, "uuid": "fad003d7-f50e-4125-8172-a2f36bc04b9c", "comment": "Malware payload", "value": "9145af22fb77e861380ed1c3e22de36d6895a24df8ddfe4a87db35705214b246", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652734830, "uuid": "efc2402a-857c-434d-a296-8241c791947a", "comment": "Malware payload", "value": "668fd6431870b94d4e77ed9cf9fa8de828246233", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652734830, "uuid": "400a2cd8-b7f8-4037-9755-29814b2e75dd", "comment": "Malware payload", "value": "13517935ddb20b230f5b267bd98972317cbf9f18ed965dfb2f7892272b8cec9e72dab9532706d47a7aa0422105084559", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652734830, "uuid": "12be8078-72dd-4acb-a2e7-a91cde565600", "value": "T10C74C046B3A840BAED678338CC535647E772B45A4B70A78F13244379EF2F3915A3A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652734830, "uuid": "13d2e853-855e-4fdf-a47e-634f928e0363", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652734830, "uuid": "729870d6-dc86-4cf3-9429-b95aaf9a3106", "value": "6144:Es/2WX22TR72tKbxGegkr2rlsy+vbEFXYvlx6xJkUjnKd:Es//Gi7/ggDvQFXTH9Kd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652734830, "uuid": "42c44a03-c9cf-49ee-866d-2e34d6b43ef6", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652734830, "uuid": "566de75c-1f46-4295-9159-ded70490e9c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652734830, "uuid": "8c89c36d-d149-4729-bdb5-1f15c034c1e8", "value": "1072a4250161a22f7e44ff22a92c8876", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ffa2b3-d518-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652706052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706052, "uuid": "f0123783-b3ff-40e0-bdab-2be6470f10d7", "comment": "Malware payload (Mirai)", "value": "f62a9dc8992843ebf027726440ae5e08", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706052, "uuid": "b61afcf0-f3d5-4dbc-ade5-a482b93fb8c6", "comment": "Malware payload (Mirai)", "value": "91fa40e964bb22cf9f916ecf5dc1f6749905e1bbca81a84dda3d6281664364a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706052, "uuid": "f3602f12-ea70-41ea-8ef1-f9fb5e8973da", "comment": "Malware payload (Mirai)", "value": "65b753f073ce7d0e17f182200c1a016b9b6ee6de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706052, "uuid": "e5057c3b-cdbd-4294-a902-d2aa9f210512", "comment": "Malware payload (Mirai)", "value": "685f00a46e3e2752f40471a0e904d6e1e0962a3d178e18f62f008f3374c78b3148eb85d0154024d2e847366cdfc2fbda", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706052, "uuid": "b07271b2-4732-4136-bdb1-21d4bc43e391", "value": "T162638C7695789CA0C1048AB1B6ACCDB48703A80096B77EF5CAC5CF5A5807AFDF1097F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706052, "uuid": "8ec125e0-0904-49e9-81c1-52b179e98cb5", "value": "1536:e/4jT0azwt+DUiGt1J5SmJeYRmzdOYF4ix0oC3vy:egj4InUlTJeYM4ix0oEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652706052, "uuid": "f15da5c7-5ab5-46a5-8797-5d193b3afe6a", "value": 70648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652706052, "uuid": "ecb62d38-7703-4e2c-a810-75830b343aed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706052, "uuid": "f29ba81e-0423-4f2f-b3a3-9620730fad25", "value": "f62a9dc8992843ebf027726440ae5e08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aafbcf3a-d4bc-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1652666732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652666732, "uuid": "61a268b1-4a67-4876-87a5-0c83932de68c", "comment": "Malware payload (GuLoader)", "value": "a542dcfb7126d80cb5e81b815b65fd9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652666732, "uuid": "842b7078-4d7b-46b0-86ad-2b54f99cc943", "comment": "Malware payload (GuLoader)", "value": "9287a3effb8d1e7e3d93722363bd26a8b6ed5eaac7df5dab5e5aa3e271ffaf17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652666732, "uuid": "ac2898ec-77a9-4533-a977-8bf6a0f76cb1", "comment": "Malware payload (GuLoader)", "value": "42e667a0ec0f14fdb20d5006f63d95afe27409fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652666732, "uuid": "bb2ff560-dad4-4876-b8d2-fb6eeb1bdc33", "comment": "Malware payload (GuLoader)", "value": "0044116dd304ebcc818d98062b1e1792e2775c49240eeecb0b1bc4d856ae2d7c37c9cd36db89ed8b9b0052de96bd7f22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652666732, "uuid": "02ff1d80-df97-418b-a83f-a7117ad49fd0", "value": "T11784E10EFA68C443D7D81D319CAB46361A16AC1A55640B4A377CFE1B3DF6063981F3BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652666732, "uuid": "b9f4ccd6-7b85-4ee2-8f5c-a1b8c225cf75", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652666732, "uuid": "ad8715e6-aece-404c-9c94-5042b3196997", "value": "6144:sNeZpRYlWxMJhkmEUqNE2E4JE80ALie3sBhcfXVtidWpeZXGFAE4i:sNmYlYM3jODBq8VL33sB0XVtibGCzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652666732, "uuid": "05d7d7b3-76d9-46c9-802c-f5142b821539", "value": 393030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652666732, "uuid": "316fbbe7-5953-4ae7-b829-adee07f6aac4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652666732, "uuid": "7b4cca27-8103-4517-be2b-6eba207feb3b", "value": "PO6R727632-5642468.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbe19bee-d4f4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652690813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690813, "uuid": "44a4aed6-c1a7-45fe-938c-5b935e21ec15", "comment": "Malware payload (Mirai)", "value": "ef41ccc6ae50613f92259cb1c09ce828", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690813, "uuid": "3185aa34-fda3-4482-b8b8-9a6f96fb2f2e", "comment": "Malware payload (Mirai)", "value": "93a37895d78682bc595708b6ec9da36f45253ecc9424845cfd097692e3491dc9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690813, "uuid": "35aa8f30-8ce4-4da8-ac37-fe340efbb405", "comment": "Malware payload (Mirai)", "value": "f5a3ee938e6494fc6ca9e8e00e2f3572686e2f47", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690813, "uuid": "d6bb8cac-e087-465b-80a9-8a079585d29e", "comment": "Malware payload (Mirai)", "value": "208d2c9c5feb98ff14d873f239ed673fb940bbf5278ed75a8084bd975cbf1b2c25d0060634de7e68b50bddf796fa70f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690813, "uuid": "94a19191-5eb1-48ef-a5c1-d9161f78748e", "value": "T1DF638D66D419AC94C4844338D4E28B792BA3F804C3772DB6AED585BA4047EFCF9193F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690813, "uuid": "8df32e32-8c27-4dee-bbeb-fe0c305e0610", "value": "1536:Wap3r4p2SFaRRFzwtkLWA0VQQT/NsHB0ulvjj2CT6:Wg8kSsRRFzMyv0Avjj2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652690813, "uuid": "885883e7-74ce-423b-bd79-2b9debe7fddd", "value": 72256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652690813, "uuid": "d75ec626-3943-4c10-91f0-f8bd2a92e226", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690813, "uuid": "5b6aca2f-52f0-40a6-acd8-13913195d731", "value": "ef41ccc6ae50613f92259cb1c09ce828", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98a13329-d570-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652744011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652744011, "uuid": "71774243-ffd2-4415-935d-563e30ca4ad4", "comment": "Malware payload", "value": "3d1bb54ca1c67e42e80bf019feb5832a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652744011, "uuid": "70de2cab-0016-491a-bac2-2ea151b6f018", "comment": "Malware payload", "value": "9417a5c6b4e38bbb67f49c77b23cbe283c52226cba435e7afe7c376906ff6394", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652744011, "uuid": "24fdc73a-55fe-4c94-931d-786db08c93b7", "comment": "Malware payload", "value": "57e81d3ef1505bf40c29d32d3a2fbbd2689aa8f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652744011, "uuid": "b737e42b-3eda-48c5-b9ac-fe29729a1b05", "comment": "Malware payload", "value": "a2fbf8d0347c7bff4c1bb72f850229a93c7d66b182ddbc5f5286490276352f7b2bcdf79f408e2654a4ae7b94502b2235", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652744011, "uuid": "64bf4a3a-d10a-487d-a65d-b2773a0229c4", "value": "T15D84C04573A48079EDB79338CC574A47E376B86907B0678F1364436AAF3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652744011, "uuid": "c2396c44-6c10-4f13-b12b-7b852612ed77", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652744011, "uuid": "d60dc9d6-591f-4ec4-a33a-9b29b07c064d", "value": "6144:EbmRW/X22TR72tKbxGekkesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/kpRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652744011, "uuid": "cd2e9be5-bbfd-4b7f-8896-bf21d53cc50c", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652744011, "uuid": "c05026da-4992-4a60-954b-e71c5bd928d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652744011, "uuid": "48c9070a-bb79-4a96-b2e5-2455f565048d", "value": "3d1bb54ca1c67e42e80bf019feb5832a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "200983a0-d512-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652703436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703436, "uuid": "7fede03b-9f5a-4c65-837c-06953fa84d4a", "comment": "Malware payload", "value": "3b0a1da5f098dc786419be9af0d7fc18", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703436, "uuid": "227ceb20-5b05-4973-85c4-ea978f79ed36", "comment": "Malware payload", "value": "941993b3a3f840542801bd014be501c03d1170cedb6c9b6900896621a6a01bfb", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703436, "uuid": "7e5a2944-0f65-44b8-a709-5d641ca46e05", "comment": "Malware payload", "value": "3b272c24dc46477057369b81050cd756714a067c", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703436, "uuid": "71bcddc0-c7c6-4e1b-8f03-f8b98a8fa295", "comment": "Malware payload", "value": "4f6cecaa5bffb994c9cb02725b225173b4eb0105f3f7fe11feac40171efba85bd65b83cf96c7bf780264d794f4187436", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703436, "uuid": "5bfe0fcb-6d74-48a2-8e6e-c62c4b637551", "value": "T1B624126873A4E571D9521CB32AFD9E324456FF01986DEE03B617372898B7CC10EE3926", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703436, "uuid": "db384060-b929-404f-8df5-d5212feb9c1d", "value": "6144:FV4jIFTc01HoNE6donJ2SLGdwx6GIaTiSAixzg:IUdGMJ2ndwx6wTsEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703436, "uuid": "58fbb9fc-34fd-4f2f-9f5c-5d1496715951", "value": 229896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703436, "uuid": "632dd3e0-499b-4fb0-9876-54d048e67a9f", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703436, "uuid": "265ccae1-cd36-4141-ac2b-eca1e599f9ae", "value": "proforma invoice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a07fe4-d4d8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652678669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652678669, "uuid": "64bd1ac1-3007-4d28-80ad-becfda013bbc", "comment": "Malware payload (Mirai)", "value": "cf07e10e03ce17b56547822e22b28c33", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652678669, "uuid": "5cc3d92a-73c9-4e86-8c1f-3b6783240591", "comment": "Malware payload (Mirai)", "value": "94a812545101689e228d19a9a1103e3ed91c4c296b3dff1072e7a94b9f2042cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652678669, "uuid": "c6c4a26e-0a71-4326-8d7a-441d171cd760", "comment": "Malware payload (Mirai)", "value": "03f77e2756d14d789c235a71cad1234bc64ccbfa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652678669, "uuid": "94d07b7f-83e3-4a1a-900d-04b775f67f20", "comment": "Malware payload (Mirai)", "value": "deee512b3a7537828f9b4b70bdc65e34ad0c2c83ea08d2fdbb26c12c2a9d6c11a88cf0240b560e602545b527c14f8a08", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652678669, "uuid": "0af9d676-886f-4ff0-8d12-12d16a60941e", "value": "T1A5534BD9B4119E7CF9CBEABE84224E0EF821221150931F27ABB7FD937D32195D852D06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652678669, "uuid": "cafb4d51-2e4b-48c8-a824-176003d8cc60", "value": "1536:PaJGM2LYiGySrWp1unNSOcUhOwFhkU1LXkMEl7bVB8uD:PrEWpknNT9Z07xV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652678669, "uuid": "814d5ff3-3fb9-4993-ba9a-aee9f3f7e2a1", "value": 65640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652678669, "uuid": "9b27b0d1-211f-41b4-a53d-3620a447f536", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652678669, "uuid": "eba1c20d-610c-4dfd-a051-76ae6f458c22", "value": "cf07e10e03ce17b56547822e22b28c33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f1eca14-d570-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652744022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652744022, "uuid": "793e851e-8cec-49eb-9040-65620c64ca3d", "comment": "Malware payload", "value": "aae1aa7b277ca7ac767cde4a63ab1ae3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652744022, "uuid": "6ee24a4a-a5b9-4608-ae2a-becf6f648bdb", "comment": "Malware payload", "value": "94af0ea195a7a3233ea4d90afd91588cccfe5c98c1c3b324afbdfd9939e4bb77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652744022, "uuid": "fdeb025f-1c62-497e-9bab-3893344ea3fa", "comment": "Malware payload", "value": "baff7d98d41cf97efb70298e2adca0512c42dfba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652744022, "uuid": "555873ae-a3a7-460d-9d74-c7a65327effe", "comment": "Malware payload", "value": "a75deb3fc05a724dbeb02b13973742a0de1fb15291adf6f997cad805cb7fda69f5cd59b817736979771e4c64a4d76056", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652744022, "uuid": "cb14f05b-6885-4a39-92d0-284f3b494739", "value": "T17384C04573A48079EDB79338CC574A47E376B86907B0678F1364436A9F3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652744022, "uuid": "0b2a4eb8-138a-44e5-b741-aac04cbd2860", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652744022, "uuid": "86297dbd-bdb2-48fa-a412-f08d7dc503d4", "value": "6144:EbmRW/X22TR72tKbxGeYkesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/YpRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652744022, "uuid": "3a175f07-0d0d-47cd-8a28-9e563950083f", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652744022, "uuid": "2ed0f346-c12e-4371-a957-27e47bc02785", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652744022, "uuid": "e96895fc-c9bf-4363-907a-c4e891068989", "value": "aae1aa7b277ca7ac767cde4a63ab1ae3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "849fff19-d51d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652708329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708329, "uuid": "dcbc723e-a493-4f12-ac91-88fe126c1d05", "comment": "Malware payload", "value": "fb0181b3ddca11fbab534177cb6d5e2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708329, "uuid": "9987b073-4975-479c-9236-01d0a90087d4", "comment": "Malware payload", "value": "95ca7e20bc627aa8bc73f08880f69c940e1f7d6e494a802508327a01740b1100", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708329, "uuid": "4c8daf23-7fcc-4685-932f-6efe7b3fd41a", "comment": "Malware payload", "value": "da09cc0b4c697e030fce87af32dcdb3b4ea2009e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708329, "uuid": "abd557e5-eb7a-4398-a647-7e75cf02dd4f", "comment": "Malware payload", "value": "1d5c8f1abbe8321d3f76803b5bc0ce812656bd717cdb203602480db3ce42e8420b0dc5e4503d411e783e9871dc13e4d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708329, "uuid": "8e7e6da3-34ea-4aff-b240-b52539dfa1d7", "value": "T17F748D8523A403F9F2FA827ECC521B55D63B78454B75969F03A04336AF23761AD2E723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708329, "uuid": "09f59cbf-f8d4-439f-8953-9c1bc8f7995d", "value": "ce7d6ed76f649d460e38f83e1f38b8e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708329, "uuid": "44befc47-dd1a-4a75-bbca-8911082eb833", "value": "6144:WnYtpLW1udZ8e4R5Tm1Xizpp5k8vB0TmIEp4QIztPXklyUVmTSvkeWT47vvk0gYs:4D1UZ3Um1EV4s4QIClTVmT6WIIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652708329, "uuid": "6a382dca-2945-4ca3-9c4e-aa5ce99e7294", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652708329, "uuid": "22d1feff-8929-4d97-8bc0-4dbfa82ea4ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708329, "uuid": "fdafbb79-8cd3-4c78-b3de-b55fa702e9f5", "value": "FB0181B3DDCA11FBAB534177CB6D5E2F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2edf84eb-d567-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652739968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652739968, "uuid": "227305f8-51d5-44c9-a584-93dead0ba271", "comment": "Malware payload", "value": "bf3dcbe1e67a122f82c0d0adb6ab2c3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652739968, "uuid": "45c0ddbf-1914-44d4-a185-00e0b9964c54", "comment": "Malware payload", "value": "96b2da5b493ac29bb08e8045157cd8b2643dcfa4a937f7eced5a276b8f8a6b67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652739968, "uuid": "9779a071-0236-4669-9d29-f5655b7f90a5", "comment": "Malware payload", "value": "c4c6b38c6321ba0e4490d2cd843748f732edf900", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652739968, "uuid": "688dcb01-95fa-42a4-b7e8-d5d2b7a077ae", "comment": "Malware payload", "value": "5a3eccd553a33cfc360d49bf34187a43a316759f7cb7277b9ecfc617dff1a30b21fd5f3b7abc8a7f5de42412e7a67e21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652739968, "uuid": "f360025e-c67f-4388-90ac-fd805c15f138", "value": "T191C40202F791C4B9E1A21E748466C6B1A777F8725674688BF3A0D36F0E73390E9B5312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652739968, "uuid": "168007bb-4466-40e1-b3ac-e3d3121a3d91", "value": "501b246be07388174c9f9a65fef86aa0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652739968, "uuid": "bcdf3cf6-4e93-4f94-b497-f7207a9d180c", "value": "12288:ceAllyB6NFuJ+yu/GfPYnuuA1uTHHnz5N9:ceAQOuwlOPYXD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652739968, "uuid": "35ba2742-45bc-4b36-85a2-151a944b2f2a", "value": 551936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652739968, "uuid": "2d4c90bc-58c2-4cff-b22b-731bb137e754", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652739968, "uuid": "0db2d0b3-adae-44ce-91d4-788acc7bdcc4", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1079618-d52f-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1652716162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716162, "uuid": "247fb875-a9e4-4cf1-9a2f-5855fba85f50", "comment": "Malware payload (SilentBuilder)", "value": "c149300a5b6a8fb3b5462f15f9238003", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716162, "uuid": "c55c8c4c-7452-4d77-b905-73ad096f1d21", "comment": "Malware payload (SilentBuilder)", "value": "970035848bd05638b3e4defb67bd1659bbcf4b9e5ef1010d6a06cc7f76b6ba76", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716162, "uuid": "a4ce18e6-9f3b-4704-9f80-65198bb0f4da", "comment": "Malware payload (SilentBuilder)", "value": "0bb1b741677652f60baec74993fae5843cdeb655", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716162, "uuid": "c7430ccc-162b-4507-8b80-135bced5ae4b", "comment": "Malware payload (SilentBuilder)", "value": "f749b470dc448158c2df397f204508fee6586fc0a78697fab271d8a714cbf7a2ffaea2c8ad95fd52b10cfaf6b0b979db", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716162, "uuid": "9b679f88-dc2d-46df-9e84-6494cec9ee28", "value": "T127734A4AB98AC96CE615C739499743A9B313FC114FAB078B3109F3727FF49A05A0761B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716162, "uuid": "6c6eec8b-22e7-4b37-b5ae-7597664f8bb0", "value": "1536:tpKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg5AezwrMCtvJecvRtbTNFM:zKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652716162, "uuid": "0e91dd16-295b-4e03-9c7c-19d7638896ee", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652716162, "uuid": "16492d0a-fa4d-4fc2-95bc-e79abfc3e1dc", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716162, "uuid": "ca65167f-6f5c-4f13-90d6-616b2768e153", "value": "24SCW 88137.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6da61a12-d51c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652707861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707861, "uuid": "fbef3b80-a4ee-4ccd-8ba1-a2aa9c2abd46", "comment": "Malware payload", "value": "f3af73070387fb75b19286826cc3126c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707861, "uuid": "1a0e397e-428e-4843-b87a-49f4f4237d92", "comment": "Malware payload", "value": "974243f2487ceeb8eeea6aa8fee215f15c7b204382d4bd12f469f712f56c3610", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707861, "uuid": "9c4f0348-5e4b-4135-880a-cc6d59c7db23", "comment": "Malware payload", "value": "7774854137d7ada89f3b4bdf67631456a1e74853", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707861, "uuid": "0404f7f1-623b-4acf-9d5e-3cc6453b77a8", "comment": "Malware payload", "value": "80a5a1f9e432d90fe4812cec865509e3888f810f0c720d98b5dfe8f1eb658bc86df8bc354c34dbd5dab3c27e89eaeafc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707861, "uuid": "67d3b2af-cd67-49b0-bbce-7b895ff05c81", "value": "T105046B8B6E54E2F6D25DE130C4A377FC972BAC3DEB934E1F825A7D453B322884925610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707861, "uuid": "098b8b73-be11-4f02-9f61-a4834465272a", "value": "e263a54738f24c587246df1df70bae2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707861, "uuid": "37168321-19d0-4e21-8bcc-8152b0062558", "value": "3072:I/D8SxgtONJf2IoY3UJMYZIP1kZZP7n+H:lSxgELf2ItUJM2ZD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652707861, "uuid": "2804c468-f434-4c94-a906-94109081763a", "value": 180120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652707861, "uuid": "fcd1940e-dc31-4924-a9dc-b8b8539daf58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707861, "uuid": "10e62a17-d6f2-4a85-bb84-3f56d44b1a77", "value": "OneDrive.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3e2ac58-d54c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652728675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652728675, "uuid": "81f17c17-bcd1-4219-be05-a298578f455f", "comment": "Malware payload", "value": "ba4733a2758d44f084235d6fe53b031a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652728675, "uuid": "22960904-ba28-4ec6-bfd2-56e5dc894623", "comment": "Malware payload", "value": "9743e0c9282aca077061e690b4b1fd70a0def71147f7ebbee648ae91cca0d459", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652728675, "uuid": "43db6f66-8560-42dd-acd1-6324555ba560", "comment": "Malware payload", "value": "45e51bd80219f6845cf42cf0b89518a7b905e085", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652728675, "uuid": "664a6a94-d9cf-447c-be99-51fbf5ff4ee8", "comment": "Malware payload", "value": "230d1bd92dc4b00168017cd857b75cf295961440a9ac3d862174617ae52451234950f95a2ca61c0979e1ea4443cbe7c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652728675, "uuid": "42e566f3-f553-487a-91a0-bc45b5bf262f", "value": "T193B4228E71C49837CA7C01F9A556164A0BF2524E58C3EBC71DC2E1DAAEE43C94AD136F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652728675, "uuid": "2122b8dc-ed5b-47e7-8e54-98bba7b7c6fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652728675, "uuid": "c9822a0b-4175-4997-b517-ca14af3e70d3", "value": "12288:Mw4+fTANHpT2aKuIaw9iNRzzyYSktG5HNtLp76fyGhMl:rf4nKuIaw9kbtG5bd7QhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652728675, "uuid": "deb4b5b5-8b9f-4770-aa26-2196158cb7b5", "value": 539136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652728675, "uuid": "f2d7092e-5242-4e97-b962-2852ad1efbb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652728675, "uuid": "9485fc27-1639-4a9a-b716-5318362a7f4c", "value": "USD54093SWIFT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89bd32ed-d4e0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652682139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682139, "uuid": "583a558f-a6c3-4f3c-bd6a-436a6baa4087", "comment": "Malware payload (Mirai)", "value": "bef05d0ee726a90ed657c2b654de7658", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682139, "uuid": "9f20167d-f6fc-46fd-8242-d28286a9b796", "comment": "Malware payload (Mirai)", "value": "97576202eba99e867785902114cbb2b36d84e2967a48e2fe6c999239cbf9c49c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682139, "uuid": "560e1323-ee52-410b-bf90-60e64d67a5d6", "comment": "Malware payload (Mirai)", "value": "518c6914317248a20c082c306c4c114fd0464928", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682139, "uuid": "4e1795aa-60fd-4574-8cbd-24d945e011b4", "comment": "Malware payload (Mirai)", "value": "deb8c4c9fe658af1448545c97bcf353324785b267590955848e7a7f2d00fc09d516ec93b74136f4789f39f07bd53dff8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682139, "uuid": "b44e8adc-8f6c-4f7c-823b-07462777512a", "value": "T1ED03E1633512E1F1CD7124B7BFBD0A962E8A56BC91D93E52CE8B255C63C780F0E51283", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682139, "uuid": "5392ab04-8f6c-4e72-b67e-f229025c6627", "value": "768:Zs1rtstIdHJEktCK+6If+m6XlgxvxuC+H0A4L9q3UELCD:e5GIJpCK+5Wm6XlgFtohLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652682139, "uuid": "8311f443-f04d-46e1-8c05-63b4c0e565cf", "value": 38116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652682139, "uuid": "c1a765e1-38c7-4993-8390-354ee91e06cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682139, "uuid": "bb0e047d-303e-4abc-a204-b8dce4747d40", "value": "bef05d0ee726a90ed657c2b654de7658", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b45fd83b-d516-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652705403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705403, "uuid": "c2c92e48-7bc6-4eba-9e17-3edd40a45bc7", "comment": "Malware payload (Mirai)", "value": "cf11f162ef22b7094e1f4016a6c3e088", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705403, "uuid": "af1fcefa-b838-4f32-b46f-afd8ba21a743", "comment": "Malware payload (Mirai)", "value": "97b3bb00d381276e7e883778d9e3e1c7ee4b533f0b1b7b1c83b026b7e6e61478", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705403, "uuid": "3605026e-ca99-4d2a-879f-17abfddf25ec", "comment": "Malware payload (Mirai)", "value": "4d2731c40a083a6ddbfac8749ec49c6e7aa45a1c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705403, "uuid": "93845f4f-f40e-4fc3-9538-62bbb8feac5f", "comment": "Malware payload (Mirai)", "value": "847e48576aae570f3f2887eed4341cd58d2daa72135740d86cb37b075d8155f4ea8af6f357d9ad0dbded33290fd1c37c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705403, "uuid": "f835ea02-cad4-41e0-a80f-2c764345e737", "value": "T14B044C46AA419B13C0D7177AFA9F024A33329B64D3DB730699186FB43F87B5E0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705403, "uuid": "043cce81-d06c-433a-b32d-91a27ce9fb10", "value": "3072:AB5u0AuvqAI4X6dqMJwaQhDm9LiGF+8tv83/oPZ8Xt8nM/9J0cMxmmW/fxWBx:VqqOXyqqwaQhDm9LiGY8tqcZ8XtoM/9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652705403, "uuid": "6e1b54c8-d3a8-48ca-800c-179052e18476", "value": 175095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652705403, "uuid": "4ba4d829-1dc5-436e-8c54-16f735db205c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705403, "uuid": "3d28b1e4-e5c3-4d0b-809f-9a5bc01aef3b", "value": "garm7-20220516-1250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6347849-d51d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652708386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708386, "uuid": "fc9e121d-e887-4dc1-aa35-56bfe88d2014", "comment": "Malware payload", "value": "28b262839235fa9ca51e8e478858ccb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708386, "uuid": "68925ca4-cc36-4ec8-9742-24962201f2a7", "comment": "Malware payload", "value": "97e240d2fe69006c0303d5f76a335d8d20ac28296804a07c21fab0e2bc004422", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708386, "uuid": "14e025b9-4ca4-4b63-9091-d9d616fc058b", "comment": "Malware payload", "value": "060545d2ce9b5b5eeb5318721985389736901a19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708386, "uuid": "789a2b0e-f0c5-460a-bc51-db1bd1f919f4", "comment": "Malware payload", "value": "90a0b49db8e85949ba2b0e47cc739087485a8c4925594bf107dde2f1395aae748ecefa906c77a63c850308509a30f23c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708386, "uuid": "89f14066-0471-43cb-8ce2-61b3b2e33a48", "value": "T1CFB5AE313A90D8BAC9232170854EA7BCB3EDAF305AB652C356503F393B75592492C77B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708386, "uuid": "88d54600-96b6-4e61-8887-36b50f74c5e2", "value": "493871f0784d0d733e68b5dfb4b3e7a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708386, "uuid": "5428097b-7ab8-4ef5-80ee-5298eb3398e3", "value": "49152:e/jOk5qm6hQ6zit2qaHwQtv7DLcMAtKDi+oxE48SRWAcg6yROz4hmqWN:xk5qm6VG3aHwQtDDLcMAtKDi+SRWAD61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652708386, "uuid": "583811d1-d8ae-4c8e-803b-3ea6c6d1fcda", "value": 2429440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652708386, "uuid": "56feb265-f35f-48c4-85c2-f6988924db69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708386, "uuid": "940fd46e-2524-4f3d-8085-1a97f93174ca", "value": "28B262839235FA9CA51E8E478858CCB8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d50f881-d4f4-11ec-8e58-42010a9c0032", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1652690573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690573, "uuid": "18944bc3-5a3f-48f1-8e4d-1cde3e2fceea", "comment": "Malware payload (ArkeiStealer)", "value": "b724bd43055188366196b44bbf0f9f98", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stereodon-social", "colour": "#9DBFC2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690573, "uuid": "e6d99b30-766e-4475-8a9c-9683ad8fee27", "comment": "Malware payload (ArkeiStealer)", "value": "97e3864d9764dff40c527358f14a8f65e4868e04c15fdeb31f53ddfb757f08f9", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stereodon-social", "colour": "#9DBFC2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690573, "uuid": "38d6fb2e-87b7-4625-80a3-bd550dd2bf27", "comment": "Malware payload (ArkeiStealer)", "value": "2a95e6bdc0776be7d405ede0e611130f43b7fda5", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stereodon-social", "colour": "#9DBFC2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690573, "uuid": "c8ac27d6-e49e-43df-9d39-0531a12a7cf9", "comment": "Malware payload (ArkeiStealer)", "value": "f3d24a9ee0cc62a3cf8088ea9eef6ae5d4da83025bcd3da5ecb25e5bb94b2636ed5632c5c8d013d7c01c325e818c486a", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stereodon-social", "colour": "#9DBFC2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690573, "uuid": "23e3daf2-4dab-434e-a0fb-00dbc1ca5e9f", "value": "T17C0501407760C03CF4B742F4B97AA3A8A52D3DA15B1465CB62D62BEE12346E0FCB535B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690573, "uuid": "2517687f-14a0-4536-a3b6-4be66ad9bc0e", "value": "d626a2a864a52e91dc5f85b5e98029ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690573, "uuid": "bea4f761-c27a-4ad3-8c2a-21958d6aa593", "value": "24576:dzpTkML0wF5HTCgti4fejs7md91voAQsg:FowDHugti4fTmd91gX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652690573, "uuid": "0e29ddd4-f1a0-432f-a671-72a0dbc425cb", "value": 813902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652690573, "uuid": "8acb70b0-3fc9-40df-9d4f-ab8637b55b47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690573, "uuid": "5844c7ae-bd42-46d7-af17-f4bea989da25", "value": "97e3864d9764dff40c527358f14a8f65e4868e04c15fdeb31f53ddfb757f08f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f191772d-d511-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652703358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703358, "uuid": "45ad9f91-c5d4-42d4-9d31-10a520d87af2", "comment": "Malware payload (Formbook)", "value": "b5844e2f10ef8e8096c6ce94be816b7a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703358, "uuid": "516e4505-a631-44d0-ac40-088ccaeca811", "comment": "Malware payload (Formbook)", "value": "9817e86d30c92f3b2028c0a2fee7276e542b557271367904b9b92a6b5603e456", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703358, "uuid": "34beb7b5-32d3-463f-9a57-ef01ec4b0ae6", "comment": "Malware payload (Formbook)", "value": "64e444490be4e1b2cc65f7e502e02969ec12a35d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703358, "uuid": "e1e4c735-aef6-4d78-8f51-1037279ab27a", "comment": "Malware payload (Formbook)", "value": "27021f6b7d5d2cf35f0acf700b60791adc6823e04223bb4165014242f7a94a17f0be7461b0c9b4214d337f3ec15f55f5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703358, "uuid": "61d8782c-6718-4b5e-9e85-18c607042d4e", "value": "T1B124120976C85144C1642F392FC3E7A8BC12DE6584792E599326FBAB817CDF4EC1E274", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703358, "uuid": "5798df4a-034d-43e0-adec-1d635d1bc8ba", "value": "6144:/0Wyi+8zuN449wv6c/7R5X8XwEnXKbXCrNk5k:sk+8zuNx9wvjD8g4XKbXCraq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703358, "uuid": "909ea53b-e42c-425e-bd87-c2f137ad929a", "value": 229656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703358, "uuid": "7cb34527-e2e3-4207-a060-586454d7f52d", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703358, "uuid": "427ddfef-ac92-4271-95c6-f60afdca2bad", "value": "PO-2022-00267 & PO-2022-00268.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1857138-d518-11ec-8e58-42010a9c0032", "comment": "Malware payload (NetWire)", "timestamp": 1652706311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706311, "uuid": "fa3ebe07-eafb-4f2e-8068-78dfb54a3539", "comment": "Malware payload (NetWire)", "value": "04e6a931e45fab88161a11018b29673c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706311, "uuid": "de5b5de2-2c44-48f3-bf87-e2cffa80a106", "comment": "Malware payload (NetWire)", "value": "984288db5fa138cb2222df3a7ef8b2dae66d614da85d3fd5b5ee5f88bb36a03b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706311, "uuid": "a71a7c7d-7aeb-4aa8-8ede-440ec7bc7f27", "comment": "Malware payload (NetWire)", "value": "68e6ef7c135640adc44d55536dfac5619cb7bc7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706311, "uuid": "bff18deb-05b0-4ba4-8e33-f54271077ae3", "comment": "Malware payload (NetWire)", "value": "4c4c44d5637586e08daf3be83bb5d0ed6cc71f1f43f530ccacb9ff12dd6e6c8987233363e0a294277bac4a9b05992a8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706311, "uuid": "119822aa-a53e-4038-a3ee-13a18c294077", "value": "T16C54BF41B982C073EA961932047BEB7A493E75384F31DAD797901CB9EE312C0EA35B5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706311, "uuid": "12b010a5-85b3-494b-a437-350564f9d71a", "value": "e03c5ea8e25367650e1f4380ec0a6eaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706311, "uuid": "d6d82c95-719d-4c61-9eab-0f268ad886ef", "value": "6144:ebhnot4+sbOAtbkfHLDiT6OzR8Q0l+/NyqRKbhodqqD8XA8B:elnot4+UwLDiT6OzR8llA+qGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652706311, "uuid": "e2394a3e-bb17-40b7-a387-690141745571", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652706311, "uuid": "bd5ff2ca-2ea5-487e-9681-3ac241f2e5a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706311, "uuid": "ef662294-3ed9-4d66-a085-73d21e0aa020", "value": "68E6EF7C135640ADC44D55536DFAC5619CB7BC7E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d744990-d4e8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652685500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652685500, "uuid": "39e29b93-b9d4-43e0-8329-3ef32860153b", "comment": "Malware payload", "value": "96d9c0cb3bbd175ae86e82d2229c3d95", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652685500, "uuid": "e07161b5-e354-4104-a4ed-924d33325203", "comment": "Malware payload", "value": "986b233b8f1dfaa98ed897b3bd0779a584eef8b032c4257cb70f24dbfb8dd5a0", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652685500, "uuid": "f08f7018-3612-4297-ad6c-ae886e4dcf40", "comment": "Malware payload", "value": "54030b4bd3d20fbd3e0200e20feec6f49c3e2647", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652685500, "uuid": "73216e29-231c-49db-8762-087258df2d5e", "comment": "Malware payload", "value": "96f7c51a3fae6173cf7240b07ad029177afdd5ed3e48782ea43be6fdea826e348c7f283aea9b3afeaa3453610f0ce7b0", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652685500, "uuid": "bc557879-2f52-49e3-9550-62200dbe63f5", "value": "T17AA6118EF758B96EC8F613724939D636015A4C268B4397936954333CE8B7BD04F89BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652685500, "uuid": "3d81229e-9d85-4519-9119-acba7dc00f74", "value": "196608:OHxN3Vqivyk/iOUS3huYfCeoUyUFWSjacCsk1uL5+w:OHxN3VqCcEfDoUyUESjTR8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652685500, "uuid": "1a8f2c38-6b0e-4b1c-922d-5a4b2cb2bae5", "value": 9800960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652685500, "uuid": "b7bc9051-2a70-46d0-9b10-6cf9077ce35e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652685500, "uuid": "f5dc5f79-96ff-413c-ac5d-37ab16b2a496", "value": "Healthy Blood Pressure_v1.01.00.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd10469-d4fa-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652693423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693423, "uuid": "6e284682-0042-4464-a19e-3055a98a03ba", "comment": "Malware payload (Heodo)", "value": "9fa1c95b80704c4016edab9f5f9701ea", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693423, "uuid": "490c8785-6fcc-40a4-8544-ddad4906b5cf", "comment": "Malware payload (Heodo)", "value": "98dcbd5b87b026e8c198491b608dc209ba05fd3c8a5be6974b40c5a19fe6b09d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693423, "uuid": "b0387bc4-1ed9-411c-b9db-fe0b8c35c899", "comment": "Malware payload (Heodo)", "value": "8865e1e875d330e0619704993e640473e49a7d53", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693423, "uuid": "52180731-cf56-4791-8c84-83affb1f7b71", "comment": "Malware payload (Heodo)", "value": "591b1dcd07b5b086f573baa0efbaad09394d3da03c8b371ab4ccf30dc6cd8b8ff9c0ed9aefc98aac3115eae3a1f58d1b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693423, "uuid": "aab386b5-2f09-48d9-8d56-4e795b5cb970", "value": "T10E055A35FB6C8492C6A3953D88A34B06EE6AFE840B6183CB1290733E9E777D45C35671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693423, "uuid": "275c79cc-e94b-4ca3-a1b2-3fa75cb0df66", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693423, "uuid": "a89771e2-3241-4beb-81c3-f9b0511d1876", "value": "12288:Q9983xFoz0/7aG8GkZHFT1YicDAXmvQaZsbNg:A9UzozAWGxGx16AWvVZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652693423, "uuid": "1b0e8372-1d90-4d1b-8143-ea67c6f7ce25", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652693423, "uuid": "aeb99883-4124-4ade-85f4-9393d504d9e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693423, "uuid": "1817dbad-c13e-4452-9ae5-cc0212f49f80", "value": "9fa1c95b80704c4016edab9f5f9701ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4447f70e-d55b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652734850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652734850, "uuid": "6b266066-0782-4be3-b204-dcc24bf0b02f", "comment": "Malware payload", "value": "e40472015f9bd82874b9e03e89598a11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652734850, "uuid": "7bf32d3b-a5f4-4ff2-a924-dcb57c90f14d", "comment": "Malware payload", "value": "98f7c1b63a001e55c077d150bbb842714322e0265033578f4042637aa20e5898", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652734850, "uuid": "87df528c-4d29-498f-a7c4-06808ea73cd5", "comment": "Malware payload", "value": "83bf83af4f218b22265296419503bc7ca14dc565", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652734850, "uuid": "4f4c901b-a1a7-4884-bb4e-92f82bc28739", "comment": "Malware payload", "value": "4c0999eef894c94cdd739d318f4792c880c9c6ba955e59a7d38ba7c216b4a412bdce8e1888cded4b05d3f4eb207bb9fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652734850, "uuid": "81a3b1dd-efb9-43f5-8c34-635edc0ea1ac", "value": "T14774C046B3A840BAED678338CC535647E772B45A4B70A78F13244379EF2F3915A3A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652734850, "uuid": "8e5d78a6-8d31-461b-a3fa-6463bf19ec26", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652734850, "uuid": "503cbd20-1f05-4f80-968d-a44f77720ec9", "value": "6144:Es/2WX22TR72tKbxGeMkr2rlsy+vbEFXYvlx6xJkUjnKd:Es//Gi7/MgDvQFXTH9Kd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652734850, "uuid": "d05ecc77-c9d1-4239-a1bc-9dae6bd46f93", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652734850, "uuid": "ee251e22-4693-43a2-a37b-1ba3051da3b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652734850, "uuid": "3b339f33-b46f-4992-b38e-b6aebfda3760", "value": "e40472015f9bd82874b9e03e89598a11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace6b7ff-d4d3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652676614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652676614, "uuid": "378509ba-8cbe-44e3-81b3-1650040cd753", "comment": "Malware payload (Mirai)", "value": "e2821ec3ba7e9c155d6b1a7e6aec6f7e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652676614, "uuid": "58f46c99-7455-4537-abc9-ea4a8f0e1190", "comment": "Malware payload (Mirai)", "value": "99bc9e859f2e4bfa5434cc63ae2f75197e7a1e48ac5a001f77881c56bd731fc5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652676614, "uuid": "da36dfaf-a18c-41aa-885a-dbed78524d05", "comment": "Malware payload (Mirai)", "value": "83a07669195d0dd06315bed76cffadce20318eec", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652676614, "uuid": "d71a2467-f9cb-4343-9a32-d2e73bbc4925", "comment": "Malware payload (Mirai)", "value": "d72caf71c08c737380593e71ce930b72034049f003c284d180f05db9169115a3f783135b087d174822fab797bd554e3e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652676614, "uuid": "07d53627-32b6-4c45-97cf-5e3bd61c9b62", "value": "T17BD2CF30911A5C76E7709F3ADBF5434225084BF892F679980A840666F4DB456F8FA30A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652676614, "uuid": "2568df70-5eb4-4d24-8001-0d8f3784d34c", "value": "384:14Sdg4dPCBUzFkpM621uuA6JD9wt4trSuWqxh82oOXcSp5vpcmUbLbBhymdGUopU:1rO8CpMmuAc2Wt7m2oOMSpoPbBs3UozO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652676614, "uuid": "dc69cdf8-e6bb-4b83-8b6b-781a3a7e640c", "value": 29852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652676614, "uuid": "c31d43fc-47e3-4ed8-8bef-8252ff0df587", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652676614, "uuid": "c6f7712f-4333-4819-8f34-640f9eeaf632", "value": "z3hir.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a33435a-d4f4-11ec-8e58-42010a9c0032", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1652690568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690568, "uuid": "d397954c-7801-4384-9cd2-f53785f9e803", "comment": "Malware payload (ArkeiStealer)", "value": "de27292317b8d60832786b86f5ed0cc7", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stereodon-social", "colour": "#9DBFC2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690568, "uuid": "935a9ffd-128b-41bf-8268-76f8e07bb52d", "comment": "Malware payload (ArkeiStealer)", "value": "9a13477776637dd1390ccb17bcaf1357fc68b259e9fb307c70eed639fc76cbf3", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stereodon-social", "colour": "#9DBFC2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690568, "uuid": "79682566-f769-4089-b5c5-6d460c152024", "comment": "Malware payload (ArkeiStealer)", "value": "83fb4d4711f264a9f3a78cfb2e89f54a95cc777e", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stereodon-social", "colour": "#9DBFC2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690568, "uuid": "d0b7cbe9-d1e2-43c1-b5cc-7185fe3d52de", "comment": "Malware payload (ArkeiStealer)", "value": "4c85881938f4210dc928c502fda04bf136522c6f5e02cd697905c77ca7358ecbcc8295bf22d35529ff9cadaaaf26c90e", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stereodon-social", "colour": "#9DBFC2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690568, "uuid": "dd775c4a-49fc-4151-af40-e75cce767c75", "value": "T1957522C2EBA55614D60F303755894A75113AF26E3BBE0F0B43AB8D04D7A27877F9924C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690568, "uuid": "b22432c1-ec56-4f3c-9543-1586b7b8251f", "value": "881a10098b83c8a5cceb4a2c3dcaab32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690568, "uuid": "c05f436f-c46e-4b86-94b9-6141d064db5f", "value": "24576:AT/NsOu3BH+sP+xo0hLLKVcc2dOB15ihJ0MFZ/jHEVv6vboELjGPN+NSjT0Rm9Nt:ATSd2k1bKqqoELyPNtjYY9NYgP4H8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652690568, "uuid": "c5c48b71-7ff9-48c0-ac97-cf13aa0a9afa", "value": 1595680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652690568, "uuid": "071e4e84-917d-47fa-a5f7-bb79bb4085de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690568, "uuid": "61d5d58a-17fa-48b2-835d-64daa4a6ab92", "value": "9a13477776637dd1390ccb17bcaf1357fc68b259e9fb307c70eed639fc76cbf3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "121b3fbb-d537-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652719304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719304, "uuid": "d534ea80-2272-41e1-9987-9b5e360cef00", "comment": "Malware payload (RedLineStealer)", "value": "d51da826e1e6ec5b81d1eaf7d7c0f6cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719304, "uuid": "4a6d48c4-69c7-4b24-951d-25789ed7dc9e", "comment": "Malware payload (RedLineStealer)", "value": "9a2a892d4eda6d0208e1a29abafbe465ef14be258b1da2f51d962ba9d4dde604", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719304, "uuid": "c3f1a55d-4b32-4b6d-8aba-50d6ad69bf79", "comment": "Malware payload (RedLineStealer)", "value": "5298bc7c57cd909da6e865ee529b3f17a9bea3ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719304, "uuid": "c3a55fee-cfd9-4eec-b9d6-c99db614e176", "comment": "Malware payload (RedLineStealer)", "value": "268405391ed41448e492140aa98e61dd07360222d6f58bad23fb30328876dac29ca56353c1099c7040e2bac10ed0b739", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719304, "uuid": "15adea1f-08de-424e-a34d-6315203641e9", "value": "T143C5CE4271EE2459F823B6F49FFDC379D766B9E6472B852F248631274ED0D022E012B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719304, "uuid": "9ad6cfa6-33cb-49c5-a4f9-7df343d530be", "value": "01abca9df409528ce11e7cb7a0fd2081", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719304, "uuid": "16155722-a808-427e-98da-12c595be9e51", "value": "49152:zi7Qx7bmJbBI8F7zs/K68JCO3GruMCZzKWO7iA3ioINVje:z2QYbBIEzsxTJP6KWqiA3iDNVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652719304, "uuid": "24ed7a3f-e677-4eac-97b1-207291d4c187", "value": 2501600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652719304, "uuid": "22830380-962d-42d0-ad7f-efbe5ad56202", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719304, "uuid": "90598720-b62f-4d79-abb4-44cc9f5d59bf", "value": "d51da826e1e6ec5b81d1eaf7d7c0f6cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abaa08ba-d56f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652743613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652743613, "uuid": "8e05b254-e9d9-41c4-8728-0be809d06a29", "comment": "Malware payload", "value": "6d92794c656fb7c4524282d9a8d3fc67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652743613, "uuid": "e980f02e-253f-42a4-b036-ab4baa538cfc", "comment": "Malware payload", "value": "9b08be1a8f6a605a0cff483a6abb6efbad97658f823f2693a25f2abfdb961c14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652743613, "uuid": "b2127f8c-bf98-4033-9c16-cad7bd689f8c", "comment": "Malware payload", "value": "82b542e51a57fce1ef90f53d163197761aa44dd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652743613, "uuid": "fd5873a8-6e85-4cea-b848-b749658d54de", "comment": "Malware payload", "value": "274569d750c8f78bf83e4e210415a44eb4b4647d49d0367ffde5c302b732e2087ac184707a3706a1b183734fce4d66e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652743613, "uuid": "5aabdd2c-cda3-4b62-9e10-14df9ad73ee1", "value": "T12084C04573A48079EDB79338CC574A47E376B86907B0678F1364436AAF3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652743613, "uuid": "de7039ed-1463-4e1e-add7-030ebe2a0450", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652743613, "uuid": "4f368c5d-dfcd-4cae-8ebd-c5ac9a69c93b", "value": "6144:EbmRW/X22TR72tKbxGeYkesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/YpRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652743613, "uuid": "2a6ebee7-7262-431e-a83a-347366234c94", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652743613, "uuid": "33a87703-7e65-4082-8b59-f98927bbd59d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652743613, "uuid": "7fc8c8b6-986e-4137-9677-da93d2728dc3", "value": "6d92794c656fb7c4524282d9a8d3fc67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17df436d-d51f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652709006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652709006, "uuid": "09192ada-f87a-45c8-a611-f920b3ddc517", "comment": "Malware payload (Mirai)", "value": "bfe7dfad85c84b13694bc639f70144fc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652709006, "uuid": "abd97d11-9935-4046-bf9d-c36934127808", "comment": "Malware payload (Mirai)", "value": "9b24d830e209e37ee358215a34a842535e5b10c281c0897a779c87e8f4414af4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652709006, "uuid": "64c94df0-1be3-4222-8af1-7d948c89661f", "comment": "Malware payload (Mirai)", "value": "066f73da0d3040cae62cc10b992415b456b7ebab", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652709006, "uuid": "34062747-7fe2-4e1b-bda8-a6a972d6a099", "comment": "Malware payload (Mirai)", "value": "a2cdf4fdd623a232ed4f8be2bb194e4860d70dc15a649365601af6cf2489d9e7c753350ddfad78c510be51e99336bc60", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652709006, "uuid": "3dfd21d4-d0b9-4f1e-abbc-74caa3c8c56c", "value": "T13F632955B8D18E13C6D052BAFB1E428D372913E8D1DB33039D26AF6137C782E0E6B656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652709006, "uuid": "ae3d4a09-7469-4bde-b6cf-3db95248ac97", "value": "1536:WMOMiNAGBjgYBuc+LhA02eNoub4sXevwK6:WM2jgYUc+tD2ef8fwK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652709006, "uuid": "79aff4f9-3891-4933-96ae-b7fba003c129", "value": 67084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652709006, "uuid": "2e194f3b-16f0-40f1-9e91-ee66878f0688", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652709006, "uuid": "cd4c7246-b3e0-487e-8f3e-e9651ab76545", "value": "ZG9zarm-20220516-1350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c65a07e1-d52f-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1652716170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716170, "uuid": "fcf9feb3-7ee8-4934-b6b9-73f050947199", "comment": "Malware payload (SilentBuilder)", "value": "9f39046798af9ff17e979e6667c44fe8", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716170, "uuid": "b5c65177-acd6-4d85-afd7-8e233226b0e7", "comment": "Malware payload (SilentBuilder)", "value": "9ba82370475e40c88f6fe9b06e81b4c17966c84d5db0bad66f47d0fecabdcfe7", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716170, "uuid": "b19d1d95-2520-4dbf-b99f-eee1b940f51f", "comment": "Malware payload (SilentBuilder)", "value": "ecbaeea90ab58dc47e65eab6623e4014ddf11499", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716170, "uuid": "f042a4f6-04ad-46d7-af41-64e6a2523a6f", "comment": "Malware payload (SilentBuilder)", "value": "9bb0cb5f239e2b7f8407bdd30774ae1d266908e96aadefca55d27b919f2d70b75b4e01764ac390c5e52b4f49614f0031", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716170, "uuid": "607da453-c195-415a-849f-e18a74f2b9a0", "value": "T180734A4AB98AC96CE615C739499743A9B313FC114FAB078B3109F3727FF49A05A0761B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716170, "uuid": "65e71267-cf14-47f7-8ebc-57b34db062b3", "value": "1536:tpKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg5AezwrMCtvJecvRtbTNF8:zKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652716170, "uuid": "7ba8056a-1b0d-48b9-8d42-70f2260f074c", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652716170, "uuid": "68abac28-f9c0-4747-87bc-928a931e9cad", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716170, "uuid": "03148fb0-87be-419a-98bd-8e1f9ab6057e", "value": "DATA-1605.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "794a5f04-d4e6-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652684688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652684688, "uuid": "ebc0b692-6402-42b9-9670-3bf9c1de5abc", "comment": "Malware payload (AgentTesla)", "value": "82cb6d0f9e2223211e36f191b987d0a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652684688, "uuid": "79b81e80-e07f-44a1-aa97-dc7bba7819f2", "comment": "Malware payload (AgentTesla)", "value": "9bada767c10c932126025f285f82aa13cefe16334ddc888ffdacc68ea90ea2b0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652684688, "uuid": "76e87cd2-39f0-46d8-8d6d-58f41026f41c", "comment": "Malware payload (AgentTesla)", "value": "d0abcf0a271d5b1599e52ed6767ed56a9197a4b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652684688, "uuid": "2250e12d-28ec-480a-8fff-eba6671c0273", "comment": "Malware payload (AgentTesla)", "value": "9b976cda6dbab4feb3bf31d5638939c7744364e5a7ded3a35077586173b95a9ec6ee8563c1fcd5d696d23da905cecba3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652684688, "uuid": "0b372735-57f2-4b00-8edf-dc976dc7a556", "value": "T141243C3E57855D02C7DE41B8D196D1A421B1AB03832AB34F6EDA4CFE1B172CDFA2A4D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652684688, "uuid": "8b547bda-b302-42d5-8e3d-7eae6c5624fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652684688, "uuid": "b3539ec9-9537-4308-940a-6a5bab9731f5", "value": "3072:fQwdM8FZDuhf53llZ5g96+ATDk9FU9SGUPN8jSXH4uqaSw5h38zQERC1poPK328D:IwdXkNbZ2oDwUlUF8jSfqb23yM3qW2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652684688, "uuid": "9619688d-31e7-40df-a6ad-7247330c012f", "value": 214528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652684688, "uuid": "e069bde2-7991-4603-a1d8-75501613cb49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652684688, "uuid": "9c145206-5d22-48eb-9e93-892db3b3652c", "value": "mannzx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b9bda4a-d4e4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652683779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652683779, "uuid": "4cc095f5-66c6-4556-928e-f4807cd48b7d", "comment": "Malware payload (Formbook)", "value": "43e04cec19b3e2c907996c23dfe1f73a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652683779, "uuid": "6cdfba24-0163-47ac-98f7-abd5f4bdd27c", "comment": "Malware payload (Formbook)", "value": "9bd2223f4fbc66ed1370dc2da0754df3ca9936f6a1f8b1a7b16d529d451bd55a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652683779, "uuid": "0996c2d4-ee8a-416f-b86c-ff4ad3cbad0f", "comment": "Malware payload (Formbook)", "value": "d3c7488fa4a5c07c0cae33aa9010d37a632bc4fa", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652683779, "uuid": "202aa646-677c-4e14-96fc-d0326f1a8190", "comment": "Malware payload (Formbook)", "value": "1187f514120a28a398fad5fc6a3a705a3d8713d9e50f3f7b5746e3304fcacf4c12a61f1c0927e02d5d364ebe420e01e1", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652683779, "uuid": "b865c55f-46cc-4233-ba57-bd5f2db784b5", "value": "T123241229F460CD0BE93DE7FB9E72C950E124FE560E624C1D4D9CB9E76271FA4901E882", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652683779, "uuid": "b9037d3e-4a14-426f-8d48-fafa29579d5a", "value": "6144:PqnxgTi+n8mdrRyTeTIrqu8WpiDVA4Lxr9N7pxN7tuN:U2zRGekquGFLxr1H2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652683779, "uuid": "30b22ffc-84ed-4454-9080-0d12f18e9967", "value": 229048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652683779, "uuid": "e8a9ed0b-957d-4c7b-9bc2-12496691a55c", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652683779, "uuid": "f57bb2dc-1e08-4327-81cf-b00242c8edc3", "value": "New Vendor Registration Form.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9d27916-d4b3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652662865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662865, "uuid": "54f4d0ef-3d02-48a5-8f7d-a2a3d53d21ed", "comment": "Malware payload (Mirai)", "value": "06eb39065b9f1ed2afbacbeecbcbe7ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662865, "uuid": "9e907b06-e5dc-411f-bfd1-2e86ec52c1de", "comment": "Malware payload (Mirai)", "value": "9c951260444dce3edde871317ec732215a13f9ed7d53a699484f69820963e763", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662865, "uuid": "d92182b8-4cb1-4a85-bda5-d7a8d9b7d398", "comment": "Malware payload (Mirai)", "value": "1c4b2220ed8ce49ed4aa214be3342ddf91f0cbfa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662865, "uuid": "2a04e6d3-cf3f-4831-a7da-2b0c8c56b9de", "comment": "Malware payload (Mirai)", "value": "08ac19433189353d962e8de2d57b5e4c3e7a1b10fde31ac0860d7c999e59b55af62a309b913de2259da491a8236811e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652662865, "uuid": "048c305a-4f58-44ee-8a3d-22e51107d57b", "value": "T15553F886B8819A25C6D117BBFE1F018E3316975CE2DE73128D141F647BCB95F0D2BA0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652662865, "uuid": "a5c93296-3730-4903-9c84-8945e1be0cfa", "value": "1536:4dnd2Gvoqc/Ljzazt9oDOFzVLp1pvCMLZIticljoQ6/:bVqGXzst9OshLpPWljoQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652662865, "uuid": "a94903ef-6e26-43f4-89fd-4ff436d94538", "value": 66688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652662865, "uuid": "abc3aaa6-93b4-4ebd-b226-f3a82825abbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652662865, "uuid": "f4ee2fe0-483a-4e0a-bd65-57698de2cf88", "value": "06eb39065b9f1ed2afbacbeecbcbe7ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "595db5ec-d512-11ec-8e58-42010a9c0032", "comment": "Malware payload (AZORult)", "timestamp": 1652703532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703532, "uuid": "984bf5fa-574f-460b-a5c9-2f3d1d1cf294", "comment": "Malware payload (AZORult)", "value": "0df353bc1f264422bdb2ecf1a1ad30b6", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703532, "uuid": "7f07cef1-b691-4664-b518-161d51da29f6", "comment": "Malware payload (AZORult)", "value": "9cbcdec6b8050a81720597c76e29fb7c89fc12dce7eb26a68ab8542235824aca", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703532, "uuid": "387479c4-8ba8-4d23-9ba7-05985cfe9804", "comment": "Malware payload (AZORult)", "value": "8e926f65c2a5fc9afea2d49ae04a25845515c37a", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703532, "uuid": "1297eb26-4e36-4651-87e9-1ca7a71399eb", "comment": "Malware payload (AZORult)", "value": "ce01fb77aab40e66b44bc5cfd0411bfde3f9c9425204e38429a90c938afe0354d2cf6da5fd5b5bf300cd790f2092d18f", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703532, "uuid": "8c8f2296-6b7c-46e1-8832-ae46409879eb", "value": "T137A41204B6D84B76D2BE29B19B36011403F77595A623FB381DEF74691AB2F008F506AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703532, "uuid": "dfd1c2a7-c864-44b4-b5d8-1add5457840c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703532, "uuid": "48d621f0-f7ec-46a1-b4b5-c3e531b79ea4", "value": "12288:Tej67N7DpCq5E9Ue2f1zqH5kPnLAmJCgJq3rcmXk:TR79FCq5BUH5wn8m81k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703532, "uuid": "15566e45-1ffe-4316-9278-2d95a9ad6b97", "value": 459776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703532, "uuid": "e2a0bfad-c33d-41ed-95d1-8ee4c74c763e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703532, "uuid": "6608d631-170e-4027-bdea-d9c6f4509d8f", "value": "Odeme makbuzu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "935febaf-d4ee-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652688168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688168, "uuid": "62fe0cf3-505d-423c-bf83-f544077634ab", "comment": "Malware payload", "value": "79582c261432af428df7c0598b5e7860", "object_relation": "md5", "Tag": [ { "name": "pixelmon-pw", "colour": "#765B0E", "exportable": true, "hide_tag": false }, { "name": "pixelmon_pw", "colour": "#378CF8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688168, "uuid": "5143371a-64dc-4853-ae7c-ce67868b1b8c", "comment": "Malware payload", "value": "9d1c92212e7954d948e8be87444b2cb69c73525646b4ecc3e749baf620c6ef1a", "object_relation": "sha256", "Tag": [ { "name": "pixelmon-pw", "colour": "#765B0E", "exportable": true, "hide_tag": false }, { "name": "pixelmon_pw", "colour": "#378CF8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688168, "uuid": "9c9967f8-60e6-45df-ba59-06614152b0cb", "comment": "Malware payload", "value": "363b3af0a54936fac4c940c997e7b2125a5aa7ad", "object_relation": "sha1", "Tag": [ { "name": "pixelmon-pw", "colour": "#765B0E", "exportable": true, "hide_tag": false }, { "name": "pixelmon_pw", "colour": "#378CF8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688168, "uuid": "49257e42-aa45-4182-890f-b90fabb5b30c", "comment": "Malware payload", "value": "61dcd14593039d7198bcc2e66ce508893cba351bd16b4d21fe903fa8ef6cee49414d510c230c1ab6b3c29cc849fd2ccf", "object_relation": "sha3-384", "Tag": [ { "name": "pixelmon-pw", "colour": "#765B0E", "exportable": true, "hide_tag": false }, { "name": "pixelmon_pw", "colour": "#378CF8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688168, "uuid": "9e32a793-4d0f-450a-a7d0-a0a777c958b3", "value": "T17D16331E390A8900AB73374BCD8119B52B033A11789049EAD9DFE91D80FAD5FD6F96F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688168, "uuid": "a42e10b8-e823-48f7-b911-0b8c5ac2dd7c", "value": "98304:4Vh1P0QTHaOcUvLExVPM3K+iTv0H34k4AeJm3SfkRqlHc:UfLa2vIQTiTG34k3FIvc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652688168, "uuid": "a608fe87-a1b6-443a-ad26-6d203689874f", "value": 4129496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652688168, "uuid": "cbdf2381-d394-49ba-ad94-e39dc50d3ffe", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688168, "uuid": "cd6b610d-75d5-4e0b-aa2d-5eef35b10945", "value": "9d1c92212e7954d948e8be87444b2cb69c73525646b4ecc3e749baf620c6ef1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dbea1d2-d51d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652708318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708318, "uuid": "f279b1d5-4b9a-447b-886e-a5482bf04135", "comment": "Malware payload", "value": "06a8c69954d6b31a26a17646bd22e259", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708318, "uuid": "f075665a-5921-4682-b936-783939d57df2", "comment": "Malware payload", "value": "9e25f81e43fd26d07ed7f09fd026fb4b6bfbc214e6f52df86a143e186a3a5ad5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708318, "uuid": "ec8c22dc-4a98-4351-8fc0-e868ac3c6cc7", "comment": "Malware payload", "value": "11cc58da98295ae8ddea064d3334a3bc7032881e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708318, "uuid": "a12fc9fa-612c-49a8-91b4-f7170552fb36", "comment": "Malware payload", "value": "cbb9605b93d162ef9a13b5959bde40aabcdda37c2fa10a562e005ecad3ec4ab3506fc9ebf18c6a943a82c8fef333dbab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708318, "uuid": "2699443e-5fd7-4009-a039-2ca310dd529e", "value": "T170B44B55EBA5CCE4E1A6D13889638636DFB1BC990E60C74F23A8725A1F3F2534D2B311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708318, "uuid": "85ed3a38-865c-44a0-bef6-bdd93ef92dd1", "value": "9b1d37fdf6384a1174f6c058e0d56e7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708318, "uuid": "62b90f05-578f-4c80-a6cb-0d2cf5053cb1", "value": "12288:ed5hfZLLZVNtwHYfJZvm65MkukU+5QCS7:ed5hfZvZuSvBMxDsQCw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652708318, "uuid": "b029b520-db36-49a9-8636-a981c1e8c415", "value": 530328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652708318, "uuid": "594725df-2f48-4c87-97af-05cc1397ad70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708318, "uuid": "7cdd6a82-b5b5-428a-9978-b30619ba326e", "value": "06A8C69954D6B31A26A17646BD22E259.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3b09581-d4f4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652690826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690826, "uuid": "550d4ef9-375e-4df9-8f8e-abd01bef4b37", "comment": "Malware payload (Heodo)", "value": "f5863f144cd75f2b13f70d036fe61a0a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690826, "uuid": "005470bb-6b58-45ce-8750-df14703826b2", "comment": "Malware payload (Heodo)", "value": "9e966967632bc149019fe46ffe5dc2f71f91cf660f5ee3ae9a4b98a9c09d81e8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690826, "uuid": "0a3d7f9e-c47f-492c-9f18-1d614bf95ff8", "comment": "Malware payload (Heodo)", "value": "e04ec05a8092c370848981c231b9887267273249", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690826, "uuid": "10a63638-2621-4bc1-81a7-8176c1b546d8", "comment": "Malware payload (Heodo)", "value": "0dd321686f442d047745d544e269c0a6f6a4035864cea9b1075a85c24e9df5136f6a3561f852d7724b58eb01c6c009db", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690826, "uuid": "6cd287db-7712-4666-854b-07558c706023", "value": "T140055A35FB6C8492C6A3953D88A34B06EE6AFE840B6183CB1290733E9E777D45C35671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690826, "uuid": "f1994f23-8793-4485-a3e0-c407d5310b76", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690826, "uuid": "66205dff-4869-4431-a756-3a53a434b157", "value": "12288:Q9983xPoz0/7aG8GkZHFT1YicDAXmvQaZsbNg:A9UhozAWGxGx16AWvVZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652690826, "uuid": "224be0ef-301c-46de-9f20-48c3234afa40", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652690826, "uuid": "0425ac15-4448-445a-a44e-d70efc64eec0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690826, "uuid": "457d021e-7d71-4016-8c6c-fc289af9d443", "value": "f5863f144cd75f2b13f70d036fe61a0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "724573c3-d51a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Vjw0rm)", "timestamp": 1652707010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707010, "uuid": "2c8cdddc-13fd-4c51-bc19-c9d261038560", "comment": "Malware payload (Vjw0rm)", "value": "167a7c90346f572135aedd910e882229", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707010, "uuid": "541e6e37-2435-475b-acbd-477644914990", "comment": "Malware payload (Vjw0rm)", "value": "9f48cd516e6734a1731f205e6c33687c74ed3fe46ea163e87b9bbf3d7d2dfb02", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707010, "uuid": "48e2b449-f23a-436b-9874-0edafbf5bd9b", "comment": "Malware payload (Vjw0rm)", "value": "08665d22d5a39c5d051f7bb8bd62d646788d1b78", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707010, "uuid": "afce4745-4973-4ac2-808b-3c570e2e77ad", "comment": "Malware payload (Vjw0rm)", "value": "b71d9cd289a52573c962caa2424c2b0b83b6bd81eac1e30765e6be88a28fb72fd88b13c81009b9cff6d850eef44856a0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707010, "uuid": "cd68c5f7-c4cf-4a6a-9f8c-3ee8d6cb266d", "value": "T17715F10CFA899B838A08621534BA070F67F1415EC575111BFF9FBD0E3F6994CDA07AA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707010, "uuid": "9a080b0e-eb31-43d0-819f-a5f8cc64ec8e", "value": "24576:XuaQ0LymTQyd3cLxPECXtGoKlH6Ygh1y5qNrwbBPuguOrXv:6jJfooKiXN+ruWXv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652707010, "uuid": "b9c6b71f-80aa-4cc6-bdca-35c8ee045098", "value": 942907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652707010, "uuid": "d1a604b8-9765-4b50-9bc4-94d5d27ade66", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707010, "uuid": "6957d02f-7e2f-41b2-aae7-96650c3c1450", "value": "New Oders,Drawings,Specifications pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f26cd2-d506-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652698644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698644, "uuid": "3b0a4336-cf25-4b8d-82b5-1117736ceb7f", "comment": "Malware payload (SnakeKeylogger)", "value": "57436c8420a9fa776e7e7d1f4f508fe2", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698644, "uuid": "e06e648a-a46d-49d8-8608-956083fb846a", "comment": "Malware payload (SnakeKeylogger)", "value": "9f7bd53d973f258aee019c5d5dca551673da3051bf2c3e586019edae9f895964", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698644, "uuid": "c48a33f7-c1c1-46c7-9071-46d3a53637b1", "comment": "Malware payload (SnakeKeylogger)", "value": "af0be3554b100f74d005d76c10507cab48d05557", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698644, "uuid": "7347b195-aa0b-411d-9545-510df6aabe52", "comment": "Malware payload (SnakeKeylogger)", "value": "194be0b02103b1468c38f52ef98931d48753badac28aa9aa8152ec7bfdbbf3f2ee44ca0ae387c4b8354174d39b04521f", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698644, "uuid": "420e5197-a0af-40f1-b702-9c2e00882e61", "value": "T1CAA423CB4B2D789A3958F7EDD1AD875D7C271E8333EB9008A83103A55819E9201AB666", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698644, "uuid": "b878aba3-1e0d-461f-9cdf-7127506b9e39", "value": "12288:R1TkbfqVEyeNn5kIK3Z89vnEHxkFgaco78CvyKra:rTtVEyEn503EvEHIcovdW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652698644, "uuid": "6440542c-cfb2-4a80-85fd-9da0ee7d53c6", "value": 470102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652698644, "uuid": "67f4ecdd-d63d-4228-b846-c9a967d6c0b6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698644, "uuid": "fa2cebb5-0512-451c-957b-a418bba8092e", "value": "NEW ORDER INQUIRY_B9020289.pdf.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2813b13-d507-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652698930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698930, "uuid": "d96158de-fdd9-4bb1-a662-d92f94f53ff0", "comment": "Malware payload (Heodo)", "value": "f92553eeee42fd46ba1232cd00389d85", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698930, "uuid": "d5414bfe-e8cf-44f2-add0-7a6581f175a8", "comment": "Malware payload (Heodo)", "value": "9fe7db652e8471744b076e16f9693b71bbe439ab2c11c1510be2f6113dbbb91b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698930, "uuid": "5609d3b3-d09a-4341-86ca-5d49c4642b3b", "comment": "Malware payload (Heodo)", "value": "352ec544e3bf0d490da39af766afc3be144058cf", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698930, "uuid": "d83c8f88-5f88-4f60-b3fb-14e876d3ecde", "comment": "Malware payload (Heodo)", "value": "7d48052423c1c1db18dc74a62de7ebf5221571ee4a72c284a3db59d9c4e471d42ae39be318df6dcc6db2bc4eecd1b8f9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698930, "uuid": "102e3645-2c52-4cc4-9a0b-11a6891c2ad8", "value": "T11E055A31EB6C8492C6A3553D88A34B06EE7AFE940B6183CB12A0733E9E777D45C35671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698930, "uuid": "048e22d9-21c7-4644-98eb-34a20f4ba9ff", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698930, "uuid": "d788a60a-3d92-4125-9d27-c38296fedc6c", "value": "12288:BeI3xFoz0/7aG8GkZHFT1Yi5a8kL37eGfv37:cYHozAWGxGx1Na8kLqGff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652698930, "uuid": "3b8bf961-f274-4471-8f59-6c2d106e2bcc", "value": 800256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652698930, "uuid": "5ea3bdf3-8718-4bae-8409-8fdbca7791e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698930, "uuid": "79f0d8f8-ba08-40b1-854b-3bbd670d9dd7", "value": "f92553eeee42fd46ba1232cd00389d85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b4288ad-d4f9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652692664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692664, "uuid": "59816419-af1c-4a17-91ea-7e3f7103bf3b", "comment": "Malware payload (Formbook)", "value": "820cf9aa2158397fa8d58926a3ec3af3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692664, "uuid": "364eb0c3-77ef-4123-be28-313fc45df724", "comment": "Malware payload (Formbook)", "value": "a179f685d54a479697d1bef545331abd4d38c47c9b9950bce57b8aaeab577492", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692664, "uuid": "1f11c5da-c224-4912-a339-1f4947430bac", "comment": "Malware payload (Formbook)", "value": "1d045de54c4401e5f903498a650e2e1e36d807fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692664, "uuid": "2d0e5661-6f63-4d81-b846-217ac8628b6c", "comment": "Malware payload (Formbook)", "value": "94e0cf96940c94e294a8347a92da900d62c9781b97bfaea1b2b8cb90bb49ba880c858c64b7f32447ab617b7822020875", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692664, "uuid": "23377805-017d-4908-86bd-118f1d6f5207", "value": "T1D04412447364C463E8624F334C35636B9FBEE61619448B2F5B11AB3F39667C29A0E353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692664, "uuid": "6ba5320d-569d-4986-9d98-9a8ed1f1cfe5", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692664, "uuid": "282553cd-3bbd-434b-b35e-c2831116da7e", "value": "6144:HNeZm3pxtg8tRR/PUXwRYkvJ+i/eFKNdhsBcJoUwG2mFpj:HNld3zJUmP+i2q7K/tSF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652692664, "uuid": "162a60b7-2f21-4c10-9e19-83309d5f8e0a", "value": 256497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652692664, "uuid": "6b66e39b-c30d-4788-9373-1b6add704ba6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692664, "uuid": "81e1121b-efd7-4dc4-a0c6-4bda0b7c5f63", "value": "IRQ2107797_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba0f772-d50e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652701845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701845, "uuid": "e9e6af5d-cf0e-486a-9cc8-bb1a94b2c07a", "comment": "Malware payload", "value": "7cbadb4c8ac3d8d8d0d78bd07a205da7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701845, "uuid": "c3dc896c-c9e8-4192-8907-d94afad20afe", "comment": "Malware payload", "value": "a19c6e51982be4a38ee1a1e99e51043b8aa3988f40b05ec7b10bd0e96962dc66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701845, "uuid": "e95dd163-4e45-4886-aca9-b9eb3ef264fa", "comment": "Malware payload", "value": "6fd96f1f39953407626e36018ebe5d0172725535", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701845, "uuid": "0459b4ff-d4ec-43e3-abd7-719029b8e85f", "comment": "Malware payload", "value": "651a33ba338f4b4c678f77d8b8d7a8d069b0653d990132140f0f94d699649ac02a78305f421fa1665ee3b49e85ff6dcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652701845, "uuid": "073e38b9-7f20-4499-8ac6-6b93714ef48e", "value": "T1AEB5AE313690D8BAC9233570854EA7BCA3ADBF305ABA52C356503F393B75592482C77B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652701845, "uuid": "69ed5728-54cb-499e-ae63-5fdd9866aafb", "value": "493871f0784d0d733e68b5dfb4b3e7a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652701845, "uuid": "35ed225d-1246-466b-b696-240151b512aa", "value": "49152:n/jOkJqm6hQ6Dit2qaXwQtv7DLcMAtKTi+YxE49iRWAcsBC6yRON7QhQFsoUun:ykJqm6V23aXwQtDDLcMAtKTi+5RWAbg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652701845, "uuid": "da6705e7-0ee4-4980-ab16-fa88d626cfe1", "value": 2428928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652701845, "uuid": "f07adccf-9fef-462f-b9d8-6eec30b7dc69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652701845, "uuid": "f2dbbee7-e3d8-4a88-8697-80c369e122e5", "value": "\u70b9\u200d\u51fb\u5b89\u200d\u88c5\u7eb8\u200d\u98de\u200d\u673a-\u7b80\u200d\u4f53\u4e2d\u6587\u8bed\u8a00\u5305.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d8cce24-d538-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652719806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719806, "uuid": "7757ec52-89a1-4a31-96f3-a4dfb6d6425a", "comment": "Malware payload (Mirai)", "value": "b2cb03936d338e4f89b914c85f2272ca", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719806, "uuid": "54f04d59-8688-4aa2-b42d-0d8aeeea380d", "comment": "Malware payload (Mirai)", "value": "a1a7f3b256fda6b48da0770bcb0297a96c00a8ebb37986c9c9d5cc0267c1446b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719806, "uuid": "def9efb1-1f88-464b-8093-7a12c1dcfca6", "comment": "Malware payload (Mirai)", "value": "ade3fea4d9faaaa689466dff5a1ac06192ec78ec", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719806, "uuid": "3a175bc6-85d8-4fe4-8ee1-aeab729f57ad", "comment": "Malware payload (Mirai)", "value": "b9a6f85555fdd7455dcdb12684769b3547bc9f116c0291dc1691227c1bcee4643ee0051850443293596709d2e517792b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719806, "uuid": "4b5b0d97-699a-410e-a151-0cff3383569f", "value": "T102B2D06256C57CF0D6301634E93B46CA73722BBAD1FE30973A5009BD38CA98589F8A47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719806, "uuid": "01e0b2e7-16ee-4cec-983d-b7540d9f4e27", "value": "384:XtbZciv+WjgXQf2GWu75YZnrYFEwcjS8NcmVWpYShKx99kgno3E6d7HehymdGUor:dbZcjWjgXQf2108nkmwqS87pr9k50s3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652719806, "uuid": "628484b0-7966-4e66-aed8-f8025df79222", "value": 24072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652719806, "uuid": "1c6c0d76-6235-46fe-a9a9-546bdfbc5f8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719806, "uuid": "446fbc8b-305e-47e1-8262-447afe174ade", "value": "sora.arm-20220516-1650", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20fa52e6-d4e7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652684969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652684969, "uuid": "1abadb56-16f0-405d-a1f6-3793b9308a2e", "comment": "Malware payload (Formbook)", "value": "ee36eeb8ab56f4134c2edb220fdaa9a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652684969, "uuid": "325f0aab-ea0e-4718-9e8d-936a38cfed7c", "comment": "Malware payload (Formbook)", "value": "a22ca7acaf7bfae77ff56f08b010ac618fb6ed2d6faddfc593b6f552c0e86f5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652684969, "uuid": "281c0df2-584e-429a-8538-751ca9a18476", "comment": "Malware payload (Formbook)", "value": "2bed59602e66709610e9604d36b660b14e11a5ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652684969, "uuid": "0b15d239-a7b7-4f73-9b34-9cc6901bdd79", "comment": "Malware payload (Formbook)", "value": "77fc31544ecd658d99290fafde3bbc741df6cf0905f5adf4cd1eb2fed99d9dce49ea4c123b293d5420206d3b6e122144", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652684969, "uuid": "7e6c9f42-4276-4675-a742-78c3728fb507", "value": "T1F0C4E0DC322436EFD85BC47ADAA92CB4AA60747B531B9213A42781ED9D4D987CF140F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652684969, "uuid": "d0e05361-7a4f-4a18-a41e-725049bce0b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652684969, "uuid": "79be6beb-3258-4b79-b244-df94fbf6d931", "value": "12288:UJNZ6VDSZRhkPkmuRn3g4Idz9l3icVNO2z6csETbYn1KJvP802B6Q:aD3RnrIt9zN1vbe1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652684969, "uuid": "64f5e9e5-ac90-4014-a9f9-307d672dc8e5", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652684969, "uuid": "4c976ec9-28b3-4395-9a59-f2529eedbd00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652684969, "uuid": "e930f3fa-4884-41d1-8a35-a60ffb36adab", "value": "aEe8yIoysWwr3Oj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70ed77e4-d51d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652708296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708296, "uuid": "49cda72a-91f3-4592-bf77-b5f6385c20cc", "comment": "Malware payload (AgentTesla)", "value": "a9d0601a3293ab39521ebe0e845cc96c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708296, "uuid": "bc7d36a7-1a81-4d92-9632-b6bc6bd7f898", "comment": "Malware payload (AgentTesla)", "value": "a3a0a0f76856466c9a11e08371c2aa34ef35f96d4d3d3d714726de20b3aa77e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708296, "uuid": "89e8fe16-58b5-4df7-9362-22c8399ab4aa", "comment": "Malware payload (AgentTesla)", "value": "b418eb39f22535e79e4624b810ffc3e719bc63d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708296, "uuid": "ec3865e9-fff5-4b1a-9c71-0f72db494e54", "comment": "Malware payload (AgentTesla)", "value": "3531eb932dd03084b2af84ed0acfec4815018befeb4c5434c465ae35f07038b0f2f024301a4738d1a84163baec2bee03", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708296, "uuid": "b2eac214-f962-4617-a91e-e401755275fc", "value": "T1DD7423B204F3CD9F756DA05EC856CF6AF53372F99C8128D1912ED4322027BC85A9D68E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708296, "uuid": "c02afb28-dcdd-4564-a737-a9a98c105643", "value": "6144:0GYNuFtgtmb5SyH5VD3Z7XHJdpMxeL0jC4L9RowI7F5giIbFJN5bFPzMNHudExoy:cEFtgtWzV97XHDmHzWwIjSF/5x9G4G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652708296, "uuid": "2d804122-b5b7-491c-9a75-e8be04e72433", "value": 356184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652708296, "uuid": "fac4e520-b849-49be-9615-3f1fb752cb96", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708296, "uuid": "4e36cc37-123f-470b-98b8-0a01f6860328", "value": "bank report.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cccb0f88-d52f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652716181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716181, "uuid": "c542aa98-5b13-4fd7-8faf-83d0cfefae35", "comment": "Malware payload (Heodo)", "value": "1df2eb425412876907d213ea03020333", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716181, "uuid": "733192a9-be9e-4978-8dbb-f45dc9f3848c", "comment": "Malware payload (Heodo)", "value": "a42e3b85427a88e8229230ce46096a92829064cedd21e8ca075d79b82b2cbcb3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716181, "uuid": "7070c597-7851-45f1-81bb-43e67c678fb0", "comment": "Malware payload (Heodo)", "value": "3099b21112f5c311a23013b823433fc84ba518b0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716181, "uuid": "10997ca2-9a09-4fcb-bd0a-532133af1399", "comment": "Malware payload (Heodo)", "value": "0fa8f8aabc21bcd754e3a1a78e2f85dda3d4620aef834c9006225865520c74301e3007bdde70e50e625d3abf2271e9e8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716181, "uuid": "fd17be84-cbda-4c5c-97f4-d044bfc2e971", "value": "T18D519E2C3EDA6128F5B3DF7179E875D6DEAABAB269015D4F00C4030B4811E40ED9293F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716181, "uuid": "8003bcf0-f9e6-490f-9a9f-7a8de6d5b88b", "value": "48:8mBV5i7B8KTSukPNx4sedNk96BLdKzvnAjk2dt6B/vuoWN04ab:8mj5id8MuNxp96/Kzvv2Hy/N34", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652716181, "uuid": "4e26a8f6-0f09-44d9-b6c3-8fca75d119b6", "value": 2632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652716181, "uuid": "46ea33df-3fef-4e7b-bdb1-d4e6a6e39c30", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716181, "uuid": "95de955f-d1ce-4e27-8f0b-8218c2ddee25", "value": "Notice-09274456.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bd39391-d509-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652699725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652699725, "uuid": "4fef6f93-dfaa-4c4e-ad34-194e5a329fe8", "comment": "Malware payload (AgentTesla)", "value": "f6cdaa147b1a34fe82896ea2a5a1f829", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652699725, "uuid": "a61702f5-f0b8-44e0-8733-b875ca0cf850", "comment": "Malware payload (AgentTesla)", "value": "a4848b31f6063d6dce3b220372c6e2780df063cccfe8b78592c821053537a4ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652699725, "uuid": "5884c84e-caa2-4d05-8356-5a809aae2a04", "comment": "Malware payload (AgentTesla)", "value": "23daa801fd4949dd5238f26931bbfd0c48660cd5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652699725, "uuid": "2710fa38-b0bd-4ea9-9ceb-f99a4d7c23a5", "comment": "Malware payload (AgentTesla)", "value": "9b1c1ef9e680eaf54f5576bbc8ac8e751588511f044677f3da0f2922218360723a79b665eff96b9aa7627f1e7f80a553", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652699725, "uuid": "c61cbafa-6bc2-456d-b96c-e7d6ba9045eb", "value": "T1D405233B9856C49F87026D9EE1BE5FA7166D0323A07D41B028A93527DE40E5B37EE31C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652699725, "uuid": "07633da4-040a-44da-94a7-3546fbe076ef", "value": "12288:kltfe5wo4CL6KsuLNc8pVyTuKvMwgBxK5k4jvrrI6pwPNJD99X2eQaIWNEKao8u4:Ee/Wlu9eTvMDBx2/jvevDa5a9EKa5df", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652699725, "uuid": "031173b7-ec73-4f74-af7a-953c30179acb", "value": 818476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652699725, "uuid": "d5f64201-9b85-4cfa-9c5f-3a6d050ae95c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652699725, "uuid": "c37120b7-989b-41f0-9c93-f7d134465728", "value": "PO P21050044.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8589c675-d4e0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652682131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682131, "uuid": "9657c646-b983-49f4-89ea-459fbd6b00cd", "comment": "Malware payload (Mirai)", "value": "701c31c0792400d5e4f9ed0ff7536ab8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682131, "uuid": "aa26791a-7dcc-4f8d-87b4-6da3f309aa31", "comment": "Malware payload (Mirai)", "value": "a5d49c821f07cddace1a9976a85b092cd25cb2c0399b2fb9d38cd86f0386b51e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682131, "uuid": "b8441adc-f399-4b52-917d-9b8615e7561f", "comment": "Malware payload (Mirai)", "value": "70890d38fb6a73227261146729cf6345dcf66ef2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682131, "uuid": "8d68b48e-0786-40dc-85ec-8f99fb4e7b1c", "comment": "Malware payload (Mirai)", "value": "421d8f8eddc26c35fad84df3ad62a586ca5404aed29f937d324fa66bbc2aa77a43b011d86c3da7ec147e36cf94194782", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682131, "uuid": "04845b9e-9f1f-4d9c-a381-b499539dfd7d", "value": "T1A1F2E16DF57836D9CC2D9DB7518B8BA49D40D08007AB03B72370E8A8F4A57D6EA4A0F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682131, "uuid": "7f0a08ee-c1ae-4f1b-b8ca-f146a79c993a", "value": "768:jyzvdrT4OFji2Xxq2vUrwHWOdoCqZV0ufIkl+7UeW/:jyzVrfjWOUrr5/0uA0+7UT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652682131, "uuid": "5d8e5404-5994-48b0-a30a-407646e1e38f", "value": 36172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652682131, "uuid": "d6f795f2-f7df-4f3d-a228-a974e0fd5625", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682131, "uuid": "6a578289-f656-410d-9106-146a0986eff5", "value": "701c31c0792400d5e4f9ed0ff7536ab8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac3ff33-d4e4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652683831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652683831, "uuid": "716af69d-8b31-46b2-8dc3-ca9265d6f2d9", "comment": "Malware payload (Formbook)", "value": "f0649cf04d4547f11fd5504fe312d06c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652683831, "uuid": "934383e0-b08f-413a-9983-505afd6b5fa0", "comment": "Malware payload (Formbook)", "value": "a5ddc9fe4d816e8d97b3b381a6f654ce065dc1716291179822b5513d7b38d8ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652683831, "uuid": "9f1c0cb0-5e22-4228-bd1f-3192d6a70f6e", "comment": "Malware payload (Formbook)", "value": "17d25270e67ab995efcc23ca8f887b4ebd361ca1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652683831, "uuid": "c7891461-34bd-44db-8c9e-038de4de2aa2", "comment": "Malware payload (Formbook)", "value": "f732796fc0e303a6953f2200d96501733a3cda6059ccdc8f4e02238d5e914616fb734992895288d2489d2310096afa36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652683831, "uuid": "aa28112c-7ca5-48af-baaf-36e9a24260cd", "value": "T142C40247AFDC9263E7BE2EB7A23503116FA5B1146022E30F1E563199EC627C73DA2714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652683831, "uuid": "2b6d21ba-0abf-408a-b67a-3de278ad778a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652683831, "uuid": "65a9614a-bc0d-49e8-9347-1a834b976ba7", "value": "12288:0z/OrzcreO4Z05KxiZVfbnT4Wg0KYMBcNip:vrzcn4h6VfjOX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652683831, "uuid": "a6b5a3ea-e98f-4a60-b6d2-baf517753a75", "value": 545792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652683831, "uuid": "931b591b-0ece-4615-9fe5-6bfc3c98d994", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652683831, "uuid": "8c02cc76-e643-4c05-bc31-5bda87003f4e", "value": "\ubd09\uc778\ub41c \uad6c\ub9e4 \uc8fc\ubb38_Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56742dd3-d546-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652725861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652725861, "uuid": "44dd26c0-8add-424a-8cd1-4c905cfd9d3d", "comment": "Malware payload", "value": "570a821fa58dba4f3d904c873b38934a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652725861, "uuid": "baaf76e4-1aac-4dce-b5e1-29c54a5b68f1", "comment": "Malware payload", "value": "a6215f68a50e40344e9d1a18983f4cdc101be7edb36e1bdc5c431963513892bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652725861, "uuid": "7a3cb7af-90f7-4a46-bc90-389b92553d2f", "comment": "Malware payload", "value": "29721cee64041740097fd7f03e062cb86fd67d11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652725861, "uuid": "80591ea7-7d29-4691-bfae-e16c182eb076", "comment": "Malware payload", "value": "60cfe0d96b7d4387384bb203d63e0b6298ca248992ce68990fea99f9909345a0ba28dda18749eb7a497151ae7333e626", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652725861, "uuid": "b4629aff-4f6c-4124-b33b-66bca6acef3b", "value": "T15984C04573A48079EDB79338CC574A47E376B86907B0678F1364436A9F3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652725861, "uuid": "50d500d4-1672-43ff-8b31-0656e5046589", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652725861, "uuid": "eca49e7e-8927-4d70-9903-dfb848e59259", "value": "6144:EbmRW/X22TR72tKbxGeskesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/spRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652725861, "uuid": "f46c65fe-2de0-4efd-85bd-0f1e03319e0f", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652725861, "uuid": "9afb2d6a-b85d-4391-8376-48ce54749c60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652725861, "uuid": "cc2078c9-554a-43dc-bdaf-62bea333fe36", "value": "570a821fa58dba4f3d904c873b38934a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b23d6590-d4db-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652680059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680059, "uuid": "d79dcd14-8a7a-488b-b790-df7fe6762860", "comment": "Malware payload (AgentTesla)", "value": "ce8e9fcb8b6ecd47e1cb3759b3579ac8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680059, "uuid": "5f07d2b8-e70b-4b7d-8113-497c65e676de", "comment": "Malware payload (AgentTesla)", "value": "a6d4ebd78476f6437984f5d5f836ffe77ac6e1bf5b0cee0e9d2e89f79a0fedff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680059, "uuid": "b3b63d50-7fb2-4966-9080-e295298ba8b8", "comment": "Malware payload (AgentTesla)", "value": "39fa72fe5dfbc110db6bd193aac09bb63d391620", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680059, "uuid": "98c50690-a0a1-412d-8f31-48e76478ee54", "comment": "Malware payload (AgentTesla)", "value": "97a3fabee76aa720f50684aa5536204881bcb3c4f541edd93d3bf40d9cd05be1890b2f7bd6a1b6dab14da26a2cd470b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680059, "uuid": "a43969e2-b215-49cc-8c0b-2c25198ce213", "value": "T193C42350A2FD165AD6FE47B4223A480806F1F612B613EB2E6D9F70DA2D737945B0037B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680059, "uuid": "b392c475-ff35-4c8a-941d-72af5bd189ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680059, "uuid": "f1efa9ae-44c6-403b-be65-b875c1498220", "value": "12288:tY9H5X56WU6vNWPtrFIitsshKEOxiNfKo2NCxW2085BB:OkWU6vE7tBNio2wxL7H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652680059, "uuid": "37f9ebde-4464-4bca-83ab-ed30c7370988", "value": 552448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652680059, "uuid": "b832fa2e-56ba-4618-bb5f-1c6e27a34985", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680059, "uuid": "70675f23-2c1c-49b8-9b6c-322516b79e91", "value": "RE Re RE Purchase Order dated May 16, 2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7da56c41-d520-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652709606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652709606, "uuid": "5c218e6a-6ecd-4da4-964c-b2c40147a6ca", "comment": "Malware payload", "value": "44aa4dbced81ae13e7d3fdbe863ec628", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652709606, "uuid": "0108dcb7-d67f-4723-b3d5-f588f22289c6", "comment": "Malware payload", "value": "a70b3a77b922edf738d9af2348f3707a5001e6551c15c253d82f08c438cc11a1", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652709606, "uuid": "9872f99c-c391-4c44-afb6-9f0116eaa1fc", "comment": "Malware payload", "value": "021b3c3c7019375489888d189593d450e806847b", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652709606, "uuid": "4ec9d3e3-031b-4dce-b193-aba604c92684", "comment": "Malware payload", "value": "708e5120073bab2f085eff9caf4b89065aeb2cd57575f13ce703cc1ca84724dc484a2e3f041d9c877c6a6f8e9e657c90", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652709606, "uuid": "9294ddb6-740a-4fc6-961e-4d323aeac924", "value": "T1252412A83A35694EC7B332B1E85D14CBF206EC676C038225F384BD9D47B8E515AD13B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652709606, "uuid": "06e189a4-9395-4402-ae54-c6ca6a9f2895", "value": "6144:QghmbINm7lKUnHW5+fj/KSwSUyB2A0V2N33be:Qgw0m7bnd/WE2Y33be", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652709606, "uuid": "9ee4018b-f606-4090-b3fe-22c4123611d8", "value": 228888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652709606, "uuid": "0a605d5a-0450-4606-afc3-8598f0d21a97", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652709606, "uuid": "481c523f-ef7a-4b07-9913-6de734d84541", "value": "AWB.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61d90c31-d51b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652707412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707412, "uuid": "99d271a6-0985-4531-91a5-08b6c3500823", "comment": "Malware payload", "value": "3eb50d8a01158bf0c2697affc25c8c8a", "object_relation": "md5", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707412, "uuid": "b737dbd4-8e5b-4ab4-99b8-19557dab4514", "comment": "Malware payload", "value": "a750bc331fac040142dec00216a72a00a4e3ec24ef21e07a0cac445df3edcd3e", "object_relation": "sha256", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707412, "uuid": "c8624f19-fdc4-446f-baa2-c94ac1b163cf", "comment": "Malware payload", "value": "87a11b23ceebf073709580bb79ea11d7af5acdce", "object_relation": "sha1", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707412, "uuid": "03d72c7f-ca0e-4ab8-ae6b-443a78239b31", "comment": "Malware payload", "value": "aab193e6c44c89a0400b8b24d09b25f2baca89225d185100de9b6f1c135ef8096f7427a72159bcd48292fbe1fe58e10b", "object_relation": "sha3-384", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707412, "uuid": "1764ee9a-9ce6-49d9-8699-622873dbb2c5", "value": "T1CB95C03BF268A53EC45A1B3245B39350997BBA60B81A8C1F07FC384DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707412, "uuid": "3deadc49-3fa2-4c56-bf4f-d786b8f895d9", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707412, "uuid": "1cb5a803-368f-4586-8026-0e835637af70", "value": "24576:84nXubIQGyxbPV0db26W3JVEuvijYsv1Et9uGpckT52zedlq89Ws5uIzk5aM/phz:8qe3f6rZ5SffPMWrQ0Zkl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652707412, "uuid": "546e3f37-9ecf-44fc-b009-5c3440e8c67d", "value": 1934664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652707412, "uuid": "f0adfc16-a7f4-457f-a102-3b34f425c0df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707412, "uuid": "7dff73d6-d5d7-49f8-84b7-a39335f8936e", "value": "VkDJ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33775af4-d522-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652710341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710341, "uuid": "42820b45-0975-4900-844b-c7805175f0f3", "comment": "Malware payload (Mirai)", "value": "214036821a903d6917a2755651efe2b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710341, "uuid": "394b40f4-710a-4032-b114-59e0913c32a8", "comment": "Malware payload (Mirai)", "value": "a827679d85661c2cb2b0078e80ef45e7a55982d7dd36bd731b926a66ecaf2b9a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710341, "uuid": "fe54c72f-60bc-4082-8fe2-17d2c9d88c5b", "comment": "Malware payload (Mirai)", "value": "002eb12f259f17b85cbbe542758c90de1e968e65", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710341, "uuid": "ccd4de75-03b7-48b8-a0ae-28113f76b75c", "comment": "Malware payload (Mirai)", "value": "a53e2a6aab582ff657708132a29c7c3d8a7e28270da08858d0ce8b8e2bc04c6128b0480fb18a91e49ee9756f32079ac4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652710341, "uuid": "c00a0e77-759b-475b-b838-00ba0def031e", "value": "T156B2D1FC9E02439BD65C517F4AA41B202C650F916583AE4E546EEF589C422F43D23F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652710341, "uuid": "3392d16a-b3ca-485a-a533-c66b83e82500", "value": "768:MJgb4D1i1BNLOBak8KKYEAq0JgGlzDpbuR1Jc:OcjDBjATVJuq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652710341, "uuid": "f2e7c9e7-13d8-4b71-b8dc-e6af69fb9353", "value": 25692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652710341, "uuid": "6ab8dd09-5202-4de2-9c09-873ac2a090c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652710341, "uuid": "defe1f0e-6c51-4937-a997-47e5f537a3c3", "value": "214036821a903d6917a2755651efe2b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43abac5a-d51a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652706932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706932, "uuid": "e15ed521-0115-4099-9784-b387d2746a46", "comment": "Malware payload", "value": "a07c01c913f999c048bec5deb9f433a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706932, "uuid": "4a1755b8-fee0-4eb3-b216-9128b1fdaf0b", "comment": "Malware payload", "value": "a839ef560ab73be0438f2eb78d99e8eb25b99787aefe61e463c8c3199bf39ba4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706932, "uuid": "c08ffd0b-437a-4b83-8058-a1c35b832db5", "comment": "Malware payload", "value": "d744e31d24094f79e1d88e3e412089ffcb564c1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706932, "uuid": "44d1ed2d-197a-46cb-b3b0-c407824dc2d2", "comment": "Malware payload", "value": "a7966fbf5f52181b5a8ffcf5aac20cfdb61bf761a7d72444f739358e12e922bc07ceee54107fa6aa188104826c6d043b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706932, "uuid": "62217ea8-4ad6-4178-b153-6df1dd440306", "value": "T1F96623FC6298331CC05A8D748923AC08B6F6D11E56FEDA9AB5EB36A07F53431E911F41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706932, "uuid": "d793c685-89ee-43ca-a727-f9557db7e1da", "value": "1137563f1487c9e53c7143efb53bc8ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706932, "uuid": "e757f7e8-22a9-4856-947b-85713168126f", "value": "196608:0YgI6zi0JkEA5iY35DySX+RXKLPsjx/DzaKP:0KciAYdV+h9za", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652706932, "uuid": "b9027c78-ae17-4924-943c-57f4b9ae3177", "value": 7020544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652706932, "uuid": "3db89c3c-60cd-468f-8d4c-2439b45936c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706932, "uuid": "d744635a-f200-49d7-92ff-04b97d713ac8", "value": "sloa2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd0f031e-d4d5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652677554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652677554, "uuid": "5d50d603-60f4-4c3e-8998-f7e054d9cea9", "comment": "Malware payload", "value": "35823c94040e35453cf2cfe834085601", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652677554, "uuid": "44d1f76d-1359-4281-9674-16a522a36d13", "comment": "Malware payload", "value": "aab721126d29f2a6bd20c2d0ef80acbd53e93141ac5dfa169718db8928ba4a7e", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652677554, "uuid": "42fa61fa-4083-44f4-b876-39e99262d802", "comment": "Malware payload", "value": "ed8dc466713364f3f54d639310de069ce02037b0", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652677554, "uuid": "c1a2b26e-b558-4fd5-b93e-0ae7a682c45a", "comment": "Malware payload", "value": "6cc121d60e6db1a727dd5fe0155a97fa6da72b25f020d500c94c398c58791674f5a98f29de4402ed65195f05367cbbe6", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652677554, "uuid": "809a0ed6-5f28-424a-b73e-f9588e000c0b", "value": "T11AE0C0EA3D00A9A807A0C4CAF2F0E738A01F69489740DC1364D49473AF946858C00049", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652677554, "uuid": "dff43141-880b-4b27-86ed-c745bb4dd807", "value": "6:q9hqIYLWpgvJK08fpNVM0bpkAqJmW/ClbOJ1QUNMpLrCUuBME70K189uMvnWf9un:nJxKjfpNVM2qJmWUbY1QUCJeUS70K1V0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652677554, "uuid": "ca064d69-c8f5-4ab0-9b85-403b4abbb5d8", "value": 352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652677554, "uuid": "ea2346b7-b547-4706-b47e-2e0bcf289218", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652677554, "uuid": "8f25e13e-1b3d-4ac7-8a1c-bd169479c5e5", "value": "Estorno-PIX_164368024..html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4631fdbd-d518-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652706077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706077, "uuid": "cd981227-28e3-4be0-927a-204088e98c57", "comment": "Malware payload (Mirai)", "value": "9cdefef34336dcaf82338965aeb09027", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706077, "uuid": "5d1ee67e-72dc-4b2e-aaab-4130ed3919d2", "comment": "Malware payload (Mirai)", "value": "aadaf285a52c9b33bcda8fb054b49d5c12627d1e5e2dee7a34860dcb813b7466", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706077, "uuid": "a7388504-4fc4-4a02-a884-4cfd0e5cde9d", "comment": "Malware payload (Mirai)", "value": "99e52235c39150a93326e72f8d19b93441e9a016", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706077, "uuid": "66f9248e-574e-4a16-9811-43576ee3c8db", "comment": "Malware payload (Mirai)", "value": "c43cc287877a7531a7d1c6295c42498deda56bfbbc4139611e875d4428e1579957cdf88802192f70f4a58730fe650667", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706077, "uuid": "9001dbe4-c390-40db-b1d8-54d180452faa", "value": "T197634B0077588E07E5AA0AF9283F17E4C7BEED4011F4F4846A0EEB164236E735949FAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706077, "uuid": "ff66b3b8-f05b-41ac-a5f1-63bfad6970e0", "value": "768:iYh5OL8dY6h/13leBoiRzhqDOK6swJf+tH/LkTv6e5C6HyJxrz6oplPZTReQ7uEX:QLUmB9sOK6L4H/g2uS/rpC0nLKPb3Sys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652706077, "uuid": "9e684c22-632f-459b-b030-44a26acbabfe", "value": 70944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652706077, "uuid": "4992055d-5ee8-4a28-b2ce-d131dcd4f5f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706077, "uuid": "d11411a2-1ef0-4863-9ca4-4be501485fee", "value": "9cdefef34336dcaf82338965aeb09027", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ee780e1-d4be-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652667464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652667464, "uuid": "f762a168-4faf-4e68-8e49-f44403017345", "comment": "Malware payload (AgentTesla)", "value": "0bd57c5d8c4442529b727701d8a8f256", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652667464, "uuid": "53202e40-44c9-492f-9faf-197630230275", "comment": "Malware payload (AgentTesla)", "value": "aaecd614bb1827800c51b202b4fba750e4f93cb36d34ac6cfe0aee8d0ee1cec2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652667464, "uuid": "7d225290-6fcd-48e1-8f17-99a9eff80644", "comment": "Malware payload (AgentTesla)", "value": "eb9911a421932ab18af25f22d3ec581dcbd6b49a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652667464, "uuid": "49aa30ee-4db2-4bbf-8639-9c612bb431ef", "comment": "Malware payload (AgentTesla)", "value": "d353aa3275cca700b3987650ede23a1ac198dc6686c256bbcc282b3f668248ececb43570aa239ccbd5bd496264df8ce2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652667464, "uuid": "7678820f-2697-4207-b68d-79da885c4b26", "value": "T1F4C4232C31ECC3B6E2BB9574223B0E1907F274099562E66C0D9BB5B91C72F860F61677", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652667464, "uuid": "415ae388-704b-4227-8837-ed5a8ba4b85c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652667464, "uuid": "976384ad-b46c-437a-9a9e-a58e56c9e833", "value": "12288:6c684mlIGu3Br3fUg+3CVK7v7X1mO7Kg2CojYUjDGP:e84mlIGOsg+SVKz7X1B7KjjRDGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652667464, "uuid": "43996611-296e-42d8-be04-46dc590915bc", "value": 552448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652667464, "uuid": "b1e5ccf4-a56d-4fde-b04a-562c92099ff0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652667464, "uuid": "3cf69bda-aa66-49e4-86a6-b96f35103294", "value": "178306_AT_1001459828_20220516_E_1,PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cb6230f-d51b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652707376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707376, "uuid": "22761bf0-57df-42f4-8edb-d034ab166e24", "comment": "Malware payload (Loki)", "value": "7172f955f38508eac9bc65f647ed627d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707376, "uuid": "6ffd4d69-f368-4c22-9d25-b46210f864f5", "comment": "Malware payload (Loki)", "value": "ab083463bed04a6a3f8848967a59917e86ea70db776a1b5b3e9a7ca8638ae0a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707376, "uuid": "ae7707d0-e968-4434-ab13-269e44558fb3", "comment": "Malware payload (Loki)", "value": "3533afbac7e63993653c81a899a08cdb499ba244", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707376, "uuid": "22be20fb-2df4-4766-b802-4cb9503af0f8", "comment": "Malware payload (Loki)", "value": "04379580396434ad1087b6fefe2a4dde4a6be44775480d195d85433c565f3243125e8549f1102ee1d6aabc66a0344f5e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707376, "uuid": "23a828b6-4b65-4682-9651-103297d91dc9", "value": "T1FE15AF61A1C5DA59DF2A72F2DE9E8C3122A7BCD50092C69A917A33F54972317DC03B0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707376, "uuid": "dbd7ca5f-b401-4ed9-95af-3e9a8da0575d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707376, "uuid": "659fb42d-7732-4e1d-ac04-19b49ce3c852", "value": "24576:9JvKAC+6OKpLeoP0MAfkxsBwoyGKnzRLsGKAC+6OKpLeoP0MAfkxsBwoyGKnzRLf:LvKAC+6OKpLeoP0MAfkxsBwoyGKnzRL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652707376, "uuid": "b3539a9a-f31e-4caf-8897-d4f5ed45227f", "value": 897536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652707376, "uuid": "50e5c96a-e20a-40dc-bc6d-da73213b5422", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707376, "uuid": "82ae92db-b590-48db-8c8a-912690bc5df3", "value": "7172f955f38508eac9bc65f647ed627d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0829781-d506-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1652698524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698524, "uuid": "b7d392cb-cc34-4762-876a-34d56f9a262b", "comment": "Malware payload (SilentBuilder)", "value": "800bd35865b5b6f1f0ca1b190b4feafc", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698524, "uuid": "e60cadc0-737a-45ec-91d9-a695795317f6", "comment": "Malware payload (SilentBuilder)", "value": "ac2814ff3c89422bad2705cef5e4071a74a843d0026b17057e23ef87a494f9e5", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698524, "uuid": "28716576-45d0-41bc-afee-22544ce5b4b7", "comment": "Malware payload (SilentBuilder)", "value": "75c22fcd56021b0d7e14ae3bf3435a0cb1ea5889", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698524, "uuid": "110836d3-2a9e-418e-ba66-d35dde2da081", "comment": "Malware payload (SilentBuilder)", "value": "caca458bdf19af3d0272fe76dad9e89fdfdab5e3fbf370da92397cf693d11010901718b14fa0d2d32d317a5c2d79d225", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698524, "uuid": "031f82cd-a487-4130-b7c9-79ab4512d69c", "value": "T177734A4AB98AC96CF611873949D747A9B313FC110FAB0B8B3509F3627FF49A05A0751B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698524, "uuid": "757ce7f8-9e36-4738-ba42-83d929c8bad5", "value": "1536:tpKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgCAezwrMCtvJecvRtbu0D5m:zKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652698524, "uuid": "4777395c-e82e-4c82-a669-9e5c7e68d2e1", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652698524, "uuid": "6634ab63-5ae8-4d14-b5a7-9a1b66fa7005", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698524, "uuid": "596e0596-7d9a-476c-8eda-0c1b1091a3d2", "value": "RechnungScan 2022.16.05_1150.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b535c110-d516-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652705404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705404, "uuid": "e6354110-f652-4a3d-b847-e8df0f33286c", "comment": "Malware payload (Mirai)", "value": "736ab3e9012e2ff620f28f3c6824bb80", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705404, "uuid": "97d3d22f-ba7a-4ba8-be5e-5602186c7162", "comment": "Malware payload (Mirai)", "value": "acc4d328507f29d9b96a719197a592f0765f790e1c52735d13a5588787e054fb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705404, "uuid": "073e49c6-3208-4870-acec-af9c812abfd5", "comment": "Malware payload (Mirai)", "value": "eb5f6a672f3d970aba74b44995eaae71e4c49f2f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705404, "uuid": "1591bda7-1737-43c8-aeaf-7fe38fac1a5d", "comment": "Malware payload (Mirai)", "value": "e4832a84911423d761f2813b7fb59eef228d36c146281f2254447f35d983837054a11dbe6a57747ab7bb8f0423780901", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705404, "uuid": "33282bd9-462f-4d68-86dc-d41b20953826", "value": "T17F735BC4E583E8F5EC120939207BEB728E77F53A593ADE97D798A9239C11601D60339C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705404, "uuid": "89202d23-e881-4ba9-bd21-c51fac4441fa", "value": "1536:onWmNJXcpeXdbzGQCZPRvya2n+/Q3VNnhElw1YSBS1Sj9B:rmNJXcpEdXGQCZPRvya2nMQ3howOKSqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652705404, "uuid": "d085644f-8873-4901-ac40-5c7b764ebebc", "value": 79796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652705404, "uuid": "75bb7a3e-7d71-47a8-bda3-e060936621b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705404, "uuid": "0efcf915-9282-4211-9e14-8e01b7b80408", "value": "gx86-20220516-1250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbfafd7c-d517-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652705899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705899, "uuid": "bae9eaa5-e12d-4b7b-993b-4daa6da04b42", "comment": "Malware payload", "value": "4b0a17ae8015965479306887d4b44787", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705899, "uuid": "422196f3-b65b-4cae-9db8-bb082d461f7a", "comment": "Malware payload", "value": "accafbac6570976cee357e8e24306a3bfc436da82533d8d3f13b29344c6e313a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705899, "uuid": "d75ad9ac-4737-4e64-9032-917f53a3136d", "comment": "Malware payload", "value": "9f5341b9516a064267ae19eaed093c4084b55a1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705899, "uuid": "9ca83f37-9229-4d6a-a1bf-bb2c82299f62", "comment": "Malware payload", "value": "9efd4377e7d224162f54ea9794621f390bd35b8dee17f72d2ea69ab9b4f987d71172c5ff491758e2ed91d9695538c081", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705899, "uuid": "606a4a19-43e1-4d2e-84e0-91147ca110d9", "value": "T1EFB5AF313A90D8BAC9232570854EA7BCA3EDBF305AB652C356503F393B75592482C77B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705899, "uuid": "8174043f-d7e7-406f-89fc-afa6533bdff7", "value": "493871f0784d0d733e68b5dfb4b3e7a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705899, "uuid": "7d46163a-e681-406d-b6f1-1132ec3196d4", "value": "49152:r/jOkAqm6hQ6Git2qa4wQtv7DpcMAtKqi+DxE4evRWAcc3/6yROYC/xjU/TbZgmi:+kAqm6Vl3a4wQtDDpcMAtKqi+QRWARvq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652705899, "uuid": "cfce7c07-ab52-4943-9ecb-10c45ce518fe", "value": 2428416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652705899, "uuid": "bfb74456-5dce-4385-8bf4-2d4ef3c9860a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705899, "uuid": "ef751720-bd60-4c16-b632-9a820e3486e2", "value": "\u70b9\u200d\u51fb\u5b89\u200d\u88c5\u7eb8\u200d\u98de\u200d\u673a-\u7b80\u200d\u4f53\u4e2d\u6587\u8bed\u8a00\u5305 (10).com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79163b85-d527-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652712605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652712605, "uuid": "955dbb16-f1e9-41b8-a87d-1b9fef402079", "comment": "Malware payload (Mirai)", "value": "b151684bcf85c615f72b7676305f0da3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652712605, "uuid": "52bba6cb-6734-4c58-954d-4c76da3d921d", "comment": "Malware payload (Mirai)", "value": "ad36170e05c2a0ad0c26bc9432e7c6789fc38738df9b241857ba7c0afcc344cf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652712605, "uuid": "0182e7c2-64b4-4546-89a8-fb1618666312", "comment": "Malware payload (Mirai)", "value": "1be8150aa377af645ab526a413cfac2fc746e65c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652712605, "uuid": "ec52cb6f-b8c6-4838-9f50-febad97af8c1", "comment": "Malware payload (Mirai)", "value": "6c88c28c96d0049613588ed337cc19c5ffae5fea4ce8c8c2cd88448dd30c32ea418109893565e3bd63a64429e06398f9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652712605, "uuid": "cbbdd5c5-5429-4ccf-8553-f249e52ffa9c", "value": "T1C1F35C46FA404B13C4D62776BAAF42463332A794D3DB730399285FB43F86A6F4E27905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652712605, "uuid": "c6c99586-e4e7-46b6-a0f8-b9d3b9d7475f", "value": "3072:1PtVfAMJ7CPrmFwpvW9uabdHcPG9VziBVKSD1miM/9Guclm8wxQ35x:dtRA8mjLUbdHcPG7zA3D1LM/9pom8wxy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652712605, "uuid": "825f429c-54e7-428d-aab5-05e8b2258050", "value": 163514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652712605, "uuid": "b3b0b2cb-e4ea-4057-af42-340567bbc19d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652712605, "uuid": "233d6a23-9bf0-4216-a5e8-1c6f21e8b633", "value": "bin.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c63f81b2-d512-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652703715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703715, "uuid": "0d256cf5-39aa-48bb-b56e-d35100883fe4", "comment": "Malware payload (AgentTesla)", "value": "cbc2a6a8f9ea9d059d9813dd4e90dbc7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703715, "uuid": "d09741aa-9d71-4f87-b9a4-207ddd15b3d8", "comment": "Malware payload (AgentTesla)", "value": "ad3da01cd367e68bad4e0a488b974f778be327047827821a0b9e7157dd32734d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703715, "uuid": "588873d4-9632-403c-bbc4-974aeef06d0e", "comment": "Malware payload (AgentTesla)", "value": "9e458d539d90526b60ad345f8c6f27aa1013d642", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703715, "uuid": "c1e2a8f1-17aa-4452-969e-dfa06754df7c", "comment": "Malware payload (AgentTesla)", "value": "26b5e22354d8dfd7d75b4cb7ecf2b8fca5b06860b651de5578f2817d6878c1831d8dd28cbb00b2044c55136d9608921a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703715, "uuid": "1d62e955-4eb6-4f05-aa8e-638b13e30ffb", "value": "T1D3B4220463DCC62ADABF6AF4A736505046B3742AE552DA2D4DCB90EE0DF2F44D780E32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703715, "uuid": "a6d5e58b-076c-4e38-9b40-c540dccfe334", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703715, "uuid": "aae7b859-f883-4bbf-8786-60db05360ef5", "value": "12288:DEp/uyeeOzfCWwKoADAog2kf/0dUuu65sXMm9B:DEZlep7TwKn7gJEoCs8m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703715, "uuid": "d5bbae14-2662-4df4-86d8-faa6d418f01b", "value": 542208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703715, "uuid": "f4edb082-d52e-44ee-89da-668f89c01883", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703715, "uuid": "d59ebc20-1022-4099-a312-79524de64b88", "value": "FedEx Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeedfce2-d511-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652703246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703246, "uuid": "45ca913b-b661-4814-be7b-c407276b5673", "comment": "Malware payload (AgentTesla)", "value": "3bc14415609d104449b942b82fdbdb78", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703246, "uuid": "db67db1a-3b29-47ba-9d41-ce83ccaaff53", "comment": "Malware payload (AgentTesla)", "value": "ad7e94b4684312ecf2bb0bca7986a22e0b07deb96bb637bd0d47bd1d05b3f365", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703246, "uuid": "6437b989-c21d-45bb-8899-3445eb9bac74", "comment": "Malware payload (AgentTesla)", "value": "a235aa25187515eee50babb535f999c20d4b12d3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703246, "uuid": "540dacb0-735b-4d0e-b432-76ba3e6b1c46", "comment": "Malware payload (AgentTesla)", "value": "3744c21130385cc469f3f47b3470dcaaf50d6d8d33a1c28b7aef5054f73104350b855921f7809007c7318a95f0499ec0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703246, "uuid": "8cd3dc0c-df06-4e2a-8551-c9b1bb087afd", "value": "T19993F18D2A29DA46E4C7A6FDBEED8EEE12CFBC03F4A59505B346361D413C485610F50B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703246, "uuid": "14464c4e-0f82-4727-b59b-fec064c39795", "value": "1536:Aej0djUZN98pE8WVse69GFuW/eeGIE5mBUGbA7nksaujpG6crTKoOqNFlo3TyCP4:Aejx98pE8WOFjW/tEPqYnk8pGZ78TnP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703246, "uuid": "7486c814-d3c0-45ca-b75a-105fd1158270", "value": 95744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703246, "uuid": "c3bb8fb3-42b9-4c68-a7d1-d0c48ea1bb7d", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703246, "uuid": "9995d16c-7450-48aa-b0eb-1efb31825f9f", "value": "ORDER.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f2aa874-d511-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652703220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703220, "uuid": "7c2c1f81-1c87-4ed5-b118-939532b7e31c", "comment": "Malware payload (Formbook)", "value": "93e459c9289575c456019b0e03054cca", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703220, "uuid": "d452bfea-1b3e-4ec1-9725-0c053e55af86", "comment": "Malware payload (Formbook)", "value": "adda20a966725131c39113dc7984e288fd50b8bab5b64f03ded482ea3e6dc8c3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703220, "uuid": "d452bbda-c019-4f20-b453-75aae6a101c0", "comment": "Malware payload (Formbook)", "value": "6a10131317b842f070bd29ba20f6148678423ca1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703220, "uuid": "11c636f6-7aca-4305-9944-2282bf239538", "comment": "Malware payload (Formbook)", "value": "1e16775ab72dc39d61f8f68658cae96c969811b787a7d88eae3f45eada95a590a74b1579b636eafe0949fff0be592242", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703220, "uuid": "6f7b78ec-14d8-4427-979f-9e91f32219c4", "value": "T1A624129DB99C809CF2C364307CC05F807D52DC2E9B8B61B479F876402BF5ED12965E6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703220, "uuid": "2ab9eca0-a26d-43c2-8a31-2d95d6de94af", "value": "6144:sTCQmTENkw6wSvW/cFOVQ98UGYjSmdBDxbP9wC7:sTusfTVcFOVQHGYLbz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703220, "uuid": "504d3ae1-e6c8-4086-9902-dfdac35cced4", "value": 229400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703220, "uuid": "551aff3c-7aa2-4510-a753-e0aaaf55fa1e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703220, "uuid": "b9283b2e-cdbd-4645-9e8b-6b875dacbaa0", "value": "PROFORMA INVOICE.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ed4ef4-d50d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652701436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701436, "uuid": "cc0a7e81-3d26-435b-9f1f-8585bea2de10", "comment": "Malware payload", "value": "708e2d6b2b59ddeb88fb051ccf3869c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701436, "uuid": "083f949a-b66a-4692-8868-deeeac41a74b", "comment": "Malware payload", "value": "ade283e1dc7b88a52ca2c0ac149af10ff68dff1709a27dd800936a7345cc6b56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701436, "uuid": "666ae3d1-d461-432f-bfa1-7b9896343511", "comment": "Malware payload", "value": "678048ad55418587075d1df6c91eade66823de2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701436, "uuid": "953e82cf-12cc-4d78-8a15-f5e047356eb0", "comment": "Malware payload", "value": "36a2dbf024d094efe6f2fc24c6585a8448d0847c4842103381e3899d6e94c769b6a13519e834bbb9ce48dfbbf53f32b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652701436, "uuid": "50c84dd2-3501-48f4-8b0c-4c79821e4d5e", "value": "T1175612117E685A15D8EE373AE3E21C092BF594A31661C49E7F5E27C20563703ED2B33A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652701436, "uuid": "6181442e-4d71-4066-bc06-db45a80d0b5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652701436, "uuid": "2b4c3b14-624d-4e9c-b14c-ae95cea77d8f", "value": "49152:qEaH7/7iK4n1b5oe0GdKxMufW4DC/j0ThnEQAGeNDPAvuzWtAvuzWtAvuzWtAvuj:RndVfP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652701436, "uuid": "468ac37b-563c-449b-b814-e02d260dd030", "value": 5921792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652701436, "uuid": "16570d6a-e68d-4c7d-b7bf-a98be4a3162e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652701436, "uuid": "b30d3584-26c0-4cb5-81f4-ba4186bf7176", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c16b2471-d522-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652710579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710579, "uuid": "891c6796-122c-4e8a-bdff-0afc3ea82357", "comment": "Malware payload", "value": "f75bd8a8b26116fd88a8e8df03200f2b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710579, "uuid": "eb5583c1-7fa9-400b-b8d5-0d03d6ac35eb", "comment": "Malware payload", "value": "ae7e260221b1563ea57ae59d1fec5daa3b5ac3fff0cd917873144cf3b5740ea6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710579, "uuid": "5cf41cc4-fa6f-47b2-9820-56badf96932a", "comment": "Malware payload", "value": "9ccb005e8618d7a5ad2a39b6f6c7e575eeb84694", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710579, "uuid": "b627b697-c845-473c-aeac-61d66ce353ba", "comment": "Malware payload", "value": "a0cc0a2bb445853b1b6d425fe671c618fa0cb5c938cf4a0576baebdc6ea3a73053ac960adffb2fe5e6af67511471f5b2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652710579, "uuid": "45f38c1e-273d-42ed-862b-63617ae0a04e", "value": "T1FD63A3888307D3AFA45F18FFEC46195323E50E26A8FC4189D7F8149E29BE55D64E058F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652710579, "uuid": "84535ee2-3476-4d4f-b945-bfc4614c74d7", "value": "1536:ae9x1rdNLnSnxtXQNcGfsOjn5RA1jUbvo8VkhjfpVx9r9Ml:/rID9Ojnq8+R9Ml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652710579, "uuid": "700c13cd-139a-4791-891d-53a9c0b2fe8b", "value": 72628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652710579, "uuid": "5a6af6cc-b111-4c6a-bf10-382643bca6fe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652710579, "uuid": "d2ca7446-fa8c-45ed-aeaf-21ed662a2005", "value": "26gcw6zquf.PS1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86388cad-d4e5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652684280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652684280, "uuid": "0a81a5b7-e11a-4176-b62c-a6c709342833", "comment": "Malware payload", "value": "ad42d271e4b7d5c14c179c6cbe559bef", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dynamic", "colour": "#EC48CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652684280, "uuid": "a071646f-c866-4ca4-b44b-077f05301b2b", "comment": "Malware payload", "value": "ae8abf10e555cee9769abea0e2d3379b11bc6a817f75a0b6038d294fa3d6a136", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dynamic", "colour": "#EC48CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652684280, "uuid": "002bc203-08d0-4e0d-8155-8296b57634cf", "comment": "Malware payload", "value": "3cf564330231eedce6458836b03e3c129c799b47", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dynamic", "colour": "#EC48CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652684280, "uuid": "b0851bae-a09b-4e0a-93db-2f8668acf3a4", "comment": "Malware payload", "value": "64e62e1c23b735a5c5283c954341e3e541dbd7a6b4412f02c3d155fd93823e6272de31a8568fdcf88099cc3e6792ef98", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dynamic", "colour": "#EC48CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652684280, "uuid": "dcc8a27e-788a-4e32-bb38-b253074e1c38", "value": "T1E233A20723EDAD85E6FD4A783B7343D4C339ED1A5A13D66E09C470296A3A78379013E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652684280, "uuid": "4fc9b9d3-63a5-41e9-83b7-f2459803095e", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652684280, "uuid": "d90a5cfb-b12c-43dc-ab3b-f1a52981cf19", "value": "768:mG0+OqGLEJb+SFeagWNRJHMMNcA/nx554oq3U07WAx3ZsLaXLw:mMJ+SFNRtMxTZ3UXmU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652684280, "uuid": "b42f2bd9-46f6-4531-bfd7-af5f00606efc", "value": 54272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652684280, "uuid": "251db0e3-428f-4201-ae5b-6c72b9725da0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652684280, "uuid": "c57b53fb-e19f-4f0f-9713-0944870abe99", "value": "PasswordStealer.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9184a11-d4f2-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652689976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689976, "uuid": "4ebee375-3780-4075-832c-613f8bb849f9", "comment": "Malware payload (SnakeKeylogger)", "value": "bbea5cf31b7051fb1b50779db9889384", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689976, "uuid": "720965c4-75ab-4817-80b3-fb50810f99f5", "comment": "Malware payload (SnakeKeylogger)", "value": "af530371b4be2eb16df4aef4f67b47429193dda3a33eb912c13ff0d492632fe6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689976, "uuid": "1bd9480f-8224-4df3-b872-f0976e947a1f", "comment": "Malware payload (SnakeKeylogger)", "value": "346c99cdcf9f092c4b9b4f879e6db83d9a36c552", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689976, "uuid": "14b61921-0c99-447e-9015-d55fdff31d5c", "comment": "Malware payload (SnakeKeylogger)", "value": "197c80d3c82bd4a46e1387113176965db0bad447e4e5fd9235f84a61bcb6ddc8d5b22b3aaf79b5e31c0ab064b580b496", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689976, "uuid": "be2eab55-9d95-4d49-8c2a-e5172837ddc6", "value": "T1FCB4E0AC7164B6EFC85BD4769A992C74EA61747B431B9203D45340EEAE0D987CF240F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689976, "uuid": "6f688116-3759-4710-b085-f495e00f7058", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689976, "uuid": "71e5d87e-f95f-40f8-b0b7-f1634a66d03a", "value": "12288:Sw/GSr7DE4qRU+JorCcgHimabo0Fcy4YiKHa+DxnrRat6Q:j/NnEOWczV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652689976, "uuid": "ec98907a-4eff-4f5e-99b4-2b685643ba39", "value": 521216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652689976, "uuid": "561af03c-d3a6-4645-9ff4-29ae1dece29c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689976, "uuid": "65837f42-f27f-4905-a47e-91046e7f18be", "value": "RFQ#1952022(BOQ-IT-Equipment.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c203dda-d545-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652725307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652725307, "uuid": "e4ab6ebe-a572-4e37-bcc2-80b8cb0c943c", "comment": "Malware payload", "value": "ba16000d74085d190d2fbc10431baa85", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652725307, "uuid": "0425c2a6-1d47-41ff-bc3f-16b8e9f2d96a", "comment": "Malware payload", "value": "aff35e96af3100894ce8e080804e647ef3396e2d66ba04b393052545483d4d71", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652725307, "uuid": "80a10858-332d-40c2-9a85-0043e9193be6", "comment": "Malware payload", "value": "e5ed4478b8e73e2451490d4cc059dc069e0a8b8a", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652725307, "uuid": "c50cbde9-0401-42b0-a3b7-ecc508ddb992", "comment": "Malware payload", "value": "eb4c253cf6ff199434bdaec38b7b66f0504e60e8342f5864075a90e70274432ebf45d0f4f23aa1f0f85be272e2be223f", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652725307, "uuid": "5a20acda-cfc6-47de-be92-d89b2d24a532", "value": "T13FE4AF22E3D04C77C1772A789C2B7768A839BE112D7899C72BE42D4C4F3568136362B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652725307, "uuid": "431f6aa0-c644-486b-a1d6-178883c0682c", "value": "df2c97204ed982b8b3e7393fd2a71059", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652725307, "uuid": "6b7c1d1d-0a72-450c-a731-4ad7ba4eb8bf", "value": "12288:LD25c7bMl3XyN6VqX1bFJf44pnlG2LniEE2DY04zyHHsPNasifQu8z:H8Aw3CowXrJf44pnw2Ln1RY04uHHsPNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652725307, "uuid": "59aaf6bc-0c7d-4637-a526-a30807b779fd", "value": 719023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652725307, "uuid": "4aa2b33b-1012-4455-9f55-e74841cf6647", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652725307, "uuid": "c10cfbb7-c261-4ddd-9a04-9c27b5f3df71", "value": "file886.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76c0753c-d53b-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652721191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652721191, "uuid": "4f9aaa67-f793-450c-b960-6e5e2c7c900b", "comment": "Malware payload (RedLineStealer)", "value": "7076c66f15d5b2c41e4d23f0cdf11a4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652721191, "uuid": "d5c05361-e500-4596-abe3-6ee19d0bff81", "comment": "Malware payload (RedLineStealer)", "value": "b0765e8647954eef0ea1edfb75fe1d891bf15d42792884208c4673c20a761c55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652721191, "uuid": "ce92b5ff-a859-4577-abe5-411f40f79290", "comment": "Malware payload (RedLineStealer)", "value": "12cd91172f4799e490420da3b559a133451962d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652721191, "uuid": "ee1127d4-9934-4042-a5ba-c8445e13b177", "comment": "Malware payload (RedLineStealer)", "value": "7173d23811fc1253bd65f4987f96806c1aebedcb181d75015b3f9a239a56e4e4aa44aa72ac2133556968cba37c000c7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652721191, "uuid": "9171fde0-9708-420b-bfd7-5809d5dacba1", "value": "T15F654B9BAF15D91ED6133070819C967254027BB12E0FB893AF456AAED33B1D0FE25B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652721191, "uuid": "df696fff-9fe1-459f-8daa-d093377a49b3", "value": "37a87ba4c777dcd1db50684f6b029f1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652721191, "uuid": "a0be5ed8-c707-449b-add3-e7441882a7e7", "value": "24576:nKBXpPCqDgLzYL3AVDSRS54SPM77eJl0YfufRx45B1Lt7jDRjHQf5CP1+Ng8n539:KBX0ugPwAxSRS5xEHeJFfCRalxXwgW5N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652721191, "uuid": "24b77e35-9e97-479d-bef7-599e76cf29cb", "value": 1413048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652721191, "uuid": "d5be5de3-bc03-4a2c-967d-97fdd43809ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652721191, "uuid": "7d20a071-3729-480b-95bd-ea4b9e51dd37", "value": "7076c66f15d5b2c41e4d23f0cdf11a4c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a62eb8b-d512-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652703507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703507, "uuid": "20b21872-f6df-44e9-b612-cf3ce1434657", "comment": "Malware payload (AgentTesla)", "value": "71b96dff14694a837598ce48cbf2cb14", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703507, "uuid": "41156b5d-9d99-41e8-bc8f-595a88238f61", "comment": "Malware payload (AgentTesla)", "value": "b104de8075d59139f7d39dfeed0a8c1271c328ec4eaf76317a0eb5359b451d59", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703507, "uuid": "bc31ecca-a9ad-41b7-8b95-9fcd738dcddf", "comment": "Malware payload (AgentTesla)", "value": "536a2021fcca62bccd874888dc6424c08bde550e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703507, "uuid": "6fc0f62a-6bdb-488d-80e0-e550bab6aa6d", "comment": "Malware payload (AgentTesla)", "value": "031e671b26552b4a82857be37093cc643b35794380268988bf831aab0eb1bd411dd0a4345a872205026eb847fa0ebb6b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703507, "uuid": "35a4cd15-77c4-4464-a8f6-d14e8fdbafe1", "value": "T145D4F0EC722472DFC957C5769EA91C64AB6034B7931BA213A41341EEAE1CE97CF440F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703507, "uuid": "950ff49b-7146-4d6d-b559-3f77895007c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703507, "uuid": "731b520e-ed10-4c4a-970b-0a8f4e8fa9b3", "value": "12288:1TIKeB9l1ypMAUY2EIBP6pQvHEKIi8k4ZdUZR+UtEP+YjKVbTMKNpd144BLAHwa5:IB71+WxEIBi+vHE9rzoF2MV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703507, "uuid": "e80dc57c-2728-425f-b9d5-9ebb7b6295dc", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703507, "uuid": "d754e018-b76f-488a-a9b3-ae69495b432f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703507, "uuid": "b871ef7a-2586-4cc7-9232-7b6ea16c0e75", "value": "e-dekont.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b611a49a-d516-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652705406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705406, "uuid": "83db4262-742f-4ccb-85d6-de7ef096a2a8", "comment": "Malware payload (Mirai)", "value": "d88814b3e1d9f4acf16620f677a85891", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705406, "uuid": "13f583dc-3009-454d-a0e8-b2c086ab11d0", "comment": "Malware payload (Mirai)", "value": "b14f0b274cfdd602c131bb7ea29222c24ed94dd1f2160ca3a5cf11bb9dbfeac6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705406, "uuid": "b10919eb-e14c-4a2b-80b4-884138675173", "comment": "Malware payload (Mirai)", "value": "ef72d02e091350570bd0d0ac2934a4b5ac717771", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705406, "uuid": "a0027c6e-c081-42dd-89ca-cfac33d7f75a", "comment": "Malware payload (Mirai)", "value": "55c1ba902568a8b690594570871070c8a1a02a4906779d8184459dd60d35d9d15b6f5b24d8ec6473cbb71ded094413d1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705406, "uuid": "84af20e8-3247-4e66-abe5-bcd988c35c4c", "value": "T14D933A85B840A622C2C912BBFA1F028C376523D8D2EE7317DD205F6173CB95B0DA7796", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705406, "uuid": "d44943ad-8c52-4b57-b941-c30f03e6f718", "value": "1536:vCrEoHEsCmp+9nwxxotDwROi8n/K4+12u+nKO5aMKansWGrvB5:vCrEoHEsCLnUU8mC4+1kEA23", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652705406, "uuid": "ceb3e19f-2416-4054-a1b2-c70db6e3c959", "value": 93656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652705406, "uuid": "08e9958e-d259-42f4-adda-5680165a3b44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705406, "uuid": "20cce3b3-590d-4e86-94d8-aa156d4d4032", "value": "garm-20220516-1250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9616b88-d501-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652696499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696499, "uuid": "2713bbc8-f6a4-492d-bcf4-682deddc03ba", "comment": "Malware payload (Heodo)", "value": "f74f3e9f770401986efa87e899898a8f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696499, "uuid": "f305083c-6b72-40b1-8910-541e5221f958", "comment": "Malware payload (Heodo)", "value": "b1934b095b563f4f000ddbe304e08ef233519100b32dffd59862961d8585ede1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696499, "uuid": "764340d7-67a9-4aa3-8771-61d1d2b04590", "comment": "Malware payload (Heodo)", "value": "391f62e9bd20a888d556c616bf22cc96b55fb9e4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696499, "uuid": "960d6502-9da7-4359-b840-9a9cea8890fe", "comment": "Malware payload (Heodo)", "value": "6a8d00285fe9a721cb68a3816068b4617cc954ce9e233acbab7d6d32f677f216c56c3dcdd0aa5263c1887a94737f5375", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696499, "uuid": "db6bec77-9b46-4596-a356-a0737e641ea6", "value": "T170055A35FB6C8492C6A3953D88A34B06EE6AFE840B6183CB1290733E9E777D45C35671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696499, "uuid": "cb9de095-277e-4c8c-9c7c-0d64c0ef526e", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696499, "uuid": "72a9bc10-f246-4d12-bd9c-b9dc9f56f463", "value": "12288:Q9983xfoz0/7aG8GkZHFT1YicDAXmvQaZsbNg:A9UtozAWGxGx16AWvVZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652696499, "uuid": "6d28696c-6605-47cf-9f08-83c6ba2afac9", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652696499, "uuid": "232d612d-1cdf-4b36-b4b8-e1502af0cd6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696499, "uuid": "6c871a0f-6ac4-4e37-adaf-c1b310296465", "value": "f74f3e9f770401986efa87e899898a8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2dcb639-d52f-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1652716165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716165, "uuid": "6737d4fb-6d1b-48d5-a1de-31a646acf63a", "comment": "Malware payload (SilentBuilder)", "value": "c23e51dfc2cf2bd487be59f01054bb3d", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716165, "uuid": "16d1924c-1fb4-4a4f-b1f0-d3040ad256a3", "comment": "Malware payload (SilentBuilder)", "value": "b1a1b25f6d6382c6beb061a7724feac0035e67b4c1a21282dc5c1192803c1e2a", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716165, "uuid": "38acba7e-5db0-4345-8283-b1b3f2f36229", "comment": "Malware payload (SilentBuilder)", "value": "ad803e001b30e028e6ec3a849cd10b4f104fe48e", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716165, "uuid": "1b0f3334-ee53-4183-84d4-7f9d7a157e68", "comment": "Malware payload (SilentBuilder)", "value": "009857eaa9db1ff9903be1c8cd1499e98b6235e34ce1897032d042472ed0bc094fdebfc88560a4dc9753847e6888a3f2", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716165, "uuid": "9f1e1192-32f1-4c84-b454-75204c147ab3", "value": "T19F734A4AB98AC96CE615C739499743A9B313FC114FAB078B3109F3727FF49A05A0761B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716165, "uuid": "30b8ec76-164d-457c-8824-c17c227afb51", "value": "1536:tpKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg5AezwrMCtvJecvRtbTNFY:zKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652716165, "uuid": "161ece7c-49fa-4181-9ef2-05a4ee14b085", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652716165, "uuid": "85a41c12-2edf-4bd9-9dbc-812973e2803e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716165, "uuid": "5138c868-57c2-4349-900a-aad776459b7b", "value": "allegato-3387.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ec74cec-d516-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652705286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705286, "uuid": "ebe60c94-d35a-477d-ae7a-ae02801e804e", "comment": "Malware payload (RedLineStealer)", "value": "ddd15a5efd67879ffa0555df39457557", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705286, "uuid": "5fc5ee84-ae11-4ec1-82d4-ac58f258d74e", "comment": "Malware payload (RedLineStealer)", "value": "b1c2bad535b059f0705ac4d42f676d4e833b23b36c922cb77ba43d0d166465da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705286, "uuid": "7e707bcc-4879-42d7-8e22-8fee87745e75", "comment": "Malware payload (RedLineStealer)", "value": "ecd0b4d61a8497d511dd80865d5f6d98d08509a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705286, "uuid": "6e12a07d-730d-4eda-8a18-23fa092c4bc9", "comment": "Malware payload (RedLineStealer)", "value": "0aa153abf99b0d4a1d89bec4bdafe40f99578c6156e6d6bc0a72568196a9377fee7c6fe6b3368d2e67afd6a65da4909d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705286, "uuid": "11425eee-407b-4be8-aa8d-810fc3c2a537", "value": "T11994F102B7E0CC71D3622E304465D7A2577BB4221670486BF7A4676F1EB3BA09AB6317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705286, "uuid": "0194bda8-cf7a-4901-9e0f-58c215d2a1ae", "value": "1aa8a0bb9714464b5f28dfcf2c93afb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705286, "uuid": "46e6970c-99d2-418e-a2d1-7b11bc87a646", "value": "6144:/9yGiDvMCi+8XJ0tNcG55Va/0fyl+Yrs+4SXky+Ogb+bnsiga3wVfl:/AGiD0CixWc25Aw6g+4SkFxbCnp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652705286, "uuid": "9658356a-5a90-4e6f-9546-e8c77a8a2a50", "value": 409600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652705286, "uuid": "1de525ce-76cf-4d4b-b2e1-f90eb189698c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705286, "uuid": "64ec1666-754f-4b59-826d-7ae05348a7df", "value": "ddd15a5efd67879ffa0555df39457557", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a56c3e95-d4d1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652675743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652675743, "uuid": "f95b40b3-9b5f-4984-8320-939b88aa7a14", "comment": "Malware payload (Mirai)", "value": "c2b5d5e6f03c94e628de152a3c2c1e58", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652675743, "uuid": "37a07c50-b603-4d47-af59-7087bcd26e58", "comment": "Malware payload (Mirai)", "value": "b22690ac12e8b4e01e57f8f850bda85ab01abe6d459787b7ede2650a0f30448c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652675743, "uuid": "faf58e52-072a-4976-bc41-f23452eda11d", "comment": "Malware payload (Mirai)", "value": "1fc2680512a8b9e325a393fc7c276581f4142128", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652675743, "uuid": "e85f84e0-046a-4e7c-8b90-66479c7437a3", "comment": "Malware payload (Mirai)", "value": "2ade85662694f6fff5fa062e935669759b80bae784948fee33646a183cf6e05db7c4827e352f42d90e6ab62ce321ebf0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652675743, "uuid": "277c0fb1-8ab4-4e39-a1cf-626b32fdcb85", "value": "T1327319827C81AA26C7D017BBFA6F108E33156BA8D1DA73438C155F5577CA80F0DA7B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652675743, "uuid": "8fa7c426-f5ad-4746-b4bb-bd979ab1f212", "value": "1536:ufzomOUDUrqVC+Oe97OBo/qMH/HMBLpJeZWaeJmM:ufzomOUUBLTwnsv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652675743, "uuid": "9afab951-89e7-4b7b-a903-2f1c992f719d", "value": 80280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652675743, "uuid": "ecc04015-c8ab-4b41-9912-58af8aa53d28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652675743, "uuid": "9f960ca4-1549-469e-b835-3e10210697f9", "value": "c2b5d5e6f03c94e628de152a3c2c1e58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c369eb-d4e6-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652684808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652684808, "uuid": "58694340-0ab4-4b59-9827-bddf2438be9a", "comment": "Malware payload (AgentTesla)", "value": "93924797af03c56bbe939046d62db30e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652684808, "uuid": "cbe1d175-80d8-4f14-ab60-ead5ad7589bc", "comment": "Malware payload (AgentTesla)", "value": "b2b92f67c669be1f57ae19e73fbf1f0b0a903b03a51597e54ef5ea19c1f7054f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652684808, "uuid": "791e7445-db82-4c47-88f9-dc3e65dc0665", "comment": "Malware payload (AgentTesla)", "value": "9634b55ddd5157c3ac0f872936304eb156b95fef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652684808, "uuid": "bc24aa5d-3a00-4011-b547-3e0a33262d02", "comment": "Malware payload (AgentTesla)", "value": "b0a40ac48a61180e5f302a71c35a1240ff685e9d2a9571cc5c51e42d48759e7e9c1769a69d84a2efba32c24640a29e2e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652684808, "uuid": "98783dad-2450-4624-ac56-d01d3ebbbc99", "value": "T15FC412033BCC6B1AC1BD27788E64606153F4E2CB15F5EBBE588262942F357C95F422A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652684808, "uuid": "276ef87b-93ea-4c6a-ac63-69caa00aa666", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652684808, "uuid": "85f862ec-63ce-4d8f-9655-20fa6f03ee58", "value": "12288:hC78LLCgzaucw9/ktiZz9gHUzE+IxeSHqP2:QQLLCgtcfFHUzE+Ixf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652684808, "uuid": "8ffbafcd-d3f1-49ce-a313-7f98a1f84154", "value": 549376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652684808, "uuid": "237681bd-7fbb-4729-b64b-e37a18026d7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652684808, "uuid": "e5a054ac-18a7-4b72-93cb-b8847bd5c8b7", "value": "GEVA_160.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebdb0c31-d501-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652696477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696477, "uuid": "8880405f-cfcb-4744-a6e0-e1b0a80228aa", "comment": "Malware payload (Heodo)", "value": "b392f6533d42ed6066903e8a3ab6eb7b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696477, "uuid": "2f674514-05d0-4c0a-8f19-c1b0edac7163", "comment": "Malware payload (Heodo)", "value": "b2bc09638e5eb26021dacae32b6edf7e7c91cb794d0f6a3423500fc84b9d0e93", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696477, "uuid": "73125c7a-3a1d-4456-a5b7-da87507fd15d", "comment": "Malware payload (Heodo)", "value": "1f2e7f1556189394eee21e38c092c6eb85fc8768", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696477, "uuid": "65a9f0c9-2fe0-4dbd-b0ae-258d107bfc27", "comment": "Malware payload (Heodo)", "value": "cbda643f8967adf8f9a6adacca58f56802eee36811faa7797c31c27985eb70b939567efc17d4cd4a5cca24c55184f484", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696477, "uuid": "9026b2f3-b8b7-4549-97d3-58ade2ecb436", "value": "T182055A35FB6C8492C6A3953D88A34B06EE6AFE840B6183CB1290733E9E777D45C35671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696477, "uuid": "ff8c33ef-9c88-4c59-8137-75311f87e49c", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696477, "uuid": "15728c40-c906-450e-9de4-97aac952ca16", "value": "12288:Q9983xboz0/7aG8GkZHFT1YicDAXmvQaZsbNg:A9UBozAWGxGx16AWvVZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652696477, "uuid": "7bbfafc0-fac6-46b5-bf3e-2d6602b91d22", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652696477, "uuid": "c7a9b5a2-34ca-499c-9e2d-443ad88d57d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696477, "uuid": "1f16e7d2-8f06-45c5-a8ce-372825df78f2", "value": "b392f6533d42ed6066903e8a3ab6eb7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ef06eab-d4f9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652692697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692697, "uuid": "21ee5038-e270-44b5-895c-cefbb75e2a75", "comment": "Malware payload (Formbook)", "value": "04d5bd4727308c2e764addfb06ccbaab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692697, "uuid": "de96f032-b50c-4785-aeee-0bda9bbfab73", "comment": "Malware payload (Formbook)", "value": "b2daaf285d233239ae7005e42adf975450289fd6c676aaa1fec8ee267cb9a8b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692697, "uuid": "8649ce7d-07e7-4346-aee9-ed2bc27fef7e", "comment": "Malware payload (Formbook)", "value": "de12f4c001e53253d7b68bf85e82ff15a5b52d47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692697, "uuid": "51bf0fcc-6817-410f-a056-236e125ae926", "comment": "Malware payload (Formbook)", "value": "b0d453c97f09ff5b56d5428556bf4f743afbaad474334598cb43e2b57b04dddd741c1699a23502bf5321b5015cbdc1da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692697, "uuid": "dba49b86-480e-4a90-a8dc-1631df4976a5", "value": "T1BB441260F6B8F4D7D8E22A379D5A8753AAEDB43110B1E7176390BE04BF26320499F147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692697, "uuid": "e6b674cd-3aaf-4ffe-bd91-a9cefb2d074a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692697, "uuid": "8898804e-cbf1-4c3e-b3d5-ef01fa91b239", "value": "6144:LOtIOmbT2eVodcUMVIaqLaAgM24NaSTvzHlCEnWC:LOLMT3AfbRaAggToEnl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652692697, "uuid": "c69bc592-9d56-46ef-a843-262bf68bf579", "value": 274263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652692697, "uuid": "a98c355c-814e-4502-b929-ac0157d7d824", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692697, "uuid": "d7ae6868-e5ac-4d86-8bd7-294e52598fdb", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b92633bf-d4d1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652675776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652675776, "uuid": "01467bdc-bb2e-48f7-b5e3-2bfe5e207d0b", "comment": "Malware payload (Mirai)", "value": "f5fb7fd1fb8464be6eb2135b403632db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652675776, "uuid": "8359ae25-cff3-4593-9cdd-f1f5ffc003ef", "comment": "Malware payload (Mirai)", "value": "b33f58675c75c29911f1bef04c950ae59e371aa29d7f657b09718274a81db34d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652675776, "uuid": "ab4da96d-7397-44c6-b2ee-9d39830ca5b2", "comment": "Malware payload (Mirai)", "value": "8e7b4a5a6d528b3bdd53010274e0a518cf4b8f42", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652675776, "uuid": "0223aee9-025d-47c4-b01e-6c367e5b8289", "comment": "Malware payload (Mirai)", "value": "79c2c3ab80cf2a15bb9f17d1a382950b433e5aa010e4138bda1ffa0e0709dc2e6320cc76b3d330fab84c5ceb5ff9c7d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652675776, "uuid": "89ba2fad-5352-4af3-a0e0-c49388821432", "value": "T1EE63ADA8D078ED9CC66586B8F54485355B23E00862633DF7DA83C3A6406BEECF5057F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652675776, "uuid": "c9f76d9b-4693-481f-97fe-9b28a7e210ac", "value": "1536:C/de+O0oGXaasT2CC1VFNO+XjsrzS02cfs3oGb2BbagqC87iZ:CleSpXsC1VfO+6zS0Rf+NChagqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652675776, "uuid": "5740f919-4ed9-426a-9e9c-afe6675ca1a8", "value": 72760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652675776, "uuid": "9012d883-bbcb-4b09-8181-72ab88c47872", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652675776, "uuid": "f44c55b0-93bc-4047-bc17-eda23fbfb93e", "value": "f5fb7fd1fb8464be6eb2135b403632db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98b157e3-d4b4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652663266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652663266, "uuid": "adf56fc6-2436-46f2-a69d-c5d1af7887ce", "comment": "Malware payload (Mirai)", "value": "ab8d7e31d1f9fa271110b9aa76829218", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652663266, "uuid": "33a03455-aa0e-4e1f-86f7-5c8174efb048", "comment": "Malware payload (Mirai)", "value": "b3c9b6afa5160881eb1d98b8d2860eacfe0c858480808153be89e544f62b2182", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652663266, "uuid": "62ee95c8-eb7e-4733-9b57-0b013b08369d", "comment": "Malware payload (Mirai)", "value": "9edc86aa2042bb65890ec4c9acd89f9de2fbc79d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652663266, "uuid": "d59d68a7-8b49-4b71-8921-5b86b054fc25", "comment": "Malware payload (Mirai)", "value": "77a8a97fc19b56d8ba44cb408f225bcc8bce6cd0446a19dcd0787945c277d00be779d33b5d41c860f1ddc3594fa0da1c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652663266, "uuid": "435eb788-e6c8-4545-8eae-c66c7afdc0b4", "value": "T1DA332ADAB402AD7CF88FEABE80660E08B631321451531727776BFDD37E32154D912E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652663266, "uuid": "31be5a70-1505-4fd7-89e7-5e26c88094e1", "value": "768:RoeXICIhoO1KG0X9rmbQB7SjgFHzqGU7cKGJMf0w9g2ICO8pkj:aCI5hokKtNvFOGUcLMf0wW2IJ8Oj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652663266, "uuid": "2bb42628-2410-4384-9751-91668c9a635c", "value": 52356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652663266, "uuid": "95852172-52c2-458a-8c0c-9c69c08b281d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652663266, "uuid": "199006aa-6830-49f4-a6ed-76feaa646b1b", "value": "ab8d7e31d1f9fa271110b9aa76829218", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb28526-d4d7-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652678464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652678464, "uuid": "a0d82c87-3a0c-4caf-90de-67c45dc47976", "comment": "Malware payload (AgentTesla)", "value": "7667b501106b79031e1354ed399eb5ed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652678464, "uuid": "cff592d9-ee75-497f-85cd-390e19e172cc", "comment": "Malware payload (AgentTesla)", "value": "b4433a617f9ddd56e06449731280b7ffb14c2ba11ad12555fd95035dc4e46f6b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652678464, "uuid": "076b768c-9b78-42aa-8760-ebfa2ba943ed", "comment": "Malware payload (AgentTesla)", "value": "f4dc360c02acb35be67f0add3018bcc000d0b358", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652678464, "uuid": "837120c2-b38b-4871-acc3-018b79e7df65", "comment": "Malware payload (AgentTesla)", "value": "b3dc0f673a2ea985c84d243b74284d0617087e0bc79a2dd42aaf1e9216d719b86ccbbcf3b128ad76b008dc3bc6ff14ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652678464, "uuid": "c64370bb-9867-42f4-ab2b-b56aca54502c", "value": "T13BC423546BEC4335E9BE21B6863E00115AF9FC0A5022E73A0DC995DAFDB2B40DFA4717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652678464, "uuid": "35318ec9-3355-445b-b991-1ff72981a7ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652678464, "uuid": "fb9af872-4f03-4b6e-8a6b-f13290913403", "value": "12288:swXW66LhbDXAWCzoGKHROeJfOheL/321LcIgR:TgLhbDXAVsGKHQkfS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652678464, "uuid": "dc7c3120-8688-4266-834e-939ca83200dc", "value": 567808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652678464, "uuid": "8dbd44a9-01b6-4baf-b39d-c1082982bdf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652678464, "uuid": "f1184ffc-6ba2-4a42-8137-9751c5296546", "value": "doc2022051601001.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "088a5a54-d4f9-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652692659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692659, "uuid": "650ef3b2-0a2d-44c6-8169-fec0dedcf25b", "comment": "Malware payload (AgentTesla)", "value": "00e39cfe5264929d543cc76ca7eee69c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692659, "uuid": "38125c59-8223-48e8-a4f4-753f74adbecb", "comment": "Malware payload (AgentTesla)", "value": "b447c6ac213dc6c0f6015a933d786e3f7c7aea09c4baf9b8ef912ffaa4e35ddd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692659, "uuid": "169d3e87-20e5-4885-8310-19aa6a7668cb", "comment": "Malware payload (AgentTesla)", "value": "ae751329b16e77ff101bb5776dc8eb54c4545e8d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692659, "uuid": "08038d95-6629-4c8b-afde-e01656721d0d", "comment": "Malware payload (AgentTesla)", "value": "9fa194795f57580f71221b8a34551a86e51b43f52fa40cfa3ba0832012118a2f9337c7106fd9ebea4b054e0b0375156e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692659, "uuid": "78d1927c-37ea-45d0-aaf0-cc1ea17c3852", "value": "T1694538987254F5DEC817D075CA685CF0A6207C6AC32B820B90173D9DB97EA83DF219B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692659, "uuid": "0c62a107-c47a-43b3-b6b5-dac2bcda041e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692659, "uuid": "7122d0ca-20c6-41b6-bb87-d91cc4dac470", "value": "12288:ZK+Hfxt7J0osjXuNFiPZHOHBAhlYTzHz6StrZlbAPtfKE49KTo0iIWxUycd4dePr:Ac2TCNFWZS8lizH+StdlI1n7o0ipRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652692659, "uuid": "36a9da24-e8fc-4b9c-a26a-c8d58c63b322", "value": 1179136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652692659, "uuid": "6ce4f657-5b63-4215-98d6-62d6df56c844", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692659, "uuid": "808f78e0-b235-4087-91f1-d9fe1c8cc6de", "value": "E-Invoice No 11073490.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26771105-d501-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1652696145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696145, "uuid": "b23a9f90-5bf8-4812-aa61-e3128be99f53", "comment": "Malware payload (Quakbot)", "value": "b6372d5a776475c6d7b4b8daafcc4561", "object_relation": "md5", "Tag": [ { "name": "green-a-thon-com", "colour": "#E9E599", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696145, "uuid": "0cfa2580-26e4-41d2-9cd1-d69f867ee9f5", "comment": "Malware payload (Quakbot)", "value": "b5d5464d4c2b231b11b594ce8500796f8946f1b3a10741593c7b872754c2b172", "object_relation": "sha256", "Tag": [ { "name": "green-a-thon-com", "colour": "#E9E599", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696145, "uuid": "c3855e2b-139e-4169-8ab2-5864d18139c2", "comment": "Malware payload (Quakbot)", "value": "9ed15333937901ed2702284dcd45bb441a0fed01", "object_relation": "sha1", "Tag": [ { "name": "green-a-thon-com", "colour": "#E9E599", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696145, "uuid": "37bbbfc2-00a6-4f4d-a344-1189ebe54f6b", "comment": "Malware payload (Quakbot)", "value": "26aa6886e14856d765978e5c5548f4f91527481704e319ac77ca8d1a3b51e0098a6d92ec40db670f41d7fbe033e97ebb", "object_relation": "sha3-384", "Tag": [ { "name": "green-a-thon-com", "colour": "#E9E599", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696145, "uuid": "baa4bf86-c304-44ef-bf06-d767f25f6ede", "value": "T10E41A90417E30718F6F65A3DA8BB23224A33BC25EE36879D128C51484BBB110E469F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696145, "uuid": "0ec37e69-8a39-4f3e-9559-7e2440822558", "value": "24:8KtVmbuNKDoKBh8W+AQkWe+/CWD25q3IUMkW81vx1ZRm:8KPVgBFQfeq4HUnR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652696145, "uuid": "3fc60f56-0121-45c4-8a7e-ef441717b87b", "value": 1987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652696145, "uuid": "693a534a-f7c6-4295-877b-fc4848b365c8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696145, "uuid": "3dee4046-5263-465d-b635-c0afebbd17d2", "value": "U621 lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a65a441-d518-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652706084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706084, "uuid": "1371f23f-37d6-4c4b-9ce6-68a9d9fffeb7", "comment": "Malware payload (Mirai)", "value": "789d637404b42d0f2508a2df92adf318", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706084, "uuid": "b032310f-1376-43bd-baa8-7146eb095af2", "comment": "Malware payload (Mirai)", "value": "b68f3c6f8f816c69a61d3b17501f9a72f9249096f543834ef2b5c79eb37b20b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706084, "uuid": "d67d1bf7-83c6-4e32-a394-23adba98b0ac", "comment": "Malware payload (Mirai)", "value": "69097e3e87f164449f2bc0e495e24f1d909f2d9e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706084, "uuid": "ef6aea4f-a08f-4e0e-84d5-0492d6c49fb7", "comment": "Malware payload (Mirai)", "value": "977e69ab17924deb4c8792299536fbf6e73dada4cf568a86b9114a33d79d3db3ea55afbba3a3ab5385cbfa23ea975f56", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706084, "uuid": "d9fb0453-d427-4b8e-8614-18e5ac2a5ea7", "value": "T1F193414D3E214F7DFBAC82398BB75B209209339626E1C584C1ACFE021D7479A745F7A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706084, "uuid": "0458dcbe-545d-4703-b3dc-60c1fa5130ba", "value": "1536:OFn0E/2tT9hXlvGTGJE2wYkKqTssVEQyHEIu43fEhl1yz:+nX/2tTntGTGE0ITJEQyHEIu43fEz1yz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652706084, "uuid": "5b654ae9-6385-41e4-af86-653f5ae113dc", "value": 97348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652706084, "uuid": "be483898-76fa-42bc-baec-22f3952fb758", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706084, "uuid": "3d98fdec-faff-4a80-9ce2-5ddabe146b96", "value": "789d637404b42d0f2508a2df92adf318", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7177bce0-d50b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652700566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700566, "uuid": "26d4b61b-6ca2-4835-a8cd-905fceb85f15", "comment": "Malware payload (SnakeKeylogger)", "value": "4aac110001d96c180cc2f8c3bd5e91a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700566, "uuid": "0d4cff03-96a1-4e01-adf7-95d6f8fac727", "comment": "Malware payload (SnakeKeylogger)", "value": "b69413577229cc48eaebb2dd3b44be3e707a6b11d68ce690eb97547f499f1910", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700566, "uuid": "6f21c01f-c0fd-43cd-b231-0cea221afc72", "comment": "Malware payload (SnakeKeylogger)", "value": "20b43979a21c04943c3bca4c659d158c7463da3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700566, "uuid": "d09d3141-3a61-4c04-8b48-257e7966ff92", "comment": "Malware payload (SnakeKeylogger)", "value": "dea19563c80703a444b6211408a68ea9cad8a5ab05a6712a18efed73d486f53c2cda18b94e80208c8d33659c463c0d75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700566, "uuid": "2f0598a1-33d9-4d15-a40e-0a17577f0da3", "value": "T107059F21A2C4E65DDE2B73F2EE5D8C722297BCD9404186AAD1BA37664572317CC13B0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700566, "uuid": "090c82b1-5579-43f5-b0af-624b6f644b0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700566, "uuid": "e5cbc6bf-621d-46ad-8733-ac407010d800", "value": "24576:7LKAC+6OKpLeoP0MAfkxsBwoyGKnzRLslKAC+6OKpLeoP0MAfkxsBwoyGKnzRLsI:7LKAC+6OKpLeoP0MAfkxsBwoyGKnzRLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652700566, "uuid": "a9ad8546-dd32-4915-9415-c51ccf4666d0", "value": 843264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652700566, "uuid": "1d705d8a-909f-42cf-96d7-4c74084ef598", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700566, "uuid": "bbd66734-9a47-40a1-9dfa-f06ab54f1deb", "value": "E-Invoice No. 0000001905.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16a5be49-d4f9-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652692683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692683, "uuid": "185e0ca1-7940-433b-827c-27886123bcc1", "comment": "Malware payload (AgentTesla)", "value": "836575586158d09fbefbb519e203a7cc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692683, "uuid": "f9202de5-4751-46de-81dd-d197814ba436", "comment": "Malware payload (AgentTesla)", "value": "b6e6efd2dec125c94e8e33c25ae53f4c4ccd8a329c0d50668047cee6301f5644", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692683, "uuid": "aabd104b-05ab-4578-9dd3-29f44c2113d8", "comment": "Malware payload (AgentTesla)", "value": "5fedadac51d6b0e1a915ab5053a427f234bda642", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692683, "uuid": "ba4fecf4-cbe3-4a33-990c-58e5fd27b0ed", "comment": "Malware payload (AgentTesla)", "value": "85de7d7a1f3a77292e7ed04d77ecc442fc134da669fe8a73d88b0df8650c94d5c479cc85f7b1a18bbb9f686c0aed7ace", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692683, "uuid": "1f27b6ee-b581-41eb-9f9e-5baf5e4d2383", "value": "T1C11523413F192D68CE286739F0BB8E212BB1ED454807FBCA77D4E14638CBE415D2B969", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692683, "uuid": "9209cdd8-b437-43b1-af9f-0ef485f94feb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692683, "uuid": "bafadbe3-bbaa-4e52-a9ce-4a2310f30e4c", "value": "12288:XdJyy/zyvtssBrChAnywAhuUlkNI4LabyGdTYSgAr0W4gafrftf2/zjxg0reF4Ke:XdRAhChKyjltmSIrtfaO0s4XzqnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652692683, "uuid": "a494522a-58a9-4dcd-8a16-2bf9916971e1", "value": 956416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652692683, "uuid": "fef6f56c-648f-4401-af31-f100d69d2a0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692683, "uuid": "d3f73c90-377a-43a9-acf4-defccf4439c7", "value": "RFP 117 Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fa31b39-d54f-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652729823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652729823, "uuid": "d04b8ea9-5850-4ac6-8e83-d7619b162c66", "comment": "Malware payload (SnakeKeylogger)", "value": "0ec157f80202de4fa1f922d8c2088d61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652729823, "uuid": "201d725f-685a-4a94-afc5-09e4b207b404", "comment": "Malware payload (SnakeKeylogger)", "value": "b71b391e6bb4ca3d099405b7513c89c0761b3cff717dcea4e18ec2b89b21b477", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652729823, "uuid": "1cac220b-e578-4a85-a5bd-6ff6fef3093c", "comment": "Malware payload (SnakeKeylogger)", "value": "dd88530836f4c2688053394a5ea6f9d18ef9e1ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652729823, "uuid": "d87d9cab-e2a3-4b6f-92b3-a949de78edf4", "comment": "Malware payload (SnakeKeylogger)", "value": "8e18fe5618d15fe1691c5706b6689273ce8fb2baf78341e16a92373736bb808e9b8096747d84eb7d202387b733aeddd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652729823, "uuid": "7a8db8a8-ee1b-4e71-96be-186823d5c4f0", "value": "T1FA541314C7D0C293CBD1AA725A2DBB3B86FA8C3414B142075310365F7EA66D27B6F9D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652729823, "uuid": "ed57cbe2-190d-4d3d-b6c9-ea4b89af7976", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652729823, "uuid": "2db64629-ec41-4401-97ac-241c46227460", "value": "6144:LOtIORSyJXCQs7LX1MzrIl3C2DG3eVGLT6DPcn2+iALC5:LOLRfEp7LmzuxaePQ2+vU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652729823, "uuid": "97e3e953-87ba-4ed8-be95-aea1dd5c585b", "value": 280118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652729823, "uuid": "afefc0ca-872b-4777-be85-732beea5a892", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652729823, "uuid": "6f303ea4-d984-4b58-86bf-6f86b0403716", "value": "kings.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e2f38ae-d4d1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652675730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652675730, "uuid": "391b36bb-da8a-47d9-adbe-5a89d26a3570", "comment": "Malware payload (Mirai)", "value": "4ebc1ead763a817849754dff086f99db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652675730, "uuid": "61a8e51f-aba2-4bcf-a564-7ad4aeb449af", "comment": "Malware payload (Mirai)", "value": "b770a5c5080ca751693dbbb7887c7ee075178466671b783db4f2fae8f5e6f91e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652675730, "uuid": "922ff374-9b6e-4ac8-b67d-982674efaf78", "comment": "Malware payload (Mirai)", "value": "348d0897571f4209f84512911560f05bfa3772e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652675730, "uuid": "4aa68550-1247-451b-862f-dc66a29a3ad5", "comment": "Malware payload (Mirai)", "value": "eccb0c14ff78dc35b6587e6d026948f252cfa4a02e3f33e1354950cbda893d317d915c76ba2b2c425b4270ac25a6c541", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652675730, "uuid": "af4c37b6-07b9-449f-8bae-ae7873cd8134", "value": "T198A3840E2E619F7DFFAC823887B79B219249339A36E1C585D15CEA011E7034E741FB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652675730, "uuid": "b06ea9aa-7aac-4df3-b8ef-ac44da7c4444", "value": "3072:XDIkiGgcsQoeJP0r01ed6WP0qNuCd4a7P9:iU2Rd6WP0qNuCuOP9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652675730, "uuid": "9ab78bd4-e2fa-4b9a-8408-291e94ef46b4", "value": 100332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652675730, "uuid": "00cec0d7-6d15-49e7-93f7-ca07a3d0406f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652675730, "uuid": "d9ef4663-a2bd-4035-8bb3-81cbd340c744", "value": "4ebc1ead763a817849754dff086f99db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b850e459-d505-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652698108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698108, "uuid": "24f4b9c1-9185-4a83-92c0-ba56f5e13d63", "comment": "Malware payload", "value": "86212de909c5057ff80d28c6bcda1b97", "object_relation": "md5", "Tag": [ { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698108, "uuid": "a1873906-97b1-4c2a-a0eb-e9e95a10975b", "comment": "Malware payload", "value": "b796ffd015039600d93f191b42361b22a940f84baada5e4e7a9bd62829458bd0", "object_relation": "sha256", "Tag": [ { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698108, "uuid": "80d7f7ed-646b-44de-8ba8-3eccfbc8d166", "comment": "Malware payload", "value": "7b4846994d2a926d32ae44464802c8862d0d89ad", "object_relation": "sha1", "Tag": [ { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698108, "uuid": "cbbe92bf-12fc-44da-93f3-1fd0bdc898e0", "comment": "Malware payload", "value": "3844fdc14168b5e848346d9eb00af78edf08ca4ed0ab9428593f5ed8c4e82655358468fce3221e3492b3c7cae87fa0cb", "object_relation": "sha3-384", "Tag": [ { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698108, "uuid": "f76c0d40-99ea-4193-a29b-18e51db5747e", "value": "T18B72D19FA7B1A197301B4EAC29322478DF7453B42F2491A8823BE49C41FF81A9593DC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698108, "uuid": "698c8f10-8364-424e-b496-3da5b7ad8347", "value": "384:rGO9ao+FvCVT/82OoZJh+5thcR6zPOkCpVP9o+axwZFl+v:6Olyc8cNpVlKoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652698108, "uuid": "c4f48f79-cceb-4ec2-b51b-d187dc6e7b93", "value": 16424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652698108, "uuid": "8dc21b30-672f-4288-a1a1-39ee547d7a3c", "value": "image/png", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698108, "uuid": "05ff8b37-a7be-479c-a19e-282cd54c6eec", "value": "image1.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21416b57-d4b2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652662206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662206, "uuid": "9c508a27-2d43-4ab4-b8f5-53bae0819d93", "comment": "Malware payload (Mirai)", "value": "5b799679e6fdc0c34416fbca9a6648ca", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662206, "uuid": "5d741022-2c14-47a3-bdae-cee9c3fe328d", "comment": "Malware payload (Mirai)", "value": "b861689e046c235698e5c4f1fe713ce8d7bdeaa80f7a98d85516059cf5abdb17", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662206, "uuid": "86928286-3080-43eb-8f6f-5bfb9ef7c3e9", "comment": "Malware payload (Mirai)", "value": "50bb52dd195687b8dcf8bf865ba011c67547fe1c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662206, "uuid": "b3ce6200-2c5c-4f57-a1ab-cd99bc64a27e", "comment": "Malware payload (Mirai)", "value": "0cfdf84038106ef72ea232824d42cc5db23d61654bb19a2a963eaca75b3e9324d0f154ea822d833d0e8504fb4e53a299", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652662206, "uuid": "b1d787c2-eeaf-45c8-8520-cbad644b327e", "value": "T1AB23F8C27892AA39C3D0577BEEAF418D331497D8D1DB3357C8281B947A8A90F0D67B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652662206, "uuid": "785ed58e-066b-4306-a845-a33a3b5742ca", "value": "768:HR7nhgvz7/a6M1yyj69CFLUEZmY89ntf2OfFGv3kNMekTtk7wCVy/rCxHghW1/K7:VhgHLM1oBY89zGv3kNMekpfhWE5kS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652662206, "uuid": "9987a3a8-1fd9-4561-9b33-e29c0875b487", "value": 48792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652662206, "uuid": "3a2a82bf-92e7-45bc-970a-ac0b568c04cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652662206, "uuid": "7246a6a8-f675-4ff1-9743-8a7058cc64ef", "value": "TSL33T.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9947af7-d4fa-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652693413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693413, "uuid": "ca95029a-c33a-4e17-a654-30c3884f1f36", "comment": "Malware payload (Heodo)", "value": "27eb659427721933a07a9d5248c327fc", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693413, "uuid": "5b3ec8df-49ce-4339-a588-740df8fe3c6c", "comment": "Malware payload (Heodo)", "value": "b8eedf13812bc2a7aba3a3b60fbafa97ff635ef6ec5a4c9f2f7ecc7db464bc4f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693413, "uuid": "ff7dfdd3-1c97-438c-b844-b2f1f1ff7d8e", "comment": "Malware payload (Heodo)", "value": "ef7cc02870a15c0cc57080a69df31f5b13e024bc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693413, "uuid": "b63b7bf7-10a5-40cd-a044-fc0297d23cd4", "comment": "Malware payload (Heodo)", "value": "7c5caa553fa19a88d3a7d7d9be55d20909e6f474a65b38647bbe9219847f1c0bf57b55c2db27c3a3c4d1e4509f9292aa", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693413, "uuid": "4655b649-9c66-4786-b9ee-66a1145c9932", "value": "T14C055A35FB6C8492C6A3953D88A34B06EE6AFE840B6183CB1290733E9E777D45C35671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693413, "uuid": "a5403f84-59a6-41b3-8737-cbcc6d6b4fb4", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693413, "uuid": "069901d8-1a07-44c9-83c9-e44c43172361", "value": "12288:Q9983xuoz0/7aG8GkZHFT1YicDAXmvQaZsbNg:A9UUozAWGxGx16AWvVZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652693413, "uuid": "536fab8b-0c47-41b5-ba2e-30926befe754", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652693413, "uuid": "8371295b-c4ae-4396-9196-5e6933037671", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693413, "uuid": "75a616a7-e926-477b-a280-d9b4283ec134", "value": "27eb659427721933a07a9d5248c327fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d255c80c-d525-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652711896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652711896, "uuid": "c3df2099-4ab4-42bb-8dae-16966db5a16b", "comment": "Malware payload (Formbook)", "value": "783a695a79ba31ccfd32df82b966f6aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652711896, "uuid": "f93486e7-ac48-4e8c-81d2-97b0e49bee16", "comment": "Malware payload (Formbook)", "value": "b91042bec3c2d82285a002269220236418c9382996fd85c434fcf0f7e33493d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652711896, "uuid": "76450629-26fc-4ef6-828e-b9c8d47b7854", "comment": "Malware payload (Formbook)", "value": "20ed4375db6761b06122946319d97f33d2bd2d9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652711896, "uuid": "7b897f2c-1815-4112-8ade-f82dec82ca37", "comment": "Malware payload (Formbook)", "value": "15d96948ac3bdd828cedc28ab7b4eb4e99869e649f2efc304a5d3fc7c86b67055ed4885c44a77b327b3576f52fab369a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652711896, "uuid": "28805c28-ff26-49ec-b00f-9d4bbc192b72", "value": "T142C4026D3690CF41D4D54439C1E799340BB2EAC7B236F3827EC966D50E12B658ECBB88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652711896, "uuid": "408e53dd-181a-4051-b729-b1e65ce2b7d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652711896, "uuid": "2f798c55-7feb-4db4-970b-e5039c51d8db", "value": "12288:twD2g2nGgDfcriV+wwv5VnaEVoKtGLyNGlmXlCWWRvQUJiupUqPF:twDH2ZTDxCXnaEtSysl6dgvQqpUKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652711896, "uuid": "41a430a1-03ce-4aab-ac5e-93a13be90ef0", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652711896, "uuid": "ec504704-6689-44d8-a2b2-b4f2dcf55610", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652711896, "uuid": "83999f23-1795-48c0-b856-6cc3e631fccc", "value": "TT copy April Settlement 2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e752fb19-d512-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652703770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703770, "uuid": "a112766b-b979-4141-b522-97fff30e52b5", "comment": "Malware payload (AgentTesla)", "value": "abe6e14e1bfdbf1e0f3fb673e59d3fa4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703770, "uuid": "cbe40922-6cf0-4e13-8e6c-96d12cdb72f7", "comment": "Malware payload (AgentTesla)", "value": "b91c4efdbfda302b6d81b5c04da925f7ad77337772235330d180786a2cc7dfbe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703770, "uuid": "6a489d56-1463-4e0b-afab-e8f94f4dd421", "comment": "Malware payload (AgentTesla)", "value": "74bbeb609852aa628c755f8ab54ed0c714d5a53d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703770, "uuid": "64acb992-69fa-4abe-bdd2-c4484da67e1f", "comment": "Malware payload (AgentTesla)", "value": "e87005c31206e0e3a4ecff5e055072d94fc4ff0996e6a17c15bb9047e37852929c1d966d44f7b0a3792453618117b81f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703770, "uuid": "f7a11aae-e6bc-46e2-baa3-97500889ef1f", "value": "T17DD4F0AC322432EFC847C576DEA92C64AA60753B930B9203991755EEDE0DA97CF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703770, "uuid": "e69cfd5a-5f6e-490f-94af-d34b4636e1ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703770, "uuid": "91760ee1-5eb7-4d63-aa84-11212600a1dc", "value": "12288:kyfFp3uL17MZnYJQXkGirTVshIqHm7oJ/B4c0bzDzVQtBpK3TF6Y6Q:ZnW76YJQXxirZshIqHw2mc0bz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703770, "uuid": "69f6cfdf-acce-48ba-aa4f-48cc0a0f0945", "value": 620544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703770, "uuid": "826003c7-808c-441c-b5ba-a9f1fc2fee34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703770, "uuid": "a8630e12-678d-447a-9520-c9a4e2cd7ca0", "value": "DHL G\u00d6NDER\u0130 B\u0130LD\u0130R\u0130M\u0130_xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d441517b-d50b-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652700732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700732, "uuid": "0d0564d2-661a-46d2-83aa-60814c81167f", "comment": "Malware payload (RedLineStealer)", "value": "7ac72b34135c477ed3a76b034ca8c88e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700732, "uuid": "f0de9b7a-8462-468d-ac3a-e06a9a27dd55", "comment": "Malware payload (RedLineStealer)", "value": "b97ec7e0e3cb3922938a3ca6b41aa925f2347d4fe5fa16a09d00de770202b058", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700732, "uuid": "2cc972df-a80c-4e9f-8de6-5dc9fb5f0502", "comment": "Malware payload (RedLineStealer)", "value": "55d8f7350b4227c48b9693b0c96ea2db71ec2c66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700732, "uuid": "6087d63d-2cdd-43ba-9cee-07209aa0548b", "comment": "Malware payload (RedLineStealer)", "value": "2e39302ed3577636c7e6800bdb67b930765c7efdc5ed8f72440e9e625148ca2d9b7767fdd162e0cbf8239f6e1321d79d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700732, "uuid": "6d847528-239b-4116-acb6-296854503353", "value": "T16A85DF167E68D861C8A354B54666EDD229B5B9B24F0FB4B76F9635CB01330E0FF22903", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700732, "uuid": "07073def-43ac-43e5-828b-434ef38d719f", "value": "37a87ba4c777dcd1db50684f6b029f1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700732, "uuid": "31dca2a1-2d3b-415e-a17c-9b449699047b", "value": "49152:BuCO8WzCwTh4IRCrrW7tw8vWLbc+wUUAP+Y9:BuCO8WzrTh4IRaIK8vWLbUUio", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652700732, "uuid": "c0472197-f03e-4aeb-96c4-8addb938a78c", "value": 1758648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652700732, "uuid": "d96a972f-6d1d-430f-a43c-8e8d353de1c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700732, "uuid": "83992288-005a-4dc6-ae74-f4040b2cebcf", "value": "7ac72b34135c477ed3a76b034ca8c88e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e25b9b2-d4f3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652690306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690306, "uuid": "55d370bd-ec42-4a45-ae06-52a7626e7157", "comment": "Malware payload (Heodo)", "value": "4dd7fe69c642ee88b0752c4308c9bc29", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690306, "uuid": "fe5aff5e-cc84-46b5-8861-d8761e5ce018", "comment": "Malware payload (Heodo)", "value": "b9ad9dd00a46e23564ae4c357724a3af0b7684880828b8c9013b808f651099ba", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690306, "uuid": "ecdc1e8e-a7bb-4887-8fbc-a7df90da385f", "comment": "Malware payload (Heodo)", "value": "344655d173426866c86a32662512774df6702478", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690306, "uuid": "762ec0ea-ec9c-4ea8-aac4-3c9250ae0d07", "comment": "Malware payload (Heodo)", "value": "6ba5c435b27081a1151dbf4a697a35c680292d3e5994e0c1bee0c4226a8623f4df5fd14d6c7609fbdffd23d3afe9aeed", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690306, "uuid": "cd351d95-1a9f-487a-bad8-2cd11c7b01bd", "value": "T16F055A35FB6C8492C6A3953D88A34B06EE6AFE840B6183CB1290733E9E777D45C35671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690306, "uuid": "147a89e9-8eb8-40cd-917e-8a6f3fa0980f", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690306, "uuid": "7d70a925-0c92-4177-8ac0-b004c99a5223", "value": "12288:Q9983x0oz0/7aG8GkZHFT1YicDAXmvQaZsbNg:A9UOozAWGxGx16AWvVZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652690306, "uuid": "6971e398-d661-487c-99b3-bf2af141774f", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652690306, "uuid": "92abe5b9-3c86-463c-ba94-f5b2e153f2b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690306, "uuid": "a4ce2694-abcd-44e3-9177-a1c77f011348", "value": "4dd7fe69c642ee88b0752c4308c9bc29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c8a168-d53f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652722833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722833, "uuid": "d837feaa-8e55-42fd-8418-01beca6b4895", "comment": "Malware payload (Heodo)", "value": "50bbeae0fe4d5fd20570d7c5ace3ecd0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722833, "uuid": "0a9cda84-7661-42cc-a5cc-8bbea5bb2fa2", "comment": "Malware payload (Heodo)", "value": "b9b691f998941071b08f02fecd705e9d59f5878b7e09f958ad1679a223b049ae", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722833, "uuid": "f191af2d-629e-42db-a494-9e04888b80e3", "comment": "Malware payload (Heodo)", "value": "69a787526d551fdbb6fab2d55cf710a0099536be", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722833, "uuid": "a53b3757-6b82-4850-a84a-e6db7cf03938", "comment": "Malware payload (Heodo)", "value": "6b3fcfa983fef00055a8cf107f2b9c2d82a62c17639612503f42d153bcca4fd290dc7a1ab53ae74d1c4195640c89cd95", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722833, "uuid": "91375bcf-3af3-4ae5-a717-9fa64942ccac", "value": "T19B74C046B3A840BAED678338CC535647E772B45A4B70A78F13244379EF2F3915A3A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722833, "uuid": "24524b0f-0d61-4484-8b4c-12aa190d603c", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722833, "uuid": "c03eac55-87ff-4ff7-a01e-397d65bc806c", "value": "6144:Es/2WX22TR72tKbxGeKkr2rlsy+vbEFXYvlx6xJkUjnKd:Es//Gi7/KgDvQFXTH9Kd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652722833, "uuid": "c750d659-9e15-4736-abba-82223161fea2", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652722833, "uuid": "536d4330-402e-4428-88d7-a0fbc0e41f43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722833, "uuid": "c9453641-83a4-49b3-8448-6182cf8aa4b6", "value": "50bbeae0fe4d5fd20570d7c5ace3ecd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31a00ec8-d550-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652730094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652730094, "uuid": "21884cbe-dac2-4a02-b01f-8989e30f2896", "comment": "Malware payload (Formbook)", "value": "32dff77da321050d0f744fabe0c0941c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652730094, "uuid": "b4ad46f3-2159-4ca6-b278-50951cd51678", "comment": "Malware payload (Formbook)", "value": "ba04df350fd5415ca46d234d20cd02273e32484de22cacc224c710477402ab9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652730094, "uuid": "e87df7f5-ffb0-4e8f-9818-3ae0c2028fcd", "comment": "Malware payload (Formbook)", "value": "5b04ea8d3ff48ce400c554667ca390359dcdbad4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652730094, "uuid": "951e059f-6ce5-4e29-a8b6-fb56403ff604", "comment": "Malware payload (Formbook)", "value": "05718034386c8cfd9e59f92386d1ff00e2e9a0a7a492b7c975dc44da7425db6695cbaab1762522bb4eea43271abf04a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652730094, "uuid": "b90622d6-1fdb-446e-8bfa-6ff5e0f4c88a", "value": "T1E4341210A680DD67EAE34B313F7D22C64FFE95130666161B0B426F2BBA73242C65E771", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652730094, "uuid": "028deb81-9e47-4b8e-bb66-f5065e83b034", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652730094, "uuid": "037b2820-d773-4f48-9850-aefe39b3fc02", "value": "6144:ZYa6VwOX7+d5whJ3dmhfmjdn8qo4IVu+6nbi83UvNuDR/y8fQ:ZYDwg0WdmwdTXIqmADR/jQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652730094, "uuid": "2f9c5abb-7d32-49cb-8cb8-08ed6d62f30c", "value": 251919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652730094, "uuid": "ea3f2fed-7784-458c-aaed-979d44a6bfe4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652730094, "uuid": "61aea2e3-95c4-4396-accb-a734bd43084a", "value": "tommanu6654331.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca62a35e-d511-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652703292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703292, "uuid": "dbacde13-1014-43ec-b2e2-f90b34c6c328", "comment": "Malware payload", "value": "15e99653a54f2415e5b51cabbd0365b3", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703292, "uuid": "b4d00da7-2912-410a-9167-9c1ed2024fea", "comment": "Malware payload", "value": "ba707e10775ee3e58327ab1a27b2e7f05506a020e98b317beee8c56a8588c85f", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703292, "uuid": "2c604826-4a56-4c5b-94a0-be3a4a9e792a", "comment": "Malware payload", "value": "48190cb410790d9dfb8af7d12b083e14dff82f9d", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703292, "uuid": "77cbaed4-e4cf-4053-937d-4f780435f613", "comment": "Malware payload", "value": "f540dec0d7cd48fb7d063ed81fe56aa88786a395e26bd11f70c2e148d137729744c58eedcb86c0ebd65c1ddc249ed02d", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703292, "uuid": "abff9665-42c2-421f-865a-58fbf56df762", "value": "T1EC24122E324A24F8E42A4FBBE0DD5252C2176E29381E5136384A7E4F9F77DE24051E7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703292, "uuid": "01ddf5db-c950-401e-8677-64be035f4777", "value": "6144:c8kr0dtqg/D7JZZg9WqtHYq6NFxtvpXoK:c8kgdtqUdZZyWiH8FP5oK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703292, "uuid": "b82dcb52-44bb-40c4-ade9-af8838480ce9", "value": 211784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703292, "uuid": "34d353ce-a8b9-4f56-8e8a-86f05ba4c2a8", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703292, "uuid": "c7769a6c-1cd4-4ea3-8319-020e44da7c87", "value": "Booking Confirmation(1).xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c220bf1-d518-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652706033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706033, "uuid": "fbb270bd-532b-4e66-92bc-d823c861fa2e", "comment": "Malware payload", "value": "24e87ce8ffa2571bddfd694b81abe751", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706033, "uuid": "9ceb6d32-e78e-45de-8e73-a2dd753ebce5", "comment": "Malware payload", "value": "ba907eafc3072d3a133d338e39e44720ad317e01dd19bd15847ddf75d089884c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706033, "uuid": "57d18181-3b80-4a6d-8288-82864dc2b710", "comment": "Malware payload", "value": "03ead28d97e7ea384631977948a3547eabb18a5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706033, "uuid": "9b8294d0-6351-41f5-8e1c-062b4fef8544", "comment": "Malware payload", "value": "29999cf3c9f81f2bef803f4398056bd1e6f9db00e564d41007760134da5fbf65cf932c24d47da697a1b43caf635e1cea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706033, "uuid": "329e0515-6219-4bab-a533-7988582a49c6", "value": "T1BCE58D86A6ED40E4D5A6D038C907890BD7F2B825033187DF05648F6B9F376A25E3F366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706033, "uuid": "b9db8c68-009c-4b67-8eff-40e8cbd5a331", "value": "5447e34c9a32326ead127494dd7c9989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706033, "uuid": "a57727b0-afa9-4e25-8318-1e8018d0035f", "value": "49152:0N7UYxlqpMdTWjukgj/sArVJ2EpXJ06t2RWsYKHNI/JkhifCS17ygbxGAX:DOJxt2xtI/Rtbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652706033, "uuid": "c06d36a0-8b2b-4ffe-bcba-40acb0ee2e09", "value": 3181568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652706033, "uuid": "e6f10332-d46d-47c3-9315-a66095a00708", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706033, "uuid": "047e0000-b048-4b8f-b212-9c3283906c41", "value": "\u70b9\u51fb\u6b64\u5904\u5b89\u88c5Telegram-zh_CN\u8bed\u8a00\u5305!MTQ=.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56fb9565-d52d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652715125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652715125, "uuid": "b7ab2773-4473-411d-b317-f0be83b7db04", "comment": "Malware payload (AgentTesla)", "value": "92e11f16d4bd9fbd3b202a4362e3caff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652715125, "uuid": "7184ab1d-2517-4a33-89e9-74a9fbb8c071", "comment": "Malware payload (AgentTesla)", "value": "baa54d1262f995191c7f0eed74e96d19a9fe8b9f55d8a154ba4ee7b331fc4fd9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652715125, "uuid": "3fbe871f-92e0-4b39-bbab-81e602797ba0", "comment": "Malware payload (AgentTesla)", "value": "43bd9decf4c8411253fb5cd66f2721444904e061", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652715125, "uuid": "af7beb90-5c75-446b-9415-bd5390777a75", "comment": "Malware payload (AgentTesla)", "value": "d366f6ef3d197caeca6e9b21ec217a9a2940d1a2a82958c74f2db24c5f6bad95925800053f04987e85bbdd2db43bd6ff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652715125, "uuid": "51d8b324-e08e-4c71-8af3-4f61d3b71804", "value": "T1F7C4235EF4B3D6E0A8399A69378746717CD0F469902DF2247B2AD6C2EF412E2B078C54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652715125, "uuid": "c4b53419-1bd4-493f-aa6c-b9e41b934b64", "value": "12288:JTabyOie1lUlFwS/cQsPr7ZxuU3BeOua1E+f7wyONJZaOXmfT:JTab7ie1lUln/cxHvG1+fz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652715125, "uuid": "4573d670-4e0e-4403-af52-b5878acba8db", "value": 570627, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652715125, "uuid": "33fb1fe1-0499-4fe6-b3bf-7ba1fe589cce", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652715125, "uuid": "72306231-d736-4eb9-b53a-28a30d825a27", "value": "shipment details - 21.6 MT COUVA 760P \ufffd SO 10169195.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d8bab8b-d50b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652700506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700506, "uuid": "18a08a35-3a1d-429b-8b57-6ebb1f6baaf7", "comment": "Malware payload (SnakeKeylogger)", "value": "988a9cd7afce4100a13e58adba4ce60f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700506, "uuid": "f2b2dad3-5487-4b31-981e-c1cea0a5f638", "comment": "Malware payload (SnakeKeylogger)", "value": "babc5c2a2b1d98e846d2028033157f23b6c5c2e5421824205450843177773ccd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700506, "uuid": "d1d01838-9fca-4181-a12b-b242bfb1153d", "comment": "Malware payload (SnakeKeylogger)", "value": "f2409049f9a306a851f2f38f3424d0d1db47480b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700506, "uuid": "2fc2c6a0-d6dd-4a49-ac3d-eebea457ddcb", "comment": "Malware payload (SnakeKeylogger)", "value": "5f2ab974a3e91e4f419dd6c9f5b7df82837c670a9751824dfa8738a3fa4bc0221af07326f0b96d9df03d46c47eccaaa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700506, "uuid": "0bc61a6b-c906-4245-a52d-1eeaafe394a5", "value": "T121F4E000BADC74D0C85AD7744C62F5A406B56C5F7E63ED1A2EAB398E6D35B002271B3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700506, "uuid": "d5154291-3257-495a-8b19-01ea9f5805c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700506, "uuid": "147084ed-2626-4b2c-b8c5-742246269b2f", "value": "12288:Asu9q3/lwTtLczZsqVz8qLp/SpEzhi3RYDSdm0AiwKjGQVNyXfAUtJ:xu9+/6BL6ZsqVznhZzhYuSdm0pwBccPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652700506, "uuid": "ffa9df50-1e6d-431a-aa3b-086e0785149a", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652700506, "uuid": "e244a0bb-d520-4012-b5ff-b71bb384642d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700506, "uuid": "86ca0965-9c7b-4443-83f2-262c731bd152", "value": "requirements.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "813e3c35-d4e0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652682124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682124, "uuid": "8dab6089-a7b9-49af-88b7-d66fcd4d13a1", "comment": "Malware payload (Mirai)", "value": "794397e17a5c95ee28b7b4d06ec040fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682124, "uuid": "81c91c89-73d7-45c5-93c9-301af37e012e", "comment": "Malware payload (Mirai)", "value": "bacba91af6dc241c409f14b30331ed104f125cbe92087b065cb021385d7026c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682124, "uuid": "52d52a9d-5274-47f5-823a-668e4425909f", "comment": "Malware payload (Mirai)", "value": "fcb74c2dcae263875837b1b1ad63ee84b56d28f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682124, "uuid": "7f34198d-6dda-40c6-ac7c-dd3def2f0637", "comment": "Malware payload (Mirai)", "value": "65984e782ccd77079fef32fa291c19640716209b5bf11a239bfe3e5cb85a00a8f0afa194c0e299037e5109242fee172a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682124, "uuid": "9ff9e4a1-d4b2-417e-b081-45774b27e361", "value": "T1C683AE74E168ADB4C0010A34B5E9DD3D5F22B58457933DF7E98182A9B4478F8B80AFF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682124, "uuid": "f1ee9f8c-08d4-4760-8f03-edb95f305e4e", "value": "1536:6axGahRYHocA8YXKPZ+4n5wPs3ZHksy16CCTjSs:6zahRYOXsAs2P+Jksy16Ci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652682124, "uuid": "9c4e66d8-93ed-471b-85d3-c509bae75744", "value": 83076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652682124, "uuid": "28bc8117-5752-416f-bdaa-ec324cf241f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682124, "uuid": "b6371e52-12ed-428b-bc2b-19c0f3187297", "value": "794397e17a5c95ee28b7b4d06ec040fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce591337-d52f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652716184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716184, "uuid": "987376c4-2324-4ff2-b44d-575e969f0d51", "comment": "Malware payload", "value": "39281123ff4c07bad6243a7c8efeb14d", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716184, "uuid": "41dfa601-809e-4000-85fb-d77f16e57b1f", "comment": "Malware payload", "value": "bb09b387015633bf28691c6ebdd8f6c4f3abbbeb3dc667ca6539ab45396f77ff", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716184, "uuid": "6208110d-0094-4387-9f79-d74b0d95b497", "comment": "Malware payload", "value": "fd0ced83436fa17f86f24e3ba27ab530c5e902e3", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716184, "uuid": "061dbc55-cb2e-4395-b5c4-fd1bd1204d30", "comment": "Malware payload", "value": "0f24b8a243d6b5b5c21bf2802893264b1d1add37a7b4686e583a565e2c0f1521dcca6f936e78c424948c11590149d94c", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716184, "uuid": "a9c11c6b-770d-4b1f-b92d-f21763dcf986", "value": "T1C4517C283EDA1129F6F3EFB17DD869D5DEAAB6B779014D5E0081034A0A11A40ED92D3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716184, "uuid": "c654c25b-f928-4e47-adb6-e7fd13e5ac94", "value": "48:8mYcqso9m7XLXjYgzUmdNA3O4b2dt6BKRv4eq4ab:8mYJ9UZ1NoO4b2HyKRgT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652716184, "uuid": "a60d98cb-eae0-482a-95bb-1979ff5b6834", "value": 2672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652716184, "uuid": "fc8f4c5b-a796-4603-8dc4-6843d84b293d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716184, "uuid": "5795e933-7043-4f7b-93e4-cc5897f6156c", "value": "Rechnungskorrektur.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b90e9de-d4ba-11ec-8e58-42010a9c0032", "comment": "Malware payload (TVRat)", "timestamp": 1652665848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652665848, "uuid": "382351be-8865-4761-a345-df64209975a2", "comment": "Malware payload (TVRat)", "value": "0ccbb13fd1e433e565c6090a0ae0ea54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TVRat", "colour": "#739DE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652665848, "uuid": "386af68d-3002-408d-923f-c7fe1f2b4fa9", "comment": "Malware payload (TVRat)", "value": "bbb1db25b2b54928d97b0a0caf8726e5d62501ab6cdcf9b4aa2e192f59958aa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TVRat", "colour": "#739DE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652665848, "uuid": "28fdee0d-b01d-4bae-932d-f3d7301b5a4d", "comment": "Malware payload (TVRat)", "value": "3c4e97c8af29220028a2b7e8e33ab3b6a296681e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TVRat", "colour": "#739DE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652665848, "uuid": "28170b3a-05ce-4df0-a87c-0907c2fbd52b", "comment": "Malware payload (TVRat)", "value": "54b37b58ec496010ee17436601329754447c038cd916a4cb5faa36e34f5bfc283f9dd5ec1987e61a9cdfad1c7c4da2f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TVRat", "colour": "#739DE3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652665848, "uuid": "8881f5c4-560a-4ece-a2c2-a9a876619cde", "value": "T131E4E5A3D342A61FE2533475C19CAA72A40627712A0F48E7B7059EFDD32C2E14E79B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652665848, "uuid": "63a4f7ff-65e1-448e-8178-2c918b63e23a", "value": "9de116a58a6964e888a644a836e6e83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652665848, "uuid": "f724ff5f-0a5a-493d-b7b2-9e57d9c70e4e", "value": "12288:lfn6tCcf6do1vq+wFNVePQjYbijQ+b28e3YJcMfneaWsWcD62Xt9i:H+1INVHYbi0mCIJcMPNDNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652665848, "uuid": "6a2b2070-f87b-4a34-9932-cf975d07e156", "value": 672736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652665848, "uuid": "99962823-282c-4732-81a6-13a7c1c93989", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652665848, "uuid": "59eabd77-dc2a-4ae3-bd44-5e3dfd178b7a", "value": "0ccbb13fd1e433e565c6090a0ae0ea54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbd484b1-d4d2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652676236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652676236, "uuid": "0534c5d0-eb18-4489-bff2-3da6d65e4e1b", "comment": "Malware payload (Mirai)", "value": "280029f3081cae0c7ae3c5974bb8b1c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652676236, "uuid": "f4460738-4856-4643-b508-db5667843b1d", "comment": "Malware payload (Mirai)", "value": "bbb61748890080030c6195ec105d5341550d2196aa338850a5deea4e323a0589", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652676236, "uuid": "bf96c381-9dbb-41a8-a4cc-f2638a0e6c90", "comment": "Malware payload (Mirai)", "value": "f366364b09091562c40a5d1683d4e2a4d83e74b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652676236, "uuid": "1c477d28-53c6-4e90-9a46-19d114b82ed4", "comment": "Malware payload (Mirai)", "value": "6ea1c19ba0c17cc3e8e7c93c01c3eb61133125306b564799806ec67c6e022f67332f94b19fdcdd971ef35a21da50ac1f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652676236, "uuid": "ec25c7b5-f02c-489d-a5a8-0a5e1a943b04", "value": "T18F733BC8A493E8F4DC1406782176BB735E73F13AB139ED9BD3E99567A801B02D00A36D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652676236, "uuid": "08b3ec89-1a68-49ff-8131-56b7ec932d81", "value": "1536:jwOgQ8JS4OZm3/W97kJ2f4ol+QLk+ltLugvSWy/ReAwJt8A73elt:s39HJ2f4ol+QLk+ltLugvSWy/oAm8iun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652676236, "uuid": "715d4bed-c20e-4147-8ef9-792a0c60a37e", "value": 74328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652676236, "uuid": "d9efb343-a93e-46b8-9399-734826ece647", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652676236, "uuid": "1162733f-ee92-4cd0-9d84-b50b29d6d228", "value": "280029f3081cae0c7ae3c5974bb8b1c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c8fde4b-d510-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652702705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652702705, "uuid": "81a57d86-347b-4fef-839c-269d907a8bf2", "comment": "Malware payload", "value": "708ce3c09fcc5519da139f8048444dc9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652702705, "uuid": "5224bf78-1360-470d-bc2d-87ecebae5706", "comment": "Malware payload", "value": "bbc79b09bcdda39bb48dd94dd32f8ca70580c42677c268ac21e31dc7552259f1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652702705, "uuid": "4f5d2b57-7410-41ca-b7b0-aa52b110d5f8", "comment": "Malware payload", "value": "4f401fbc57dc408670e93b46f7a54f8ded6e7e08", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652702705, "uuid": "68e21822-6a57-4863-ae33-e50aae7d3dbd", "comment": "Malware payload", "value": "81b5dc9a2a8d96a2724ad3565e1bf2a5ea830dc12dba5c96440ad268de03c154de3df633a2effbdd6791a57e02b72aed", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652702705, "uuid": "8c94e51c-a3fc-4089-98f4-922ffb35f59a", "value": "T1FB924A7DF5870E88CE87D6AC160A3B821548F51C73D984E237BCEB38664596F9623D38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652702705, "uuid": "60fdc428-64c7-4b87-b7c6-e1dbf0048ebd", "value": "384:fJjqGgLZf3HRnuaPevjEky6rd70YW74JUaAacY:fJjtgLl3HRJeM66ZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652702705, "uuid": "5ef3d713-d55c-48bd-983d-67a138c6a593", "value": 19388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652702705, "uuid": "7a83bae6-4de2-455c-9ac2-2e1e396da2dd", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652702705, "uuid": "70c6fd6c-2f79-4796-84a0-88b37e4bd823", "value": "New Order PO 6784.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebf80e4a-d4ec-11ec-8e58-42010a9c0032", "comment": "Malware payload (Hydra)", "timestamp": 1652687457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687457, "uuid": "76b6ecec-289f-4c14-b30a-c644e5c7cf01", "comment": "Malware payload (Hydra)", "value": "147ef9f8890c63a44610520d0391e9b0", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687457, "uuid": "2e17e4c5-efe9-41cc-95c3-2d4056753a81", "comment": "Malware payload (Hydra)", "value": "bc8d4ef11a68a6523a3a762ae5a5ce670e2fc4def138a3e4da762615325e8a13", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687457, "uuid": "5a3b36e8-d618-4222-9ce5-b0bd3e400a31", "comment": "Malware payload (Hydra)", "value": "6b58f1ef78d0d3481f9037cbb43a14b91f4e3be9", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687457, "uuid": "161d4d87-fd5c-42f1-b359-ea8811690d6b", "comment": "Malware payload (Hydra)", "value": "12b7450ebc7e46fb83b36a89cf1f5c909cad88d8158190c841837f97117e948407f3c2c70fb044a3cadcbde9e40cd5d9", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687457, "uuid": "6b9ea4d9-cd05-4399-9f75-cc08757a4b07", "value": "T18FE53341F50C799ACA2EF7B149A580CB17200DB2C629C95F5FB1F31D187AEE0275A4EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687457, "uuid": "a1abde4b-0eee-447b-98dc-c4d8648ddf14", "value": "49152:/1zmKRzE8IvNM/frMzOqyI1aLento9DrF1kgTtP0UYZ2mS6jY4DfuaLwNyT8y7WA:/hBzIisCiaEoNJ1lTtP63SYYiuaLU48+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652687457, "uuid": "228b406e-88b5-4a4c-8400-363e3345851c", "value": 3081993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652687457, "uuid": "3b03c8a7-16b3-4fdd-bf64-41b9ef9a034a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687457, "uuid": "b262a662-acb8-492f-a743-675c00d7d101", "value": "psk.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca5a84df-d52f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652716177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716177, "uuid": "dfa50c4d-d116-4a0c-92ff-c00447554a4c", "comment": "Malware payload", "value": "333137097735353c32eccf0116cf9793", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716177, "uuid": "f38fc567-e7b1-44f2-a5a1-c430ec6853b8", "comment": "Malware payload", "value": "bcfd4a9005c31b297e5be0c4accacee7192637164689a373d1f67b45d3a59a08", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716177, "uuid": "32de6347-d0a6-4060-baf7-cfe58c20fd4d", "comment": "Malware payload", "value": "3ddfea6374aa1450e609a2ee8f558fb1442df7b4", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716177, "uuid": "5380ce93-1975-46c4-9aac-0aa0282bf228", "comment": "Malware payload", "value": "b262e68b29a564bee1e6f2c94e24526ab902ae90121971574d56573a2c2f8de8d07eceee5d072c6f360747b1ace92a2f", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716177, "uuid": "9aea8e06-c728-4de5-a7d4-9228035c6ceb", "value": "T1F251C0382DE91129F5B3DF71B9E97A95DEBAF97768014D5E0082030B8911A40FD91E3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716177, "uuid": "2751adf5-7099-42f1-b911-8e4227f36ceb", "value": "48:8mUTKRv7gbXjgg8ZgJWcvz9ZsQsXcbM4ab:8mYKR0bugEcvz9N/A4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652716177, "uuid": "9e3820c9-77ff-4240-be4f-55407d3784e1", "value": 2640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652716177, "uuid": "c7b30496-3b04-4465-bf29-390ddd630f70", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716177, "uuid": "58642d71-ae48-4bc0-9a42-79053cd498d5", "value": "elenco 052864.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74df1b8f-d4fb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652693700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693700, "uuid": "d7af8440-deb2-4592-809a-8fa381ca9fd4", "comment": "Malware payload (Formbook)", "value": "686ddd21a0c4790f0357fbf8699fe521", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693700, "uuid": "8a0a6587-4b27-47f0-9ac8-19bc5b996e33", "comment": "Malware payload (Formbook)", "value": "bd108a3bdf861a3e5233d91028a651bebb32884f16c0e039b312fdd06e4b0889", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693700, "uuid": "1b5f312f-0af5-4150-9593-12e06b434d53", "comment": "Malware payload (Formbook)", "value": "5c4f1d934bb4849f39609bf13079a11a81482902", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693700, "uuid": "ad752902-7c11-4efd-ba06-6b6ac1233b13", "comment": "Malware payload (Formbook)", "value": "a67078e9b85f5f8d081d08c7f80f79bab7e6d5e55a48a6752bedaf1e9304226dc910fb8b4d87e8ff3c76ca2b1d131f33", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693700, "uuid": "ca46b740-9f15-4ee3-a5d4-7cddefd6ed6a", "value": "T18B241290381C9B54FBB4C67F66227662D07F9E1260E7B0B5F663F6F847B06360221897", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693700, "uuid": "a5ee08a7-f0ef-46bf-aac4-2decc7b605d1", "value": "6144:mc6Eul7ZL9Ucki/bxAobzv7SY/oRS1URYjDuqTAdckzurcix:cVZLacL/bNbk2LjDuq00/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652693700, "uuid": "dbb10230-4f03-438f-a3c4-c71729c1b1d4", "value": 229080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652693700, "uuid": "ec89dd71-f113-4396-bc73-644136e2db87", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693700, "uuid": "8553d5a1-be10-4392-8ff0-0062f38012fc", "value": "aaaaaa.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db38d178-d511-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652703321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703321, "uuid": "02a80a90-0784-4814-b828-82df21aedc8a", "comment": "Malware payload", "value": "17b36c462ac02a6b5b33a520f1b73cd9", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703321, "uuid": "f2a18a67-6afd-400f-a30b-6ddbe8a328fe", "comment": "Malware payload", "value": "bd6338e5fec330a4521f2ec125eba452b0e1254ddec5ca7cfbd0a03316c7842f", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703321, "uuid": "89a45c19-bdd2-491b-8b50-2bb878a80430", "comment": "Malware payload", "value": "e06b444330465342a8ef7684303cb49652431707", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703321, "uuid": "c18d72f4-a6c2-4ef6-bb43-7cb3dc6d73f9", "comment": "Malware payload", "value": "742fffe3b5a1758ec03e2f7321c219d27b20724049090fc102504ae76eb7a50ffc674aaf6e005e8b93c1f4d5bd81722b", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703321, "uuid": "0d2faf56-2643-4326-b816-f09ce6b7aa95", "value": "T1E124122B3CC0D0C8E994D23C182287159966EF7B8C7EC6777940F7754CBB5621D21A6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703321, "uuid": "1a84366c-c5a8-4be4-8675-b075836e17d9", "value": "6144:/FnVEObeIuzxKVyMZi1NlPQCIy/yMILUq:/FGObeIhVZZcotMCX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703321, "uuid": "f5e7c8c2-d2c3-4dc1-9fc3-ccc9c781d861", "value": 228936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703321, "uuid": "9549f7ba-3146-4309-90a6-9e9e49b775cf", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703321, "uuid": "2920914c-5bf8-4e27-a7e8-ab2ccb7ce8c1", "value": "R.C. PILE 7374.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ec0a03-d4ed-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652687633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687633, "uuid": "5f9e5095-a934-418a-a036-76c3ff30ec9a", "comment": "Malware payload (Mirai)", "value": "f9d66f66d8627d62713cc71419155e94", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687633, "uuid": "67f6b72a-6491-449a-a519-06a2467efd15", "comment": "Malware payload (Mirai)", "value": "bdf6339f9096dd11b05cd88ecdbc72f882bd1c2254ad8bd578b02f99ebb854d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687633, "uuid": "c186f27a-6bbf-413f-aaa8-91c8ef869875", "comment": "Malware payload (Mirai)", "value": "b680bbb5e0c4c2c4a4e66472929e04ed55c962d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687633, "uuid": "1bec01d1-5e49-49f5-824b-374a02187a9b", "comment": "Malware payload (Mirai)", "value": "cdd43c7ee57112ad24413b6de6edeb423ca8593a12c5d4161ebdb157095d1d4958a1f29552cb0239d342869b089971eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687633, "uuid": "a8a77a6b-28eb-413a-9756-d501837b86f8", "value": "T163B2E0BD13A599DBF928A7B3A71C9C0390255461E23C93DA16C7C4432DBF3A1BD24DE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687633, "uuid": "d7a4977f-1864-44b6-b190-5b002d0a8af9", "value": "768:RDmTYT/nB6e6kv2idW71tvU4aCmwqXwJTTv:FL/nNjdaU4tm3XQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652687633, "uuid": "487e690c-a1ab-4da3-872e-b9488739a8a8", "value": 24772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652687633, "uuid": "b62ce746-bf06-425a-a3c8-e4fbf6e85f09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687633, "uuid": "6426adc0-58ac-45c9-8c5f-943d89fac2de", "value": "f9d66f66d8627d62713cc71419155e94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a522c15-d519-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652706487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706487, "uuid": "eb23d7f8-71f2-497a-b928-5f6f4eb01495", "comment": "Malware payload (Mirai)", "value": "848f9e39660957f7e0e947216fd22ef1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706487, "uuid": "6f579f21-b58a-4844-9e5a-ce362cbddfc1", "comment": "Malware payload (Mirai)", "value": "be94c193ceb3f0232e64274df49f7777210976ca92cf5e1314f1b184686372bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706487, "uuid": "e59cd80a-3d95-4df6-a0ef-bbe4f36dd3b1", "comment": "Malware payload (Mirai)", "value": "3ba661d6d52f4149fd588f3850238f1080a7be0b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706487, "uuid": "fbb5b134-c6e5-4b33-8397-e8d37e2c2796", "comment": "Malware payload (Mirai)", "value": "3ec00469256d2b07c28b4f7b6c2ccabb4ca9ab88c604f3d2b648c60b12a4ab4962208ef69329f5f34119d8b0e73875c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706487, "uuid": "fea4b315-48cb-45e1-9c5d-67c8861b297d", "value": "T1FC733A753946F63CE9E590B8F84329D115220A083FEDD5E36C83607ABF70B89716CE5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706487, "uuid": "f6c3f09a-fbef-48cd-881a-ff4556ab63ea", "value": "1536:SVUiFHcgJEahRzvz3Ym1DMNYVBIVCCfy0K9k1qAzn:SVUiNcgJEyv7YODxujVzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652706487, "uuid": "1d3d6031-f422-4cc0-8c1a-ee33bf94d724", "value": 75132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652706487, "uuid": "519a9aa1-c326-408c-8b3b-9851e332895f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706487, "uuid": "672d9fab-84ec-479e-912f-229c0b0938c3", "value": "848f9e39660957f7e0e947216fd22ef1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6961d9c1-d501-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1652696258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696258, "uuid": "6bc2d5f4-a502-4589-ba8e-33d368a0cb6a", "comment": "Malware payload (Quakbot)", "value": "f78dc8140535e31f6890e4ca3c2821fa", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "green-a-thon-com", "colour": "#E9E599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696258, "uuid": "ea75a1c8-2d7b-4898-82ef-17db7099a918", "comment": "Malware payload (Quakbot)", "value": "bebf4177fc27714844f0e5e506637115828de7805529680d8ca19915aa7a7ac8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "green-a-thon-com", "colour": "#E9E599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696258, "uuid": "22e37c66-a35b-4b14-815b-535989a9c753", "comment": "Malware payload (Quakbot)", "value": "d3a25362849bcef1a1630ac3a453da9b526fb1be", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "green-a-thon-com", "colour": "#E9E599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696258, "uuid": "fabce1aa-16ad-4866-b546-21a0644db873", "comment": "Malware payload (Quakbot)", "value": "a12613a03d188a699661f4f2663a0cc948c08116f13474b23d025ecc109fa158f057dff105f18b23b3dc215a4815879f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "green-a-thon-com", "colour": "#E9E599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696258, "uuid": "0d8c3edc-aaed-40c7-bb82-5d509ffbe0da", "value": "T102E4AF22E3D04C77C1772A789C2B7768A839BE112D7899C72BE42D4C4F3569136362B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696258, "uuid": "7e1aac57-a7be-4382-9608-e2da7b7e9e83", "value": "df2c97204ed982b8b3e7393fd2a71059", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696258, "uuid": "7972dac9-09f1-4e20-8fd5-b743331b1928", "value": "12288:lD25c7bMl3XyN6VqX1bFJf44pnlG2LniES2DY0HfyHHsPNfvZRzsvBn:98Aw3CowXrJf44pnw2Ln1jY0HaHHsPNw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652696258, "uuid": "83f6475f-43ab-42cb-bd4c-62d41f1e0fc3", "value": 715306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652696258, "uuid": "383ae154-0145-4514-8a01-104983efa148", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696258, "uuid": "b9db786d-b7cd-48a9-8116-78250c7526e6", "value": "B png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f499c5-d4cb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652673193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652673193, "uuid": "6e31f92b-ffad-4d3f-a7a6-21122ffb43d8", "comment": "Malware payload (Formbook)", "value": "b21f6abe8ce5e434e40ce380cd557dc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652673193, "uuid": "f0c420cc-18cb-4d52-87f5-03aacba52fc5", "comment": "Malware payload (Formbook)", "value": "bec8c6b5504f6063eb944f8fc571e5f35b0ee6f6a6234dcbac63fe5479d82f13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652673193, "uuid": "a543ef51-21a6-422a-89cf-00ce85c5ef92", "comment": "Malware payload (Formbook)", "value": "52e6e62c6430b2771eb08f62ec54bd551a930811", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652673193, "uuid": "788b09d5-d11d-4374-9584-2aac03c09173", "comment": "Malware payload (Formbook)", "value": "82920273936efb50bf41c816e47ef912a12af713d6df2375e4d599eb8f3b9380985e6bcc8d220d9b9fb85d8e4596d9d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652673193, "uuid": "fd06b1d5-ff2c-424c-942b-33815ebad374", "value": "T1F1B4120469AC9336E6FEA1B0B37A850146B1F6179523F2381DC7604A2DFBF565F10A3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652673193, "uuid": "92171304-e745-4601-a49d-0374427234d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652673193, "uuid": "57bb7ffc-ee55-4118-8194-4fcc2e2baddc", "value": "12288:9DxiOGAT5vHm0aEMa+1RWea397mX7xfSbt0n/AF2EHRuYPRMkI/xe:yl4vRb7+SJ0nPE7MJ/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652673193, "uuid": "98a55d9e-eec2-458a-af5e-5ba5aabeb282", "value": 520704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652673193, "uuid": "e8a9be1e-a7d7-4121-9e39-448c06f112f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652673193, "uuid": "abb587b8-e15b-43a8-b219-97ba440322fc", "value": "QUOTATION REQUIRED FOR NEW PROJECT HB2242.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f907acee-d511-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652703371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703371, "uuid": "06336800-0d03-489c-82b0-7ae558a15956", "comment": "Malware payload (Formbook)", "value": "70da89e68a38eabc03093a03d7bff7c5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703371, "uuid": "2e1ec155-569b-43bd-be47-b000cfb8acc9", "comment": "Malware payload (Formbook)", "value": "bf0deb580e83a35698d4e8313eeec47a1dca21cc3d1297a03536b3a16de70aee", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703371, "uuid": "ee9da59f-b4a2-40e2-83aa-5d57b961b529", "comment": "Malware payload (Formbook)", "value": "d64a71eedf6e9ed609c91e06fb7f821d6fccce1a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703371, "uuid": "ea09312d-2bb6-4b13-8abe-357a790e755a", "comment": "Malware payload (Formbook)", "value": "3db74d7e44ebbe4f975bd94dae0b2964c1249b38648e9003f7614d0218b90915a41875598074d2b6b07da53cf35b9041", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703371, "uuid": "c01e07d7-3231-4cfe-b4d7-b1b6a4970569", "value": "T1B524127D2BCA570FF86A12736CC6212C5673CE9658C6E1E27062B99D1BF3D000469ADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703371, "uuid": "83508a03-a262-49d6-aa9e-3813aa457e22", "value": "6144:kPfodUSNcKqLHOxnIBNWmdGN6zQ+3R+nugM/dsRNk9:riHrBpdGN6z13RBMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703371, "uuid": "71daed78-aedf-4a3c-afb6-3bd4291366b0", "value": 228712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703371, "uuid": "ea8dcca4-68e6-4608-8ed9-a88d1c3ebb90", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703371, "uuid": "2027b20f-86fe-4b40-8934-94c4bc9acd25", "value": "PO_QO9P5594.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5852a55-d511-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652703257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703257, "uuid": "195cb126-03c6-4e53-abad-489718cd88aa", "comment": "Malware payload (Formbook)", "value": "617c93a6f7f19d123eca938a3f4e78e6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703257, "uuid": "6192f730-2bdc-401c-ab0f-b7982f53917e", "comment": "Malware payload (Formbook)", "value": "bf917fb0d049d4f72febaa5f915120c9067f513100bc36cb4f65ce03b751811b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703257, "uuid": "b3091c26-9d11-4daa-9994-69f7c3d46779", "comment": "Malware payload (Formbook)", "value": "eed3b38632e7840a7ad52004be24c4b66636cbab", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703257, "uuid": "96377046-1820-4a66-b741-01e3df370968", "comment": "Malware payload (Formbook)", "value": "1523f21ab5b8057e9d6ba3405bf21ec2b77437dfa03fe5250af79990e22447fadb8906ada08a0eee02f79754fa1abc4e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703257, "uuid": "14c4381f-8a15-40c2-8fc3-f87039290a75", "value": "T12A24120276904457C9E16E7B75C3DDDAE5BCEDE834E2952A1E3CB31A8A744F603812B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703257, "uuid": "a973f81c-ac2d-4dfa-a30b-f0c30e22d93d", "value": "6144:OGipVXHL2uQ+tc5B9PZhxLJ9ptPTlx/OqOKuDdAueR:OPVXHL2uQ6sB9PZh1ptntuDWueR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703257, "uuid": "8e592146-a67c-4249-9755-c6acab49ba64", "value": 229048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703257, "uuid": "d4212beb-0de6-433a-abd1-2c28281a3ec3", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703257, "uuid": "c93f49c8-0b05-4d6a-8a9b-3b16616ff4dc", "value": "RC_Pile1314.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62c3e5e2-d4d9-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652679067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652679067, "uuid": "fd9c8abc-3536-4525-a2d3-62e94f38790d", "comment": "Malware payload (SnakeKeylogger)", "value": "7e439c7f9636682598cb3438da45ebe9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652679067, "uuid": "3510deb7-cdce-4405-9bbd-0f92a1f19a5b", "comment": "Malware payload (SnakeKeylogger)", "value": "bfc94f0bd631a75dca96329c99631b3d7a6f6152974b091d280a8f77ddd88e15", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652679067, "uuid": "7bd749bb-ea08-438e-aadf-56e31b549133", "comment": "Malware payload (SnakeKeylogger)", "value": "1033a94c129f60d5ef3915f0f8f1a9882eb4c845", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652679067, "uuid": "62d7d62d-6fbc-4c6e-a0eb-a177624b7b0d", "comment": "Malware payload (SnakeKeylogger)", "value": "0b817e6b98a1311a1338c1903f942a049e7a543a72d5fa80d73c30904e7f8146f6b3c2b80896e191e2ae6c662edcd9c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652679067, "uuid": "56f88d51-5f84-4306-a4ce-fb1070cd011e", "value": "T1AD84CFAE9755C509D8A93A7B88F363307F01BE2011B3D39F60D5788B95B7BE63C90290", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652679067, "uuid": "6420877c-9fb8-4784-9a6e-4c11b4983b0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652679067, "uuid": "172dda90-19c1-4f91-8a86-30f24b6114e1", "value": "6144:BaFn8icad8KTKX6YcdxqS/4ra4BC6F2eqGqoiVmHf8M2GQAXObT4:f6NgoDqS/FX6FXqa/87G/X7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652679067, "uuid": "7fc24f82-7bfe-4e0c-87f6-da0305b945ba", "value": 388096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652679067, "uuid": "fefba1f9-e784-47c9-8588-691836864d39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652679067, "uuid": "2c1112a4-a5ca-44ca-b405-cd18b8fdc542", "value": "7e439c7f9636682598cb3438da45ebe9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b29cd0ea-d4d1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652675765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652675765, "uuid": "ad968411-91ee-4793-82d9-e37a627f347a", "comment": "Malware payload (Mirai)", "value": "d3cd62ce3e5f470153ea96221a1b7d26", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652675765, "uuid": "38ca4a98-4a81-4784-b854-f80766b32e31", "comment": "Malware payload (Mirai)", "value": "bff108fed1deee2623dd308fecb2a9de03abbae18807fb584ea43f860d8799b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652675765, "uuid": "4900ebcd-7e1a-4f94-a3d7-eb8f6baf6687", "comment": "Malware payload (Mirai)", "value": "48fd84cace34842901b8e69b2544e81176b4a531", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652675765, "uuid": "c2d7b974-7b4f-4231-91cb-e387b0cbfd48", "comment": "Malware payload (Mirai)", "value": "11d3e1f5fd76b9f865dafe1273ae7c071ba427f7f9c2f42dd235da8bbf360ef0210007e3e3011b8144c8f9c31f08f7de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652675765, "uuid": "f39c182d-3942-4e29-8754-d7ff506c0208", "value": "T1C0930885B8819E15C6D413BBFA2F008D335297A8E2DEB253CD145F6477CA81F0E7BA85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652675765, "uuid": "b34babf7-53d1-4d62-a0f6-a227c8f4096f", "value": "1536:019n6ba+ZvOpqHk5QOgyb+YAYQ+yxNcjsuCvw9mrsplDKZUCQBKXAVanVX+F8Jyx:0KbaykeObbDAV+eNOsRo9mrsplDKZUCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652675765, "uuid": "167db271-105e-4b48-ae6b-07e4461e9c5c", "value": 91264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652675765, "uuid": "36dd4b10-c56a-4f9b-a2bc-76ebd378a723", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652675765, "uuid": "d97d55b5-a2ca-42f3-b598-0435f68ea6b5", "value": "d3cd62ce3e5f470153ea96221a1b7d26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78a9c64e-d536-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652719047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719047, "uuid": "a2fcf7db-6ce2-42dd-9bbd-57ac4b5063be", "comment": "Malware payload (Formbook)", "value": "811265db438164c9f614922a020159f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719047, "uuid": "13d34412-986b-48da-91dd-527a15ec55f8", "comment": "Malware payload (Formbook)", "value": "c021e44584f8145fef29a6c46f9de8ccd8ada5a245c7660695e1e164eb2b088e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719047, "uuid": "32395c42-951d-40c6-8e95-eef3f6a0341b", "comment": "Malware payload (Formbook)", "value": "47e0ed0d05b9af0cc01d8b2b9defbfd3edadcbf8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719047, "uuid": "6a378c5f-f23f-438b-80d3-5431c99c6309", "comment": "Malware payload (Formbook)", "value": "16b098e12f7389061adf58d0d218a854bf112333ef4fd5623cf805e07e94fb97a84ae72ed800b626c9bba03b53bc7573", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719047, "uuid": "d30b00dd-ffde-4c33-a324-7d08d6f048aa", "value": "T1AB44121133E5C27BDAE206371E336B124DE1106A29B51E5F97A06FCBBCB2405BD0F9A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719047, "uuid": "64fb1747-fef6-474f-9c54-9871c2342658", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719047, "uuid": "b6313370-380b-4cf1-b138-b5f0a054de9c", "value": "6144:LOtIOH+5ShxXTFsgbcu4XN0ma9UxHcLtrbX8Fd9Zkx71DPdXIQNn8Z/:LOLHEShxXysMN0PA8LtXwd0ZOQNnm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652719047, "uuid": "a75fd325-eafc-4434-95ea-de7823c7000d", "value": 263261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652719047, "uuid": "8c8c7389-8c4e-4927-bdab-a71d311cb894", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719047, "uuid": "aea71a25-4d0a-435e-b43f-df3b392fae2d", "value": "SecuriteInfo.com.Variant.Jaik.72878.14382.7065", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45d252c6-d53f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652722827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722827, "uuid": "eaac5d8d-cf51-4796-a313-af1d88b3510c", "comment": "Malware payload (Heodo)", "value": "aa8224c3b23c32cf8c3acfbd56709de8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722827, "uuid": "94f6902a-1d8c-4aa3-be86-41b0a1221432", "comment": "Malware payload (Heodo)", "value": "c02540b6019b51d8c1c05c38345e49dda93cac9c4485cf9b1cee021d494c7826", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722827, "uuid": "c387b94c-3090-4dcc-9b0e-e5fe74881455", "comment": "Malware payload (Heodo)", "value": "69d669d7c738f77dc09cb8cc5d2dad22c92109f3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722827, "uuid": "7d3581af-06b5-449e-90f5-d8d8b44eea3e", "comment": "Malware payload (Heodo)", "value": "89c47cc4c690e97888dade7f6b325442943a97a25b9b6866dcfe46cfd2eb9bf513fde738290a0350945a92b0dbf394ce", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722827, "uuid": "f1cadd4d-7e89-4a5d-99b1-c3947120cdba", "value": "T14A84C04573A48079EDB79338CC574A47E376B86907B0678F1364436A9F3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722827, "uuid": "f412cadd-2a7f-4e77-9ed7-cb1e4f9466ef", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722827, "uuid": "dd3362fc-1f4c-4d06-a5da-c0c23d12dbc3", "value": "6144:EbmRW/X22TR72tKbxGeskesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/spRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652722827, "uuid": "13d0747a-d339-408d-a7a1-2fdc410fc051", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652722827, "uuid": "bd1f3911-0124-4476-8ff8-ac702e8f71e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722827, "uuid": "1fb5decb-9f8f-4719-ad26-2ca506491695", "value": "aa8224c3b23c32cf8c3acfbd56709de8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cac2a9d-d538-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652719805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719805, "uuid": "c27e8f50-a83d-448d-801b-bebec6631bcf", "comment": "Malware payload (Mirai)", "value": "9f7edd2a1771e752aed741929da45b36", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719805, "uuid": "b4e32ff7-1d8e-48e8-b569-c6d3798340b3", "comment": "Malware payload (Mirai)", "value": "c07e51b1572065aa174d054d08e07b2e732dd478d42b8506e687f96372886413", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719805, "uuid": "95fd7449-e4d3-47a2-b0b0-451016fc6d6b", "comment": "Malware payload (Mirai)", "value": "f628a38080af110fe9321b4cf01f762547e1db42", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719805, "uuid": "159d35dd-7e00-4965-af10-60301ea20e42", "comment": "Malware payload (Mirai)", "value": "a1f13955e369c57eff324d56139407535ae9fe4ac7d29497331b6da466f13fb55719d7cb9bbfbb9d656db2c1ee8657ce", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719805, "uuid": "cc140077-1dbc-496c-84ed-2fc115119733", "value": "T10A23F172F7269B51D6A2003ACE6904C25B470BB8492F3767BD594D4D1AFB10A0FF4D87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719805, "uuid": "53b91cde-a237-4e89-883f-bf72a3fbab53", "value": "768:nhlEeaxvkMqEEtksplyUFJNi9FJYqpIrG9q3UELnQpDLkJcQMfU3zFKSey1I:nbEekqftjpwUjNEIrrLnYLci83Zpey1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652719805, "uuid": "88768602-7108-4015-aff4-bdbf993f8cc5", "value": 48376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652719805, "uuid": "3f53f75c-0d98-41e8-8264-f010a9651c9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719805, "uuid": "183ccec2-9013-49ca-a42c-1019e1d7d12b", "value": "sora.arm7-20220516-1650", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9aa83ca-d51b-11ec-8e58-42010a9c0032", "comment": "Malware payload (MimiKatz)", "timestamp": 1652707640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707640, "uuid": "953e6fab-738a-48de-ab0a-9b764cee88ce", "comment": "Malware payload (MimiKatz)", "value": "3b81b0f4eb5e6a8ee9343d70d26f291b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707640, "uuid": "3ce08f70-d50a-4fff-8760-d4da5cf88607", "comment": "Malware payload (MimiKatz)", "value": "c0d82b38ed8596f0d48492cbe4120888476db451bf0b7b8a119f7480dd386fcd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707640, "uuid": "330b48bf-4f20-4c0c-8c10-97328156ca5d", "comment": "Malware payload (MimiKatz)", "value": "12dbbe118f8973a46e05fcf0ef3979cec5b31167", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707640, "uuid": "89b581d5-55a3-4730-8da2-6043461fba45", "comment": "Malware payload (MimiKatz)", "value": "c08432366c2cfdfc7639752f6d03be26f67269131ce281f89381bc323db4d5d4567877aa8809cc4208cff8f6e61599f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707640, "uuid": "25f6e7b7-92f6-49f8-9fa6-c462cbfca3a0", "value": "T18195D072624082BFD69021B04899BBF54D645BE44E3ADA8BFF94FCC969253D0983DF34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707640, "uuid": "8296d696-7082-4006-8dc2-9e73df39bcf7", "value": "8dbd645ef5654bb004fb90bebb3c070d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707640, "uuid": "4a6178a3-a6b6-471d-9d5a-cb5a1fc0c8dd", "value": "24576:d8e3HdYUsL+I7OXFlyVctQ6etCE4TA68dRvIYxYYMGiR9TOg9J:FHBq+IyXTyCtlAzeX4gYxYYMtl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652707640, "uuid": "572c0250-9651-4aec-870c-0ca64ea0351a", "value": 2048312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652707640, "uuid": "c764dd46-20f8-445d-9f99-5f88dfa2530e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707640, "uuid": "8c8196e0-4fa6-4323-bd19-3b15e10ee8f6", "value": "$OiKuCtaCKsk 01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b122fe5b-d533-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652717853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652717853, "uuid": "54d9ae56-f1c3-4d0f-880d-102cdade99f0", "comment": "Malware payload (Heodo)", "value": "99e9825328925e724a87307575eb24e5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652717853, "uuid": "945400c9-d0a5-47a4-82c5-20274b03343b", "comment": "Malware payload (Heodo)", "value": "c10f7d70c58c55346f32fb74a514c5b672ed6a9db121a52c59a0bad93383944e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652717853, "uuid": "c168e3c7-d7cc-45b8-b4b3-f1cafe79d262", "comment": "Malware payload (Heodo)", "value": "cac088faa80c20cacc1fc0cacaef4b9f8d5035f3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652717853, "uuid": "fa4c4f26-2d6f-4552-bce5-985cd7441106", "comment": "Malware payload (Heodo)", "value": "b5495a2f5d5a813941ac39961d9d062d0cba05fd82f75e3b804e496de861bb8855845569c1fff4e56c414a6687947f8c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652717853, "uuid": "03048d56-d9a8-47c7-b8d8-7288e3dbf56d", "value": "T199519C283DDA2218F5B3DF717AE875D6DE6ABAA26D425D5F00C0030B4811E40ED96E3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652717853, "uuid": "fa7cacf9-7b7a-4de2-bcae-b7503a1613d0", "value": "48:8mOrwF7B8KTSukPNx4sedNk96BLdKzvnAjk2dt6B/vuoWN04ab:8mOrwFd8MuNxp96/Kzvv2Hy/N34", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652717853, "uuid": "4b6a7a26-16e0-40a4-90ec-167049a25b17", "value": 2632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652717853, "uuid": "6e3763b5-b27a-4d85-9f53-10730a163b30", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652717853, "uuid": "b077ecda-6d51-43b6-88ef-bb0c597d385d", "value": "LDu_53.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b08bb3-d512-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652703447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703447, "uuid": "7860962c-11a3-4b1c-9e8e-18993830b06e", "comment": "Malware payload (Loki)", "value": "8a97006054586f482524fd745cb2dd48", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703447, "uuid": "b77de92c-7589-4b2a-8c75-1e7a729b63a2", "comment": "Malware payload (Loki)", "value": "c16c83cd39bc8a464a2f5842cf51f04649fb6b587a6b59b703cee061a70d4571", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703447, "uuid": "ececdee4-408d-4166-a21f-f19d8fc4fccb", "comment": "Malware payload (Loki)", "value": "9a37526d9f56a28ce091959d90c4c23e2af64787", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703447, "uuid": "b91e505b-7235-4ba4-b9c2-11538d247084", "comment": "Malware payload (Loki)", "value": "2c1aff388aaf71f271246cd385b36707795518fdd88b2ac1c4babb857009e3554364fa93468a5b6057c5863a8e46db5e", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703447, "uuid": "c208f9cf-596d-4f87-8724-101ad9ada130", "value": "T1D6241262BE59451BC7472E3B5821ED4E6FB6DC2C8228E26DE91C3F5FF47BC0640062A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703447, "uuid": "948cf6eb-f8c0-4914-b5ed-31bbc0c93c55", "value": "6144:MD3eTenFYMopeiCq6IJeAFSEuQmdfLtcNQC:MD3rRopecTBxurFLUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703447, "uuid": "37fde605-1542-40c7-af6d-091b987bd85e", "value": 229608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703447, "uuid": "5fe594d8-ea5b-432a-93a2-8afd4edc545b", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703447, "uuid": "3a7e3af9-7040-474e-9a97-aabe15e66234", "value": "200.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bd40839-d519-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652706543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706543, "uuid": "ccc70975-6802-4157-b946-3a85ebffa048", "comment": "Malware payload (Formbook)", "value": "dfd5f0df7e2785918a6bc7a8f207d668", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706543, "uuid": "355c4fb8-a92e-4204-b60e-b9c08f98f859", "comment": "Malware payload (Formbook)", "value": "c17264caeeff55f505d476b196dd7c7a1a8ea7e508cd157ccf5f59d92d1a71c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706543, "uuid": "c94681c8-57e5-4b86-84de-5772bf0b4e21", "comment": "Malware payload (Formbook)", "value": "070c80301c7c539bdf16a616278383dcefc922bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706543, "uuid": "5c7344f6-761c-441f-b46a-78881d995f0a", "comment": "Malware payload (Formbook)", "value": "8b0441ab406fc102ba3b989c8bb29e34d2107bd11aa0e37f355097cf93b8388e665f176a195b5bef627fc2eacae31d49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706543, "uuid": "41138e2c-26a6-42f7-b6a2-b983cbfdb6b9", "value": "T172E412103A47E534D17D673BE3A7085517FA26A35E22C69EAF8D71C20912EA3C907F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706543, "uuid": "6f343a31-b337-4f3d-9e48-04d50c24cd1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706543, "uuid": "29c9a34e-7e40-4c5f-87ef-54319d9724b9", "value": "12288:gCgqUn++MuU8BfipB5BtDq6gRgO2kaaXwnxBs86J2GSgs1c1YUldhKi3llxiS3nK:gCgqUn++MuU8BUBk6gRr2krXwxk9DsLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652706543, "uuid": "0c69347b-3017-4ac7-ae2f-2e235e3ac269", "value": 717824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652706543, "uuid": "26598e02-5c1b-44d4-99c0-6f87f7d9e8c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706543, "uuid": "4937dc06-3dfb-4240-a4f6-795c145c94c6", "value": "dfd5f0df7e2785918a6bc7a8f207d668.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "425e684d-d53f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652722821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722821, "uuid": "63174895-1a0f-4f38-ba3a-eec7cc41deb9", "comment": "Malware payload (Heodo)", "value": "d207287c0a75df8a4aa64102a0d92f72", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722821, "uuid": "3b87af06-17a6-42a3-90c2-e4eb0506570f", "comment": "Malware payload (Heodo)", "value": "c177530347dc2c7a8434b0e60a6e376c4eb551d4983895c4db3bd2a3c83b59e0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722821, "uuid": "24e9b767-a51e-4219-a934-2c5c5fc3f52c", "comment": "Malware payload (Heodo)", "value": "d30ce3160711e6700eaa0872ba40e397577a2290", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722821, "uuid": "6d586c35-0292-4b0c-bd7e-bedc64ea96cd", "comment": "Malware payload (Heodo)", "value": "8ba6400a282c36be22beaf7e5053915b398c177480e0a8955d844dcadf348e710db1709fa5e8213818100f6520c293bd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722821, "uuid": "d88a3ac8-ce69-484b-85ad-cc22daf97266", "value": "T18684C04573A48079EDB79338CC574A47E376B86907B0678F1364436A9F3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722821, "uuid": "385cac53-658b-4207-8573-a7bf6df1cbb8", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722821, "uuid": "ac98377d-214c-40dd-8c7a-773956edafd1", "value": "6144:EbmRW/X22TR72tKbxGeSkesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/SpRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652722821, "uuid": "ebb92eef-b515-478b-acb4-de86f6f2f716", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652722821, "uuid": "c5cfd330-5b1e-43f3-82bb-a65e72ab02e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722821, "uuid": "7a9ff03e-e01a-4aa1-a748-6cf903482c3e", "value": "d207287c0a75df8a4aa64102a0d92f72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4a156ff-d4f6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652691740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652691740, "uuid": "c586c000-9d28-4d8a-8aa0-4434f06fe5b6", "comment": "Malware payload (Formbook)", "value": "b96e1cc146269b91b018969fe884ae4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652691740, "uuid": "036f13ef-be52-45b9-a81a-a990445186ed", "comment": "Malware payload (Formbook)", "value": "c1784c72cf689294811cf3f79a5b05a42207842e718bc1a3a2d40fa80d876ff8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652691740, "uuid": "8f14b7b1-c2fa-4e5e-aa06-a1cbf9a05542", "comment": "Malware payload (Formbook)", "value": "c53369b42c4bf06b83e121e44693ab49c39058ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652691740, "uuid": "a4f9f38e-d3fb-4068-bcf2-94477e7e7a44", "comment": "Malware payload (Formbook)", "value": "1f68ce638ecd3030bbedd480ef6f02de344d1481f9e2e5609cacebd25b999558b5d0b607c2618435aaa932a2431200fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652691740, "uuid": "127198b4-5d09-4def-bfb4-3ebbc218ce6b", "value": "T19EB42255E6EC4221D4BAA6B87B3600250AF2F967D463DA7C5CD380EB2E77700CF11A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652691740, "uuid": "54f1bb94-00a1-4045-9280-450b7cf7bd24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652691740, "uuid": "dea417a5-a909-466a-81bc-baa69aa30d40", "value": "12288:cJ3ElS7xTeMQjzET40bhSIfAUB9qcXik0XA:cJ3ElqVe5zS40bjAa9qYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652691740, "uuid": "a0cc698c-a01f-4ca8-bfbd-2a4228b17a63", "value": 520704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652691740, "uuid": "30a55579-27cb-4301-8f5f-13069ff06e66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652691740, "uuid": "317401f3-c4c3-4fb7-a267-0b1e5f27e74c", "value": "Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34826b38-d4f4-11ec-8e58-42010a9c0032", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1652690585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690585, "uuid": "868a4b12-2dd4-4a7d-ba64-2f79a9f166a3", "comment": "Malware payload (ArkeiStealer)", "value": "6b6adef2db4be50255bb393265cfbc91", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stereodon-social", "colour": "#9DBFC2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690585, "uuid": "80a89437-732d-4829-93f9-1ef39d49e74d", "comment": "Malware payload (ArkeiStealer)", "value": "c39e87f36d1f3597a4d205c4f2d7801b8b1040e2b97391196a8a59a8a8788ad5", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stereodon-social", "colour": "#9DBFC2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690585, "uuid": "89141a52-e2ab-41d1-a4b9-a1fce61d4f0d", "comment": "Malware payload (ArkeiStealer)", "value": "1e71ab7e60419bf6c99ad9ef15231a1d8f7f40c3", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stereodon-social", "colour": "#9DBFC2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690585, "uuid": "4430eb12-432f-43b4-9c7e-27ea912c467a", "comment": "Malware payload (ArkeiStealer)", "value": "58b1a52ab090529f83fa8e1dc05277f583a0b91daa7fc6976370c93286a3e1d7a916c35e3ce066f9642a0ff3ea00cab9", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stereodon-social", "colour": "#9DBFC2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690585, "uuid": "f20cf9b3-d478-454b-9aaf-ec2f25d81878", "value": "T103D4F110BB90C035F1B712F4497AD3A8B53EBAE14B6560CF62C92AEE16316E4DC7135B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690585, "uuid": "793fcb0a-489d-4d66-a90c-5cad6cce9d6a", "value": "8f242c9c63ca6345b847b0a3155096ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690585, "uuid": "067a0f15-5804-41f1-862a-bf7bd12d8a3f", "value": "12288:V28s6Wanin+Nk8Y8FV8YjmySyN1kZLYqAFW8quI85IzIMopKnluF:425cdh8FVlmySuK05tp5IEMoGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652690585, "uuid": "0babc968-674b-44bf-9707-80e3de18ce61", "value": 652800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652690585, "uuid": "118e086c-9aa0-4e94-81d7-84eaf026fd73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690585, "uuid": "0e00e61b-c835-4c3a-8ee2-618438127ce4", "value": "build_2022-03-23_12-25.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7693d023-d52c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652714748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652714748, "uuid": "bcda897a-4d6f-4f54-817b-9c0975a48159", "comment": "Malware payload", "value": "257e0b90503375cb64018979493a0375", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652714748, "uuid": "093dc1a4-4740-453d-9fa5-8a28a446745d", "comment": "Malware payload", "value": "c46f8bdc611e253950773ca2daf8a59ebedd55b1d50c33b011a0709fe63c35e0", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652714748, "uuid": "c7e64d72-e67b-462a-b8f1-6011f8309b62", "comment": "Malware payload", "value": "b91020420d2247d48f8c4014ecf7693afef06150", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652714748, "uuid": "9589fba2-ed8f-4c9d-9b24-9783ad46af89", "comment": "Malware payload", "value": "78054dad19d40e6ce91f40c2f934d180ea55b4f95cd379866d3a8b28ee1f4c4b93f78e4e5ebaa4539c777936b2837e90", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652714748, "uuid": "e07d429f-4f9c-486c-b0b4-3884851b3081", "value": "T1AF06AEAD0B36AB967649374878040F450654566CF1E410789A8B37A3CAFFEF2807D7BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652714748, "uuid": "b057f707-ae7a-4bc5-866d-66a9d4ac0c83", "value": "24576:UvCIIoislD4moeUoaLLMTqWs28zQIIrIdb3BX/rdRTlT91VpkPt1IeSyuV49g2iH:z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652714748, "uuid": "b9fcfe45-4cc5-4c3b-aa9e-37071b95a47f", "value": 3755000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652714748, "uuid": "dba15408-3a60-4e18-9877-714dc0393ef7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652714748, "uuid": "453754f6-22bd-4b86-a760-40013136da11", "value": "Serbver.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb58fb84-d512-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652703723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703723, "uuid": "ed606edc-6afb-4a88-984e-46cca6c30254", "comment": "Malware payload (SnakeKeylogger)", "value": "f63026bfdab0fc476e46ee33e7f270f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703723, "uuid": "efbd376f-5aa4-4b7e-8ce7-93b7fc64c241", "comment": "Malware payload (SnakeKeylogger)", "value": "c4932fa323858a1922adbe110e2985ebabe53bf67c91f5ba3a9211db0eb01a4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703723, "uuid": "c41dcaec-73d8-4dc9-acfd-f4ae50453d64", "comment": "Malware payload (SnakeKeylogger)", "value": "78d6dba25696148a81cae18d88776ebe94810aa4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703723, "uuid": "c083d2bc-df43-40d8-bff6-3cd92b9e2736", "comment": "Malware payload (SnakeKeylogger)", "value": "20fe14165b23bcae4c230b5b4e23c9f13025b42e3057c24210668ce2984f9d3f6ba3dfd925b6ef13a7b34079031901b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703723, "uuid": "7f3adc2e-0880-48c8-971c-5fc9343a8c4c", "value": "T143055BD5B15098DFEC6B49F2AD2AAC3020937E9D54A4410C559BBB1B7AB3343209FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703723, "uuid": "3715fe55-a1f8-49da-a945-219c58b69a82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703723, "uuid": "a6690716-88ca-4f69-b3ba-d8dd72db1ea2", "value": "12288:8lQp6Z8rEpO5W5iRVTt7ZlieiLMzdDxCLw9dcKdoQUa+RgE1uqp6Q:8lQa0b7Zl8YzKU9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703723, "uuid": "54bec172-8d08-433c-8d2a-2901f65c4a88", "value": 809472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703723, "uuid": "e90eb661-6738-4080-81c2-72e3d29c8dc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703723, "uuid": "c2052297-26be-493c-9db5-fc83085b2861", "value": "FOTO\u011eRAF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "478e009a-d50b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652700496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700496, "uuid": "49c738d2-be41-44cb-ad67-2a891abad8c9", "comment": "Malware payload (SnakeKeylogger)", "value": "0471224cc4fcda950746c7e67dd64c4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700496, "uuid": "2d170ef0-c7a9-4a92-a987-f432936c407d", "comment": "Malware payload (SnakeKeylogger)", "value": "c5ab196b66289c38945da072fa002b9f958d624d2b98384f5b91b02a86fcd169", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700496, "uuid": "958ad2f5-b3d5-47b3-84d5-6dac1922c962", "comment": "Malware payload (SnakeKeylogger)", "value": "19cdfc96900a26dc4730569dd5f5fe7fdf433058", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700496, "uuid": "6d0d7a91-c573-4d94-aaac-1efd9035b6dc", "comment": "Malware payload (SnakeKeylogger)", "value": "55bfe069515516f7d5c9385ecc10fcb66330fe2a6e86d0c941e5b66f803b378b5421d33ef92f02147659f01c433f5c2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700496, "uuid": "a5223a99-6557-4e31-a521-730836958d2f", "value": "T16AC3281D3BF88804EAFE8A7305715121C7B6F8520966CE1E16D1F56A3E7DA808D26FD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700496, "uuid": "9ce14c21-042b-4c86-b137-2d97a8755351", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700496, "uuid": "c090c05d-5b52-4b6c-b0d2-4b605b9b8b14", "value": "1536:Ba4ZERmnV9aSOW8YOk9TBT1xuX3yuzNNICb/6njjHybA5piOWBZ7n0Kclg:Ba4Zxn8Y19TBTruHxaCbCnZwBZ7nbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652700496, "uuid": "ae9a344e-5e38-4bbb-a221-9d3a8d7dfaad", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652700496, "uuid": "9f3b5cb2-7dcd-4372-a55e-330fbd587e00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700496, "uuid": "a99b0048-4965-47ae-a032-15b18ffbbe58", "value": "0471224cc4fcda950746c7e67dd64c4e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eba10e4-d4fa-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1652693206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693206, "uuid": "80423eab-403d-455e-8192-9381f19a626a", "comment": "Malware payload (AveMariaRAT)", "value": "653570b891a8f37e05ef4df4070eb39d", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693206, "uuid": "4b3a9cdb-c58e-4c24-b6ee-d11cfab053d8", "comment": "Malware payload (AveMariaRAT)", "value": "c606a895308ae329768f671e7bcc0e186d57166d59448c792f86e3a803f8bbe9", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693206, "uuid": "61138949-ef8b-4cc7-b901-fbfbd00256b9", "comment": "Malware payload (AveMariaRAT)", "value": "dce306acc7855d97bdead253ccac3f8479305811", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693206, "uuid": "6651afa4-326a-4c31-a727-365f9741bd2f", "comment": "Malware payload (AveMariaRAT)", "value": "732a452f4f29fc1d8fa9d20f7b8272b27ada56a1873fb20564002b6ea6cb8f65a05b614ae70865f0b0b4f302b2d47bae", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693206, "uuid": "389ad5b4-0911-42c7-8931-67f42552fe60", "value": "T14E951910B3A15124F5F767FA66B54694887E3C811F2CE2CF4A850ADECA292F47C347A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693206, "uuid": "579e70c1-6194-4afe-90d4-af586513ec61", "value": "f40b392a15f243aae9f6b24f04047e6e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693206, "uuid": "3157b11a-d26a-42de-9932-4c54c6cfce11", "value": "12288:ed05fRBi1vvXHdJUNoyiiguuJ2glmnGeNCrRcQc/PJcEj2uGn9bunQ7J9D4pa7+o:q1vfHUorlm9NCFcR/PJc4gbunQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652693206, "uuid": "33bd0e76-e72a-4c58-bd7b-fd2dbb90f5db", "value": 2054656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652693206, "uuid": "8fa3bbf3-ca7f-47d0-bf68-d45979583807", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693206, "uuid": "00577bde-4021-41fa-9925-57d9c14bf50c", "value": "US$ 36.043,92.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "047a490a-d51b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652707255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707255, "uuid": "e110548e-d760-43e6-b258-40d8adfcc98b", "comment": "Malware payload", "value": "70c085890f4fc8505ff3dd1fa40aed1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707255, "uuid": "68e0be2e-fc5b-4730-83b8-c68555475bd9", "comment": "Malware payload", "value": "c7132f83b72e3ed03d2a1ca3c0561240843db88232f51d12e6ee5dddb6cd28c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707255, "uuid": "bb7cdfd9-4242-4e99-a0a2-273c3ed0575f", "comment": "Malware payload", "value": "7f6b9e9beb0f7e2c5ae11604cc7082483e4f0e1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707255, "uuid": "451563f8-f23d-4698-9671-529310b123fe", "comment": "Malware payload", "value": "7c5dbf103c921b881e1540ae88a4bd0a1ca4197eef0b57e006a43fa8c91cc37787bf40e477251b23f34ee6ecaab6b921", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707255, "uuid": "6eab981c-e713-4ebf-9cb8-890496b0d3ca", "value": "T10D057CE3629095F3D3774237D96AA6255A317E70AA26680D3BAC3A4C4E331D1EC1DCD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707255, "uuid": "c01aaa58-6d6f-4c97-8bd3-2f3eae759881", "value": "7f1e726bb60db85d5f0226a392c472c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707255, "uuid": "ec67b5f9-cced-4ee3-88f4-59dad61f5398", "value": "12288:GArA/9qa8l9JrFc6mQliFGUzLQhI/OgMbWmuXCd:GcKUl7rFmzkhMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652707255, "uuid": "f6d751fc-34c3-4a02-a02a-5c57e6cc9c80", "value": 852992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652707255, "uuid": "1f8d730a-1d56-4367-8d0a-172bc563c046", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707255, "uuid": "c2b5dc9f-12d0-4e39-af34-ebb7370e6943", "value": "RFQ_DD0676E7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f25aa451-d537-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652719680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719680, "uuid": "31f6a35d-0b33-4a00-964d-bd30a03f49b1", "comment": "Malware payload (Heodo)", "value": "6e1fd1d08ebda66a77a741ea528fc3c3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719680, "uuid": "ea7dff68-195b-4c1d-8064-4a397dcfe7d2", "comment": "Malware payload (Heodo)", "value": "c74d553855375d2cce2dacd7fedef4e69ad63c1f2a0d89139bf0d440e166cb1a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719680, "uuid": "2df750ba-4248-4ed9-8b6a-a573ed25400c", "comment": "Malware payload (Heodo)", "value": "0511376a48efa8dec73c574d53f91258e00775a0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719680, "uuid": "4189b0e5-1a9e-4ea1-bab2-435bcf77ae9a", "comment": "Malware payload (Heodo)", "value": "ac8d8838d9cda897727d78a53f23842873199b24109a7031eb5bddba1d45330639dac9328f3015e33dcc79d1b38302ea", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719680, "uuid": "5b228e32-d1b1-4530-89f6-841703eba2b2", "value": "T1B884C04573A48079EDB79338CC574A47E376B86907B0678F1364436AAF3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719680, "uuid": "b2cba967-830b-4810-9f78-2e5b3d2eee23", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719680, "uuid": "a53c282b-2657-42a4-8021-9e184a9455fa", "value": "6144:EbmRW/X22TR72tKbxGeZkesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/ZpRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652719680, "uuid": "85a445a9-27c0-4973-a499-fb90d27a2423", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652719680, "uuid": "b17336d9-840b-45dc-a1e2-99d47a5d62b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719680, "uuid": "8a652238-d5bc-47c5-8c21-bf897dff0717", "value": "6e1fd1d08ebda66a77a741ea528fc3c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f37b823c-d541-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652723977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723977, "uuid": "320e1490-a9be-430f-bb74-70b1900ed032", "comment": "Malware payload", "value": "814bcb29157948628f76a38e26f457bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723977, "uuid": "51364816-253d-47f9-855e-5b1e6639ce42", "comment": "Malware payload", "value": "c7acc5e2f0aef0ae7e138059bb89aecea9cd757191cc97338368c4e1bfa5f64f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723977, "uuid": "2b1c5ffe-1216-4eb6-bde7-8137a7f4c5ad", "comment": "Malware payload", "value": "f04b86a85a10cbe8bd9c37790b8f45290f6693b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723977, "uuid": "92df22f3-5691-49f0-bf5e-745d174ec4ef", "comment": "Malware payload", "value": "4b3ff55d4c1f7f1fb9c4605b01983ff665177b5f9b39710b6c1e8176824f3342e3ffb6170118274592e3e933ce183be3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723977, "uuid": "9bb6cc95-d698-4a60-90c1-6230dc5d3363", "value": "T1D884C04673A48079EDB79338CC574A47E376B86907B0678F1364436A9F3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723977, "uuid": "37cde4d6-0e9f-4c27-92c3-793a76d63274", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723977, "uuid": "51c98977-f7f6-4432-8fad-4c0fb40610fc", "value": "6144:EbmRW/X22TR72tKbxGePkesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/PpRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652723977, "uuid": "86e00c9d-68ea-4aa4-b705-cb1e0fe144ab", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652723977, "uuid": "142c3dbe-7247-4e94-91f7-63e8f29d0f68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723977, "uuid": "d913d7a6-9418-4619-96f3-a875b1bf1705", "value": "4DGnYNi7lUZ.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb9e94f2-d526-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652712368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652712368, "uuid": "9b86311d-cbea-425d-bee3-8ae63bc16b78", "comment": "Malware payload", "value": "a59d9c4ac4cc0464ea5b22839878a001", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "NYAN CAT", "colour": "#D6F25F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652712368, "uuid": "42f38c52-ed06-4ff2-b386-57806ef6d4a1", "comment": "Malware payload", "value": "c865cd0f5c4b67506704213ac99bd8a3c8d4e4b08ff0e171bb3ded4b23bc465b", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "NYAN CAT", "colour": "#D6F25F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652712368, "uuid": "d6422050-3ed0-461f-83e7-c9f09fcc979b", "comment": "Malware payload", "value": "56dd40c1daf569d62c1affce6ec207d008b8bb97", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "NYAN CAT", "colour": "#D6F25F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652712368, "uuid": "55ac663a-1dcc-4aee-aee6-3163c7843559", "comment": "Malware payload", "value": "82b104e56759ee832bc26b5936989c4257710dd95163ccbffa88e964b50df6e719938417e0ecd508e2f16463b482cf09", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "NYAN CAT", "colour": "#D6F25F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652712368, "uuid": "6bafa210-1d95-4051-b29c-d861278c50b4", "value": "T1C30562CB3AF864213175399FEB2FF9DAC3BFD360B219E39D10940648A5E2A11D8D4562", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652712368, "uuid": "6457f279-70e3-4998-9fe5-dafd7fc97d49", "value": "192:71MMMMMMMMEMGCJdDg7i0TBN0gLNjMMMMMMMMM+MMMMMMMkPv1+MMMMMlIMbMMMo:ZeNX1v1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652712368, "uuid": "7c2c3845-02f5-4fa4-a9b4-ef5253d85c4f", "value": 822130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652712368, "uuid": "640d2a1d-360f-4d2c-a735-db9546e1ef85", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652712368, "uuid": "b4f22cfa-b974-4d7d-864b-341592567b3c", "value": "DETALLES_DE_SU_NOTIFICACION_DE_CASILLERO_VIRTUAL_JUDICIAL.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0738effa-d53e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652722292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722292, "uuid": "cb0af3a3-fb7e-4749-9a81-ba519b7c1646", "comment": "Malware payload (Heodo)", "value": "739143364d533a944b78d07fcf8eedf9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722292, "uuid": "bae044a6-5c07-4db3-806f-4e1a431a4cc8", "comment": "Malware payload (Heodo)", "value": "c89012b07b32732ff130b69d8dabe6aff4c866350b6678df1e3c6cc4233fa38c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722292, "uuid": "407389d3-0a7c-4162-b653-e9d6e7e5cc6d", "comment": "Malware payload (Heodo)", "value": "f6e39205ad29f8cac970a25730089aa86929395e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722292, "uuid": "cf616e35-7de7-4b5d-a274-dc64b7eba961", "comment": "Malware payload (Heodo)", "value": "6c1f5aa13e9b10835f360015e5619a6885dd250d9424b05f37e7506f5e2c45031f77ad422d3804c97caa129013cd8d64", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722292, "uuid": "cd5faf17-9e58-40a6-a447-be055d09cb62", "value": "T11D84C04673A48079EDB79338CC574A47E376B86907B0678F1364436A9F3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722292, "uuid": "c0d8a4d7-a4ac-4212-9a43-05ccbb1e4b6d", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722292, "uuid": "5e88c973-e53b-4c22-bb0d-e7fbce71b809", "value": "6144:EbmRW/X22TR72tKbxGenkesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/npRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652722292, "uuid": "25f88c46-2e9b-45af-8653-c51d1bd05be4", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652722292, "uuid": "5ff0f79e-68b0-4012-b047-94123289343e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722292, "uuid": "f1773a60-b898-41be-aa9d-dad4fbf114ad", "value": "739143364d533a944b78d07fcf8eedf9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fbe7aa7-d4ea-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652686283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652686283, "uuid": "fa57b102-f782-4543-9926-7cf679a7a83a", "comment": "Malware payload (Formbook)", "value": "f9eafc4e73d53aea7afab3f1b161da9e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652686283, "uuid": "458c970b-4f33-4cd6-8238-56962361eb36", "comment": "Malware payload (Formbook)", "value": "c9633d02d0952908ab4e718f6e010e43f6c635817b37f0d90704322bd8efc5c5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652686283, "uuid": "883089cc-59ee-4eb9-8143-31d883f1091c", "comment": "Malware payload (Formbook)", "value": "7dd90607810af8775656fb5370cd50d751beba3c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652686283, "uuid": "a1bad8a2-2684-45cc-b809-68d0363fd78a", "comment": "Malware payload (Formbook)", "value": "686cb6dd08ae39e9061e6b0f5966910bec742cf56c23b6baefd281c8180cac83ba788b5c4bfa677daf927a8cff3bc59e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652686283, "uuid": "a5579bb9-1d87-493d-8798-fd41c5ff35f5", "value": "T1CC2412823E84B648F2BC7138A602DA95B54CFD6C670337A37589B70E2B7DB31151DB61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652686283, "uuid": "c7d661e5-80bc-4636-971a-524c25eba239", "value": "6144:RrjG4qPbiVhDDCF2YRsJu8NUxPq9k7DkPOaXjtux:Rr5de7RuxNUxPKkMy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652686283, "uuid": "a3672766-67a2-496f-815e-37fa1a8a0338", "value": 228904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652686283, "uuid": "97cf6fde-98fa-4d7e-af9e-b500d943e936", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652686283, "uuid": "94db3adc-95ac-40c6-8b95-3269006bbc7e", "value": "TT Application.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e54aca7-d50e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652701796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701796, "uuid": "3e46f4eb-8b88-4c07-80e2-14da3c617959", "comment": "Malware payload", "value": "f648ad9933b2520a21d2bb393cfada50", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701796, "uuid": "39383a0d-95f6-4e11-8c2c-7435b0209fd7", "comment": "Malware payload", "value": "c9fc0bea8ee7fde3f7ca2799a8894a8d5c45cf81c54ee3e6246c592b29cabfc2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701796, "uuid": "c5ef932c-6682-4724-a588-258fb88a7a04", "comment": "Malware payload", "value": "64f72def24d1a39f573ffa2842541f41020b861f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701796, "uuid": "201159b6-e35b-46c9-a365-e73974fe711f", "comment": "Malware payload", "value": "33789ea86b5133e75cdb73503a87c97816725f2ccafe7971380936abb0150a04f27d2b7182cefabeb0a1fc2d8ee88157", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652701796, "uuid": "c3a64d7b-2e21-49b4-be58-766bb1e1345a", "value": "T1FC820C3AF6888ED8C64AD2E4170F3A0440ADFD5853D9D8D29BFCF7706A055AFA70E940", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652701796, "uuid": "0af6989f-6d15-47bd-aba2-db5f3dac7fd4", "value": "384:QmeO3rC0YML7aEqgAoqC0mi6CvcN2uQxK669:QzaR7aVzwCvcwNKp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652701796, "uuid": "9377982b-7b41-4d3b-85bb-7228c49712a6", "value": 17994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652701796, "uuid": "d20738d3-7d1c-4110-9ff5-c40da82dc547", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652701796, "uuid": "bc8f1837-0e67-4f8c-8eaa-f70560544d8b", "value": "pay in receipt.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "952f60ec-d4f8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652692466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692466, "uuid": "f97b529c-88f7-49cf-9eb9-0ba56a52c858", "comment": "Malware payload", "value": "66e88ad4ced53f73b8dbab1ad85344e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692466, "uuid": "ba6298e6-4558-41b4-8b40-1ed0a2402818", "comment": "Malware payload", "value": "ca73d0f17a8920fbf5d43bb4cd3155bc00ad4c1ebb1af7942c51362aaac83b01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692466, "uuid": "7bcabd9a-40bb-42aa-b687-3e297566355b", "comment": "Malware payload", "value": "cf29944726afd523e09ffea25fc9174bbf2ff692", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692466, "uuid": "a7cb9986-4b6b-4598-994d-b2aa26dd7bfc", "comment": "Malware payload", "value": "5efdcfd479eaae98fe1b187339332bf562028bc0e24e18b9e9d172b6b2dc67ac26b75dc45156b81218d1d0892be265ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692466, "uuid": "7d0f3cc4-6385-467b-af09-bf7342eb35ba", "value": "T192C41210F2A0E764D96D4BF4AC3759AA17B97C295A21C61EBDCDB3DF2E323502810A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692466, "uuid": "19b35e56-1d8d-4193-b986-5cba83986e59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692466, "uuid": "09d72911-ecd2-4314-9da9-1bbf857e5a3a", "value": "6144:uAWXqWr+zlCf3Tuwa4P5eYgquGSCGrvuowOsYh5mOeW6wCDZKlbSd+gUfku9q3S:3W9r0F4QldCGruGsWmOeWhfl2UxMu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652692466, "uuid": "2257be17-681b-478b-a442-7d4915964016", "value": 561664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652692466, "uuid": "7ab905c8-74ef-4ba1-afc8-408a67fb3702", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692466, "uuid": "23fa9e0d-08f6-4560-a886-8e937f112151", "value": "ttt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0e650fe-d53c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652721691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652721691, "uuid": "3602b7d1-80c3-4d06-9fa8-79825b50ef5d", "comment": "Malware payload", "value": "7ea17abb7bae548c4411077c0f8ca1e5", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652721691, "uuid": "2aad059f-d001-4b83-992b-e508e2298cf1", "comment": "Malware payload", "value": "ca832e611f3e0b3669949f59c6bd52ab2480027225ef2ff4f665dd6a2ba5eff1", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652721691, "uuid": "388d93bc-2a3e-42bc-8ebf-85281c6e54aa", "comment": "Malware payload", "value": "2011bff332bb716665754979dc6131e3adddaaeb", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652721691, "uuid": "5bb65005-d81f-434e-855a-5c50f418c9f5", "comment": "Malware payload", "value": "ef43cf72cbf24cb99ceda288567b76961e737a833743f1ae81c00243c6bf2f61d35269d32a2b9e27313e14fa85588ad1", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652721691, "uuid": "f732aa37-bc61-45f5-b170-011cd9dca785", "value": "T172C53377E7CEF192D856D8332E8071B2FA0D73C7A079F94B2619E25454ABCD4972B808", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652721691, "uuid": "353f1c60-c336-48c3-b677-eb657486b1d6", "value": "49152:jAkrlAWXzf7dupMfrNFeD4uM+HytLt1gjaCmIBhhB3C8KOAz4z:jZrlAWXzfxuyDfw4uolkjaUBN37+2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652721691, "uuid": "e4b3758d-bae4-40f6-9496-01d4a0831423", "value": 2570031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652721691, "uuid": "c9b698bb-1997-401b-bc75-8c5fbd19c3dc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652721691, "uuid": "b62a5d47-751f-4fec-9cfc-7de8f4e40290", "value": "sana.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34162485-d4ee-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652688008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688008, "uuid": "07ebaab8-59e6-43e1-b7cf-2fb11a470c6f", "comment": "Malware payload (Mirai)", "value": "c1b344826ee68eee1ce267a74e9055b5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688008, "uuid": "1f04b824-6958-4f82-815e-b6d762ff5e89", "comment": "Malware payload (Mirai)", "value": "caa7c6177832908ced818651b73688d0708fd9f415f547bd6b1d5cae5f8ba149", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688008, "uuid": "987df3ad-e5cb-4eda-a1a5-83326717681e", "comment": "Malware payload (Mirai)", "value": "f0e32a6965639218b0fbeeb30be448878f74a151", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688008, "uuid": "30865c06-35cd-40f0-b56c-2b99da437381", "comment": "Malware payload (Mirai)", "value": "383a7db091adf9214cf37ca726910a21e2d88bc5bef6875ae0ea5073acf10bf02b8f6881ce05adb507171f9db97b278b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688008, "uuid": "30a85622-1d37-4bfd-bd97-b5efe9917578", "value": "T13F634AC0A553E8F4DD1607B53077EB374A77F136512AE9C7D3B8A923BC82A41940B29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688008, "uuid": "0bcfd811-ab2c-4387-8cd8-ab858a1140c8", "value": "1536:h4uwwSB8qv117K/Mn9O/Eb/vRkWNZLF/EfNatG4k7ja/+tDzzcS5KfXQE:hBxEV3Db/vRkWNZLF/EVatG46aWRcSAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652688008, "uuid": "b23a13a6-deb5-4c1d-85a8-fa9239637cd3", "value": 70672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652688008, "uuid": "f134d6bc-b3c3-4002-b8d4-f537b7a61005", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688008, "uuid": "8b03758d-3329-4f0f-973c-072e66d4193a", "value": "UnHAnaAW.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57935d77-d50b-11ec-8e58-42010a9c0032", "comment": "Malware payload (MassLogger)", "timestamp": 1652700523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700523, "uuid": "afac30c5-f508-41b3-b228-661912580533", "comment": "Malware payload (MassLogger)", "value": "837cf26221fb384ce6bf2a95b0d74a90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700523, "uuid": "6edb2089-bbf0-414d-96da-4cc0938dae7c", "comment": "Malware payload (MassLogger)", "value": "cab9ea99be713d04dfb08a504ae6cb92ceebca932ae5651f106045a86966bba4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700523, "uuid": "3586e929-2460-4eae-99e3-45c3e3210995", "comment": "Malware payload (MassLogger)", "value": "15b7d6c7ad62399e662b2e44d0aa0a063da8783e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700523, "uuid": "fc6a2d07-5931-48cc-96e2-aa6f85f1195b", "comment": "Malware payload (MassLogger)", "value": "f82da59ffd4831848f4e2719ae72b50de73397a6ce2562fb496fe37bd8aeea86fcf9cbac97fd5aadf17dbbcef32592e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700523, "uuid": "6f220bcb-e243-4ef5-803a-63c2cbc05201", "value": "T1906523504A88BD77E27DC4780E75775243338637CB64E79247223E5A08EA7A395BCC2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700523, "uuid": "9763c5ba-ccc8-40fe-aeb6-a20f73ab2c9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700523, "uuid": "06da68c2-c5d8-4b10-9aff-df3a28874202", "value": "24576:rkwi6vjTa8FyBx+EzEdMubwp/u02J1jGC6UW9B6JvfUYKtftPoHtWr7+:ra67HFQx+HCubc41jL6fos7t1PoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652700523, "uuid": "b2e33e84-fa37-43c5-84eb-bbd28c4ecbab", "value": 1529856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652700523, "uuid": "2a1f1b19-60d6-4de2-a682-ef9dd8cdddc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700523, "uuid": "601f12ae-6bf6-4bdd-8d63-8f80087b01b9", "value": "S09543456789098765TT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40f60f8c-d518-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652706068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706068, "uuid": "638406e8-f4b6-4632-b2bb-51dc2dde94ba", "comment": "Malware payload (Mirai)", "value": "8de1ce92f727b949b22c49161521f3f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706068, "uuid": "ab27b017-fe8a-4a1c-ba12-eddab7c3b807", "comment": "Malware payload (Mirai)", "value": "cb67b6d854f57d99a218ed1eb84b316c1d3470d06cd0f612db0745b49b468a0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706068, "uuid": "bfc73877-ba78-49fe-9e3b-6af04c20cd59", "comment": "Malware payload (Mirai)", "value": "ff9d05f9f339d4b35480d589792dfd26d1404c73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706068, "uuid": "b5f20c5b-78e8-4804-8f4f-dc1444c28f6a", "comment": "Malware payload (Mirai)", "value": "c9c9d05672ba2da0ede6cb24078b8e124c6eb4fad8f54a670e519f9a612bdd11ebcd8677b818aabfc7922b33713d37f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706068, "uuid": "0d67cde3-6ee5-4ea7-8534-4f95116ce4bc", "value": "T1DF63F786BC80AB29D3C01777ED6F109E3300B7D8E1DA3246DC245BA47B8ED6B0D66B55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706068, "uuid": "d9edb86b-edc2-42e7-b92c-7526b424f34a", "value": "1536:ZdNeBbSLXHlqi4fDXHeKUmiIEqh1XfU2/Yy:ZdKbSLXH4jUGhFM2Ay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652706068, "uuid": "69064f01-02cf-4769-92a0-00cd4f003d5a", "value": 67468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652706068, "uuid": "447d8eec-02fc-4363-ba6a-000f13a75c4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706068, "uuid": "a864ab95-7216-4873-bdfa-3ac234567b27", "value": "8de1ce92f727b949b22c49161521f3f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b3f5f9d-d511-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652703186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703186, "uuid": "262118b4-0c13-4d89-b69a-fdcc52716e4a", "comment": "Malware payload", "value": "d399295c5b3014c54fd882b6508553c0", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703186, "uuid": "aa67bee1-11ae-43a8-b327-951f2f0e598a", "comment": "Malware payload", "value": "ccf581faa2deea2293e624c0bb022a1abe5ebfe61db88ddb99421eeee4a17f1d", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703186, "uuid": "7f26ca17-91f4-4685-95b3-4da5d3062749", "comment": "Malware payload", "value": "18c8356284d1e20aede2e4291679814bf9a24891", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703186, "uuid": "c500d8af-acbd-4660-a2ca-2a9aae5d5c1e", "comment": "Malware payload", "value": "8a9929f90f32fd8ae497ebf1d8dfa78b22b26efd232978b42998cbadaf3efee468a6e8a6e5cc2b5c9d267f9a31077867", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703186, "uuid": "b4221d8b-9004-4153-997c-8b2c7d02972f", "value": "T11192F4962574B1E5FBD74E32DCEA91009534DD22D91BE70AE1CAF708583F5606843F3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703186, "uuid": "69d24b33-01e0-4664-924a-d7e9f8d4edfd", "value": "384:UEiaJ77777777777777777777777777U7777777777777777777777777377777/:UoTx2IAj4GxNpUPv6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703186, "uuid": "f7943897-f8aa-4773-8b07-a96efdbaf13d", "value": 20920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703186, "uuid": "84f597f9-6538-4851-89d2-7858b28d0c84", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703186, "uuid": "9a691e28-d171-49b1-bada-7b6c953dc801", "value": "SOA.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76a43778-d52d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652715178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652715178, "uuid": "e9e65bc7-f9d7-416e-a8dc-4c8d143c1478", "comment": "Malware payload", "value": "710c8a1aff30f8c093331cd10d7327ba", "object_relation": "md5", "Tag": [ { "name": "1024", "colour": "#B5C373", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652715178, "uuid": "b0b71d99-c8af-4143-836d-010262b9dfe4", "comment": "Malware payload", "value": "cd08895286c264c42a2d58805f2be766980ee9ed3d922bfe148d641914601aee", "object_relation": "sha256", "Tag": [ { "name": "1024", "colour": "#B5C373", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652715178, "uuid": "59a20a45-bfb8-4303-8575-b894d5e528aa", "comment": "Malware payload", "value": "dda278126f7e05108a1083d2e9d0643410e8a12a", "object_relation": "sha1", "Tag": [ { "name": "1024", "colour": "#B5C373", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652715178, "uuid": "0964ce25-346e-4179-8b40-7a44bb81f8f6", "comment": "Malware payload", "value": "ab6167a4d8123d703e3467ef47ba2407cc6d95f33d8eb1d6c42da7666cfa5f4371a695c5414ed8c24469a6155f7de05f", "object_relation": "sha3-384", "Tag": [ { "name": "1024", "colour": "#B5C373", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652715178, "uuid": "9aeeeabb-edbb-4d84-a08f-0d40e806573e", "value": "T12431086A0BE073FAD1A54C38A4E4A7571BB4582CAE10AB94945E47D61CFB09E3C13F70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652715178, "uuid": "e2c801f8-502e-4fb8-9c9a-f7f81440dce3", "value": "24:VN8CSvUV8L4Rb5QsPWIo62UcSzFTsRBTZWtgz1PoDbGhOeKIktqLzs:78C/8L4Rb5QsPW02UcSzQqez1Po/Gh0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652715178, "uuid": "f65f7970-875c-4c68-891e-8b20c0461398", "value": 1446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652715178, "uuid": "4025b691-613c-4c5b-867a-740c9f607c49", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652715178, "uuid": "37a2a744-3dfc-429f-8eb8-6bd651351389", "value": "LDu_53.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "004c903c-d508-11ec-8e58-42010a9c0032", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1652699088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652699088, "uuid": "189e1dbe-7b7e-4380-8340-6d33c66e60e6", "comment": "Malware payload (YellowCockatoo)", "value": "8444ebef78c58d48dd48fd0bec0a4b5e", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Vespero s. r. o.", "colour": "#ED7836", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652699088, "uuid": "425ed7ec-68c7-4fd5-ad59-a00f88de8830", "comment": "Malware payload (YellowCockatoo)", "value": "cd25e2f75f56b57a53700001ec1e368faa5b42b9db32ba4a8761317b5cfd6921", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Vespero s. r. o.", "colour": "#ED7836", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652699088, "uuid": "d508230d-3845-4995-8890-944d55fa5cb6", "comment": "Malware payload (YellowCockatoo)", "value": "f0a2418b8e00c648e49150bbe1428c37cfe87353", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Vespero s. r. o.", "colour": "#ED7836", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652699088, "uuid": "fa0b71e1-b438-4280-8be4-4764bfb74a9d", "comment": "Malware payload (YellowCockatoo)", "value": "c1497980d1809dea4dc08d6aaca72e5ef166c7ad84c441ca520ff1b109a0b6b26335ea0676e4f89e685e21c58aaeed3a", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Vespero s. r. o.", "colour": "#ED7836", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652699088, "uuid": "f0a9f2b5-8ece-483d-b8bd-ec0c3711d2ab", "value": "T15B95235F98016F58C324D8AF4E8E99243DBB06BF9D91FB13B56AB4439FC08CAB015857", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652699088, "uuid": "eb0043da-878f-4e34-8364-85a76415d3ce", "value": "24576:gNzt94EBpPPzWolxXSJvaFctY/ltcVrMgSr3sqLCFaR+XlF1Qtzrd8G0iK5NvMC/:it94WCgXjv0G13vCFZF14tGiK5NvvDj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652699088, "uuid": "147df8e6-42ed-49ea-a205-59d950e8df72", "value": 1950967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652699088, "uuid": "7a739c0f-1eea-42c7-8a00-0aca1f4e6c60", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652699088, "uuid": "3a26f38b-d7b7-4b72-8853-0206614c384d", "value": "237270198970db6ed7e9e8c5bcc01127431da6ae5c71c01df958b8cc9292232e.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81056362-d509-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652699733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652699733, "uuid": "31598a7f-2d04-49f0-b744-aad88f2ee09e", "comment": "Malware payload (AgentTesla)", "value": "06dcb87bbe9870a849adfb167ff3ab0d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652699733, "uuid": "4f495b15-7b32-4bd7-b245-1c16e150d4b1", "comment": "Malware payload (AgentTesla)", "value": "ce260b263d3e127e5ba639e524279fe23ced619278013c8a740ae7a05cd5a55b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652699733, "uuid": "aff7c687-5e36-4dd7-811b-ff613fa149ce", "comment": "Malware payload (AgentTesla)", "value": "cc04afb803b27d0743e128dd2b76c7d2db34d4ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652699733, "uuid": "09bc08e9-3913-4b19-a1ef-ed857740db36", "comment": "Malware payload (AgentTesla)", "value": "29add8a7131180818fb80b77800c46aa449b31f9784daa2ac87f73021f7656854e12501d9b628164a63ded829fc9dc71", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652699733, "uuid": "092e9c18-2b59-433c-b5eb-d494aaab4121", "value": "T1CA25BF9C725C71DFC857C572CAA85C64E66078BFA71B9207A063259DAD6CB87CF200F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652699733, "uuid": "e69c08e5-5393-4e88-9b83-fa2d22883c9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652699733, "uuid": "300534e2-face-40f4-9286-210ad38ca0ee", "value": "24576:hlu9doF7KFJ/TDJqC9N3TKiGr/gW0Czg6GhTXbvL0C:m9dXJ/TDJ5N3TKiSd7g6iPL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652699733, "uuid": "92aaf72d-a1f4-4dbf-a676-f692f9514cc4", "value": 990720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652699733, "uuid": "2b825792-faf7-4140-b9e7-6fcfcd5a6461", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652699733, "uuid": "1517f62d-c18f-4438-9533-48a5ed28a1a2", "value": "3FRxdKsMLRas0Wg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e6701b3-d4e5-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1652684213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652684213, "uuid": "1746f4ba-ea6c-4d0a-be4d-5ea4152adda3", "comment": "Malware payload (GuLoader)", "value": "bfe26580e8fe1af541b1051eca654fd7", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652684213, "uuid": "2e787c1c-809c-4d91-94fa-f0e7ce143070", "comment": "Malware payload (GuLoader)", "value": "cf5ee6f100de92afd7839af41155f7df2542e8d222870c22c36e3ff2b96737b0", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652684213, "uuid": "5b9f60f7-2337-4ac2-add0-948eb6b8eb9e", "comment": "Malware payload (GuLoader)", "value": "f568a9040655af7f68524d304c8d847eda504ec3", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652684213, "uuid": "e0de34fa-647f-4c88-9403-a39d904eae77", "comment": "Malware payload (GuLoader)", "value": "f2c1d7bad2bb65fe24e65fd4c66e3d0cc0911f483ce975f49932fef1b7243740f79f3e4657a20d935020b9055dbea786", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652684213, "uuid": "23ce4bc1-dc9a-4aac-b08a-dfce9bd2f509", "value": "T1CC34465181B6AFC491F93DDFCB1D4621B3409EA6A2D3F1485BB101BD7FCB2E5432A2A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652684213, "uuid": "0ae9db34-24b8-445c-b8c0-27e68b61256b", "value": "3072:GywmTGOHdqA1V9DgALlUdOatMCX/SFNw7xdBm42:GPAdqA1VhgAL2dftLvS3w7xdBmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652684213, "uuid": "5a730114-fbf5-4ee2-a9f5-4fd47fb12e7e", "value": 236396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652684213, "uuid": "4ecfe3f3-268c-40e1-a05e-edae04c51ef8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652684213, "uuid": "90583365-e9c6-44b4-a149-b2590a8a2f58", "value": "Your_Transport_Plan_Changed-Maersk.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a1b6f72-d4e5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652684313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652684313, "uuid": "1affb65b-6e48-4121-a372-4bd91ea15bd9", "comment": "Malware payload", "value": "8e5caa7572894bce72b31f3e6d3a9e22", "object_relation": "md5", "Tag": [ { "name": "Dynamic", "colour": "#EC48CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652684313, "uuid": "0ad1ca83-ab7f-4d62-acf9-9f326afd1baa", "comment": "Malware payload", "value": "cffaa5ca1acce4973a2ec6db9abefc0c5afb11b2045cfdc4213a7d8bba642a6d", "object_relation": "sha256", "Tag": [ { "name": "Dynamic", "colour": "#EC48CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652684313, "uuid": "e25244a4-64af-45e4-873d-1049f8942e12", "comment": "Malware payload", "value": "808680e6958641614026890a3a586ac59177c87d", "object_relation": "sha1", "Tag": [ { "name": "Dynamic", "colour": "#EC48CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652684313, "uuid": "c080761d-6ad4-4444-ab22-e5d797e6069e", "comment": "Malware payload", "value": "ff469ababb85906952ff92d6a2144746832f8a5d35303b9d13b70daec48778f1863e77955262ea38e314ed988ce90157", "object_relation": "sha3-384", "Tag": [ { "name": "Dynamic", "colour": "#EC48CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652684313, "uuid": "943063e1-92c6-4bea-9939-f312417333b6", "value": "T144D4239F9F91BB2BCAF1D8B7300C55175698ADDFAC342D3A9EA901FE185024B0B3915C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652684313, "uuid": "f7e78a0d-d721-4616-abe2-16c87e29bb28", "value": "12288:xX6RKDtOk7itY21cz64DaI12A5ywSjjtAbzRxYblcNfNbnrSH:00Ql1cvl35yjjORxYJcZl8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652684313, "uuid": "e6e9b7ef-e7ef-4783-a05b-e295bd075678", "value": 621153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652684313, "uuid": "7a7dcab3-0028-4ac0-bcb7-ebc557023d2c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652684313, "uuid": "16722fec-4e18-41aa-a0f9-a01a1bfc4ff3", "value": "DynamicStealer-main.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e2a64c0-d4e1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652682361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682361, "uuid": "dc9c9b81-da3c-4e86-81af-46c6900695c7", "comment": "Malware payload (Loki)", "value": "c557a80afca01273dbf20bffa4dace30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682361, "uuid": "e23dabb5-9766-4a0b-8bba-b4625285eb97", "comment": "Malware payload (Loki)", "value": "d01d91c8a0032b9f4bd1d35c94d5d67f396acd6f54cad98655a64ca80ce967cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682361, "uuid": "1c146aa3-96a3-4fd2-ba5e-4872e461ff55", "comment": "Malware payload (Loki)", "value": "b51bb5914bd0c828de9d6c49506127d22721ceb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682361, "uuid": "bdbe52ba-8f06-4a85-8862-56915641144c", "comment": "Malware payload (Loki)", "value": "a06a434a2b2f66eb2ae3214038ea4588cbf122dba3726ad7e18cd6e829559b14368c6bc93970cb54e6b0c56c26884d44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682361, "uuid": "38694e3b-ea3f-48a2-97ea-cd3a96c20a45", "value": "T1B70401617364C673E8D22B310C63A7638DFB81222574935F97A42EAABD711827E1F353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682361, "uuid": "7c0882b1-3531-46ea-9f87-a8b96dfb2372", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682361, "uuid": "5ec19540-7091-45db-a49a-ba69f8925f04", "value": "3072:LODZGPEounbHtBEkgWxNilh/jKHDfEEnmEDSLzO/TSt59IA8LBLZ4qER0:LOtIOHtBEpWxYlQD8Z8SLS89v8LUqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652682361, "uuid": "8ae4dd2e-e2c4-435d-8dc5-a825d0b26888", "value": 186598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652682361, "uuid": "94aa59f9-2879-4136-801f-094075eaea6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682361, "uuid": "7c546069-5337-4ff9-80f7-a1c5bd6c8121", "value": "c557a80afca01273dbf20bffa4dace30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0af8e7a8-d549-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652727023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652727023, "uuid": "b6424f04-8200-4faf-95c3-0aecac8873ba", "comment": "Malware payload", "value": "ac5e81e1855fa74139eed6e50c578e34", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652727023, "uuid": "a59dd1ee-65a6-4ad4-b397-a820eb9c7d36", "comment": "Malware payload", "value": "d02635cc6130ad49b9b14449e3c1a75d8e1fa808db4c9199704f1f6e70c2b086", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652727023, "uuid": "01140a26-0a58-4d2e-b919-658b7ed35dda", "comment": "Malware payload", "value": "187aa5fde866563cc8a97a462bf7f20de6311a21", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652727023, "uuid": "45e582bc-6025-401c-b8ec-63aab8cb896f", "comment": "Malware payload", "value": "5dd82da334423a63b8d8cec5bde4146baf0957e0a9fdca0e9cbbd2a50bbcf051c6f19cbb09cb7fc679c08057d3d3c668", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652727023, "uuid": "07bec51e-734d-47bd-a43d-0777905a0ec4", "value": "T15B5633EBF1F40D13C41CBC7A6D9ADA20229A5CF5543AB4FCC99EB290801D287A1F95DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652727023, "uuid": "ca412015-531b-4eb9-a828-c50f832eeea5", "value": "4b8ea275b01195301d047f45b8ba14d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652727023, "uuid": "4f06cb56-b577-4f67-a43e-0800a37fcb44", "value": "98304:1cOO644heBIUQMOqNXHO7Y9Qv+X1bTLwbSKmMuustE+0HeCPGr3aZxUPYnuNx/c0:1cvU497Bu86+X1bTEXuustEpHXyaXUQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652727023, "uuid": "6c74ae7c-ccb1-48a3-a526-7662b2596aba", "value": 6196615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652727023, "uuid": "ee4af631-73f1-4b82-94b5-943bb4229d1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652727023, "uuid": "f996f8c0-e6d5-4000-b714-e0665c912d8d", "value": "ac5e81e1855fa74139eed6e50c578e34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3699b482-d505-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652697890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652697890, "uuid": "c7ead0f9-2797-48cf-8830-b9127ffd7d5e", "comment": "Malware payload", "value": "eaacd129ed15e7d00110fb70e08a6a56", "object_relation": "md5", "Tag": [ { "name": "ppsx", "colour": "#84F264", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652697890, "uuid": "0e62205d-632c-47c6-b9f4-30b203a221e9", "comment": "Malware payload", "value": "d06b67bdd21df2acbac54461c572fedc21d876d8c1dd329e1da6ad0648566aad", "object_relation": "sha256", "Tag": [ { "name": "ppsx", "colour": "#84F264", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652697890, "uuid": "d450add4-8a2e-4216-ba43-e4cf1f7d77c9", "comment": "Malware payload", "value": "0f963f955258ad8df4a426c93c73f47fb2bc1f73", "object_relation": "sha1", "Tag": [ { "name": "ppsx", "colour": "#84F264", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652697890, "uuid": "55afca6d-48ac-47e4-8ae6-9a2d7cceb485", "comment": "Malware payload", "value": "2b8e158dc9ad28ddaf69ddee4d122a0d1ba2b52ef02a0ce52308189c8b9ee358d83d3169c3060de7b25c201412b991fd", "object_relation": "sha3-384", "Tag": [ { "name": "ppsx", "colour": "#84F264", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652697890, "uuid": "a2b7df06-94d8-44ad-aad4-489ec09fe628", "value": "T11853D19EE145631BC123557CF83A809DBEA9960431249ACEE5D4B01EC6A9C877F4F3CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652697890, "uuid": "55c14d0c-68dd-4e78-9075-543d167e9b2b", "value": "1536:hgC+k09tmj7ajfq90HQuAMgi7L4lqc9kZVPDMdECxXQqSUCM:OeJ92QuRg1qcKzDrAaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652697890, "uuid": "99d1da83-0481-4630-83e6-bbb6f04ebd25", "value": 63916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652697890, "uuid": "392751d3-f9f2-463b-b14b-d808b36143df", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652697890, "uuid": "1abd41f1-78b1-44eb-89b3-70c7133aefec", "value": "Product Catalogue.ppsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f16a715-d53f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652722815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722815, "uuid": "fd6fd80e-69da-433e-a88b-c9e3b7823045", "comment": "Malware payload (Heodo)", "value": "7e6ad202148ca00984bb26cfb9a1a9cd", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722815, "uuid": "315118dd-c380-46d4-990b-36b15074a4df", "comment": "Malware payload (Heodo)", "value": "d08a0486c96d47b5d8f2f1ee8c1d2ea8f3baa075bc0c52433c84bb7ec2b11735", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722815, "uuid": "f768d76f-cda7-4434-bca9-e47c9df2e732", "comment": "Malware payload (Heodo)", "value": "7606ed5018565a104bbbbf348c2d990e5f24a722", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722815, "uuid": "378d7bdb-b440-4f96-b4be-fba6f480e1b4", "comment": "Malware payload (Heodo)", "value": "86fb2ba612ee79fa98ca8a7b4746b0b5bffd65188473e1f04d30b6ea9667bcfc32d63d6ecf8ffd60b6c3481a14b3586f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722815, "uuid": "31e357c9-d3fc-4841-ad5d-3ecdd326a296", "value": "T1F884C04573A48079EDB79338CC574A47E376B86907B0678F1364436AAF3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722815, "uuid": "e6cc5631-a022-40c0-b5cd-5f61543b6289", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722815, "uuid": "bcbf5067-0014-4592-8566-9925b732b8c4", "value": "6144:EbmRW/X22TR72tKbxGePkesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/PpRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652722815, "uuid": "903c6cfa-8cae-435a-b016-10c0afa2c876", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652722815, "uuid": "2a6072e0-e29e-411e-9069-91094a713478", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722815, "uuid": "7aac77e0-3913-4a8c-b16b-cc7ebe24eed0", "value": "7e6ad202148ca00984bb26cfb9a1a9cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca1639c-d4f0-11ec-8e58-42010a9c0032", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1652689096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689096, "uuid": "d1fdd0c9-47e2-470a-bf54-d4ffc5ca109b", "comment": "Malware payload (ArkeiStealer)", "value": "394ee21faec7774538126ff51555d98d", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689096, "uuid": "123a0c7a-2a2e-4efb-804d-eac361937089", "comment": "Malware payload (ArkeiStealer)", "value": "d0cb66bdd8b44b5d521f339b1892c76991c9542348e57d3a77e2b70ce19279a0", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689096, "uuid": "fca8582f-a8a7-4b0a-9bbc-bd2646d93975", "comment": "Malware payload (ArkeiStealer)", "value": "2ce247aaca91744ce0649cc487675bc268562531", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689096, "uuid": "888bd2a1-6145-4b45-aed6-b5aa9782acc1", "comment": "Malware payload (ArkeiStealer)", "value": "a1714a7252120e1a3675a917efc47cae6fb69b84d58efb489f4d18a95a010d99434bad219bfb2f69c9fce8cefc9d5266", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689096, "uuid": "66788d01-7402-455f-950f-cf1ded13f68a", "value": "T1F7D4BE117340E032C13329369E66A7718ABDB871AC265547F7D42E2EADB42D2DF31B1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689096, "uuid": "db11dd78-e11d-4b68-95c8-1049682f8113", "value": "12288:oseUsxBPDvx6qLDkMkUFp6YtoN+lWjXmTUDz:TeUsxxDvx6qLIMks6YtoN+kyWz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652689096, "uuid": "0cf20f62-e4f1-4e0b-ac18-e55fc708ee25", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652689096, "uuid": "bc8e10dd-4cfb-4f61-b659-7f60794250e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689096, "uuid": "52a27fa0-afdc-4ea6-a99c-59a3407f4ea0", "value": "d0cb66bdd8b44b5d521f339b1892c76991c9542348e57d3a77e2b70ce19279a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5decd2df-d55a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652734464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652734464, "uuid": "9f2e58c9-344b-4852-a318-0678c0c9c686", "comment": "Malware payload", "value": "f7dc4bdc8e7ea6e9a48c954e96cfb1b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652734464, "uuid": "d13a2273-1110-4792-b843-4a52a9b25cfb", "comment": "Malware payload", "value": "d1147789150c321cedaeb78c6c511b2dd88407457c6b27568d708ee2ff871eb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652734464, "uuid": "4b380d16-0acc-4fc1-b62a-755681f889b4", "comment": "Malware payload", "value": "2cf1b25066d307f1c8aec96235ca329fbc637825", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652734464, "uuid": "89fe6f31-de62-4b3a-b08b-98f4a157800d", "comment": "Malware payload", "value": "29595e0be75bbc20aff8e5a7d429a9e6707c4f68943e18c930aa8b28780856ed29a3e63454a29eb6e8cce778fdb9b8dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652734464, "uuid": "79078c1c-bf2b-4372-9395-791354fe667d", "value": "T1CB74C046B3A880B6ED678338CC535647E772B45A4B70A78F13244379EF2F3915A3A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652734464, "uuid": "e9db432f-ddfc-4514-a1f4-3fb2e85c0561", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652734464, "uuid": "cf672bc8-0fa5-4b40-bd9f-9e85f0469523", "value": "6144:Es/2WX22TR72tKbxGe5kr2rlsy+vbEFXYvlx6xJkUjnKd:Es//Gi7/5gDvQFXTH9Kd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652734464, "uuid": "309126a7-ff5e-4c3e-a6bd-cbea1c1b2761", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652734464, "uuid": "ef3e59ea-7668-44a8-8da6-8816a9006d29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652734464, "uuid": "d49bcece-01fc-43cf-8e3d-af025235bf76", "value": "f7dc4bdc8e7ea6e9a48c954e96cfb1b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "180b8bbd-d512-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652703423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703423, "uuid": "8a2d69db-05f3-447d-a324-ffe5643277d4", "comment": "Malware payload", "value": "66ac53b89047a2dd8d5a32b85a35621b", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703423, "uuid": "ec8851de-0d8a-4d9a-828a-9b39f4f2d46b", "comment": "Malware payload", "value": "d166cd6e467f9368d126093150072a14ac61bd082fa5b9d25d6c8c5460580746", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703423, "uuid": "19b72d4e-8b8b-4133-9425-1e83efc82f25", "comment": "Malware payload", "value": "c05f792e80f30d9e3e85780c2ec48ff7e2ad3e09", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703423, "uuid": "2cef8f0f-52a1-436e-b5a6-8a46fb422ae3", "comment": "Malware payload", "value": "95b207a357759b1e7bb7b590e070ce065e969f3921349b711ef20206bf2ba0075cc33cf34a44e405dd56824881654a4d", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703423, "uuid": "08f71bbf-503a-4c06-a62e-0b61af0dd400", "value": "T14A24124F39D9B846C59983719E98EEB70253CFB1860B448B8CC43BEA84F15FD75680B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703423, "uuid": "90219808-8b21-4230-9585-f66905bdddc2", "value": "6144:iAJDsRt7OHCJOAAhDpdlWmkT8N7N96mFuWJRDflY9:iAZsR2eOAmDpHWSZDvFu0RzlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703423, "uuid": "f83503ab-16a9-4bc3-9915-a3f9fc4e2c0a", "value": 227992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703423, "uuid": "592bf78e-fb7f-4cc5-9440-dc4223344962", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703423, "uuid": "18232209-f05c-42f6-96e7-df6a490ef99a", "value": "MGE-PO-2022-056.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52816ccd-d519-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652706527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706527, "uuid": "10ac204c-7e29-4fb3-b0ec-af2961f003a8", "comment": "Malware payload (Loki)", "value": "e95ec4d6653fd04defa43e0503d4314a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706527, "uuid": "eec18ca7-d5a6-465b-860f-899ec94bdc44", "comment": "Malware payload (Loki)", "value": "d1741f7d3bcad64ecf32ff7826e107b80f79fe04e8b9d8c7bba6f6ddf8bf4407", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706527, "uuid": "86762eed-7785-4537-b908-35a554eee6b2", "comment": "Malware payload (Loki)", "value": "cbaf75ea7736a5ef1f08ac5952e2a627920c4b54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706527, "uuid": "ed1434ea-9a33-4b96-a875-f992c3989a1b", "comment": "Malware payload (Loki)", "value": "158326e10893593789f42a46f1b2fbd7a490386d324a02e07b82cd7377d68287e8aaa44850bef87281933e32b83fc68c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706527, "uuid": "4b207d75-e193-4387-9fbe-abe5eb3cea95", "value": "T18E0402406691E42BDA72BBB34D6A7B971BFFC46629E4C20F1F512A9C7C36341D60E324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706527, "uuid": "f118d244-099f-4324-98e6-558ce7d652b2", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706527, "uuid": "c89e1a78-b80c-4e20-bcc4-af7dcf1ba10f", "value": "3072:LODZGPEounbrbpOpuDCKgTVcKkkf19OQSSEHacL9D0odoTNDt8ZHR4abLzOJYQNU:LOtIOHpOfVcBkff1F3i+odER+H+kP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652706527, "uuid": "44a57014-f236-4129-9e9d-82d129ab4c40", "value": 186697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652706527, "uuid": "82bc0111-ddb7-40e4-90cf-688dde7530da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706527, "uuid": "ba56e6db-54c3-4872-b941-4d5cf46fe63d", "value": "e95ec4d6653fd04defa43e0503d4314a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e7c143a-d55f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652736693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652736693, "uuid": "56d60183-caa6-408d-a6b1-16d28308536a", "comment": "Malware payload", "value": "057e79acc279e2e32509355bf1297a50", "object_relation": "md5", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652736693, "uuid": "af1b9c82-7984-4479-99f2-815e0574048e", "comment": "Malware payload", "value": "d1b71af0f409d55636d9ad69f36506b3310a3035c1c1ad9a1e2699dd2093d9de", "object_relation": "sha256", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652736693, "uuid": "4842e7a4-6c6e-4642-a3cd-8972f6b01454", "comment": "Malware payload", "value": "59cdc88dd483df3ddd7fddf676ac107557fe7f80", "object_relation": "sha1", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652736693, "uuid": "763f3aff-bffe-4c70-abc0-42cb1a4d0c1c", "comment": "Malware payload", "value": "a40980576f73272c6528c469b84e054cffe63bde59561a4db04ce21617cb5a5c7da21f423dcbba6d2c9bac23081eac4a", "object_relation": "sha3-384", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652736693, "uuid": "ee60ea30-63bf-4581-93a8-0abe8f4a4a8d", "value": "T19295C03BF268A53EC45A1B3245B39350997BBA60B81A8C1F07FC384DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652736693, "uuid": "5d00eca4-a358-406f-97ce-cff8441db314", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652736693, "uuid": "a1d38d80-9af9-4be0-baa9-40c5f97cc26c", "value": "24576:+4nXubIQGyxbPV0db26WIJVEupsv1Et9uGpckT52zedlq89Ws5uIzk5aM/phdON:+qe3f6GdSffPMWrQ0Zk8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652736693, "uuid": "42d288ab-b8d3-4d1b-be49-0f653a2c2cfe", "value": 1934688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652736693, "uuid": "47c92cdb-a818-4210-a948-7a06198a09b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652736693, "uuid": "bb4c740f-01c0-4175-963d-2478031dad3e", "value": "VkDJ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c6bea00-d4ec-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652687270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687270, "uuid": "ae02cc82-f0a6-4235-94f7-8e7bd06da8b4", "comment": "Malware payload (Mirai)", "value": "fc6b35f09b34f03474a4b09ef9ba8884", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687270, "uuid": "80851938-9b62-47a6-9b12-21e5e1b9ea3e", "comment": "Malware payload (Mirai)", "value": "d250597b79f7f596f5c088535d4f8b38ac6c8e76d27b474af359d33d943c1a95", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687270, "uuid": "18ea8e57-70e8-4e57-9c78-e23298f15cd4", "comment": "Malware payload (Mirai)", "value": "d63ad534d00580ca811411e0bfc31d176a3a9cf9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652687270, "uuid": "c3392c45-0f69-4706-bc8d-8b255c779848", "comment": "Malware payload (Mirai)", "value": "3962596af9d44f3bbda0e72f380dd92036e83aa42faf62077a592d1c88df60ba0511baf6752099ce25ca23afb413c5f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687270, "uuid": "22ac5cc0-0117-4f82-a0f7-c3b889fdba20", "value": "T101434BCBB412AD7CF99BE67E80230D0DB9307261505307277BA7FC93BD322689956E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687270, "uuid": "08485145-66d0-4145-a649-aa31dec7a30b", "value": "768:xj2eFZgNesrlBVYlJVqKO9xQQnOkgFHPi6jkuY2yUCSAiTq5ouvZm88a7:x6u5oQOCFPi6jtY2fAiTqSuv48b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652687270, "uuid": "e7edb8ec-d437-4660-a278-a6e4024964d9", "value": 55212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652687270, "uuid": "e7ea0f09-3c87-48d4-886b-e02c9be91c4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652687270, "uuid": "5156b385-e388-49b1-a526-bb9aa83728eb", "value": "fc6b35f09b34f03474a4b09ef9ba8884", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9977bfda-d531-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1652716954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716954, "uuid": "b6973e5e-760c-41fe-92e2-67b47ddc9574", "comment": "Malware payload (Quakbot)", "value": "6260bbdb6c1f5d1d33557470bcabf8de", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716954, "uuid": "86bac8d9-d81d-4bfd-9ec4-772878caf55f", "comment": "Malware payload (Quakbot)", "value": "d2c969098c9a689728a5f5ac942fa4f75c88738d0367d471276ac4c470504ded", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716954, "uuid": "ababf823-3ead-487d-9bd6-16b3d3b959a2", "comment": "Malware payload (Quakbot)", "value": "560d6294f3e965006636e5730c65b438ac1be82b", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716954, "uuid": "68384b9a-01f0-4d23-85a7-6dca51b2d036", "comment": "Malware payload (Quakbot)", "value": "392cda9e9a164973c44fb6b71d4ccca4ba34734bd7c3dd955c077b088bfa178014765b7bc270116be85591f8063f336c", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716954, "uuid": "7ce2ed73-9c33-4142-897b-108b6b4b7d7d", "value": "T12EF4AF22E3D04C77C1772A789C2B7768A839BE112D7899C72BE42D4C4F3568136362B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716954, "uuid": "b0f481d5-a230-4414-8343-5e488fa9f13b", "value": "df2c97204ed982b8b3e7393fd2a71059", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716954, "uuid": "cffd2edf-401d-4226-8926-3b0b316344aa", "value": "12288:LD25c7bMl3XyN6VqX1bFJf44pnlG2LniEE2DY04zyHHsPNasifQu8z:H8Aw3CowXrJf44pnw2Ln1RY04uHHsPNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652716954, "uuid": "d0580dbc-5dbd-4738-9ad7-db498eb5c32d", "value": 737824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652716954, "uuid": "2bead1fa-334c-452b-a7b2-b808b34d4e9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716954, "uuid": "ee7a46bf-7719-4d71-80ea-a87954ace6b8", "value": "d2c969098c9a689728a5f5ac942fa4f75c88738d0367d471276ac4c470504ded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec37da3-d4e0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652682147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682147, "uuid": "0e45a016-f1c9-466e-bafe-a1299bd5003a", "comment": "Malware payload (Mirai)", "value": "697aca95a981672a521716a128bc8fc2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682147, "uuid": "a6670f60-da81-438e-a26a-b88d9ab62860", "comment": "Malware payload (Mirai)", "value": "d327ac9b40c5803ac81272389d98490f062ef0a5ebeed56b6cf76aac346dc302", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682147, "uuid": "dba0aedb-21bd-42b3-a484-eea35f4ca895", "comment": "Malware payload (Mirai)", "value": "072b1cd7d936a9cf80618c752aed67bcf09a4130", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682147, "uuid": "e2e6e525-52ef-4da9-9a92-ad4e8da615bf", "comment": "Malware payload (Mirai)", "value": "4cc5b489f54f02129b2c1aa4d6a165ebadb8be9d9283411f497954758e84648b2b739df2965a7d3bf9197c71ebab6c2d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682147, "uuid": "6ca04ca7-42ca-46ad-b96c-e1565c516cce", "value": "T1D2835B98F8128D7DF98BD5B941294E08AD3163D11F931F27A6A7FCE33D721A8B902D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682147, "uuid": "29fd85de-97bc-455a-9142-b845362471bb", "value": "1536:cXbc/JbENkI0/h27lCmg1pdYXfNh0q8VUAyUBvDPLhcV0W:NpENkI0ECfpoapZLdcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652682147, "uuid": "b13bec4a-e31f-4b4d-bd9b-1963d23a3d5b", "value": 85720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652682147, "uuid": "69814a38-c4d7-4e7e-bfdb-d681d46a2804", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682147, "uuid": "a40680d1-a9e7-48ba-a0ce-a6c8d4bc68da", "value": "697aca95a981672a521716a128bc8fc2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bda291b-d50b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652700557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700557, "uuid": "b34f0a06-3ace-4e22-9698-933bf6134a49", "comment": "Malware payload (SnakeKeylogger)", "value": "88f6e73ed0c9513eba2fc37ddfe407b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700557, "uuid": "59d9ff69-dc28-4eb2-9d10-56ce4e53bb1a", "comment": "Malware payload (SnakeKeylogger)", "value": "d334e8c36cd03e4e61082683a206bf54f91273816f0d4d6aec4764b26ae13d2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700557, "uuid": "fdd61eda-487a-46ef-bd84-7b100d20e4ba", "comment": "Malware payload (SnakeKeylogger)", "value": "978a722543e6ffeb7de91da74c9104cac705919c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700557, "uuid": "9d15918a-913b-4624-94a1-0f33d5a6f8f9", "comment": "Malware payload (SnakeKeylogger)", "value": "c77987d45614459308c63c463c9ced3ce03e7976473ae442f3ca0eedd4645b474ea7aa2a08bb94dafbed1b5aa90b191a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700557, "uuid": "920f86da-ce56-436a-bda6-0a1a3b33fd5f", "value": "T135059E22A2C8E75DDE2A72F2EE5D4C722297BCD9404186A6D17A37B64572317CC13B0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700557, "uuid": "16984e7a-b2fd-4ce7-bce3-ccd708e6ca8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700557, "uuid": "0bcc2626-dfce-4756-8cad-7fddeff73a03", "value": "24576:de0LKAC+6OKpLeoP0MAfkxsBwoyGKnzRLsHKAC+6OKpLeoP0MAfkxsBwoyGKnzRs:o0LKAC+6OKpLeoP0MAfkxsBwoyGKnzRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652700557, "uuid": "c44d439e-f153-4f7a-97e1-2002e27f0af7", "value": 843264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652700557, "uuid": "42a858b5-df6a-4021-90e5-453fd63c55dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700557, "uuid": "7667bb99-299c-4506-b284-5c153b4253ca", "value": "PO-HKG-SVO-696-1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff57d2d2-d53d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652722279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722279, "uuid": "a801abbd-121e-4f57-9ccf-705673f04139", "comment": "Malware payload (Heodo)", "value": "3e97ae5ddd906007391d600a54ed995c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722279, "uuid": "d6c63059-ce70-482f-a2d1-3b6fd463efff", "comment": "Malware payload (Heodo)", "value": "d339468c3c811abd09a1e9597f0b9bc57510b5ece0e7698805b6f63d7d26d664", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722279, "uuid": "ac3df81c-49fa-4d0c-85dc-c96a31cdc46d", "comment": "Malware payload (Heodo)", "value": "caec933253a7f6197646f5d92702a4e4b8440020", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652722279, "uuid": "3ba1a90f-fcb3-4c47-bd5b-466d0827155f", "comment": "Malware payload (Heodo)", "value": "bb479eebf6523449f301fe31209a12743dc49e10c4ce537286386c344053ce6e286ace9057b89974f66c43bf81d17796", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722279, "uuid": "fab2532f-668d-49fa-9894-62cdc674ab3f", "value": "T1B574C046B3A840BAED678338CC535647E772B45A4B70A78F13244379EF2F3915A3A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722279, "uuid": "5509b649-0d3a-439f-9c9d-21821656be30", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722279, "uuid": "6b83d649-83db-4670-adbb-32c986687b77", "value": "6144:Es/2WX22TR72tKbxGeskr2rlsy+vbEFXYvlx6xJkUjnKd:Es//Gi7/sgDvQFXTH9Kd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652722279, "uuid": "c1257fa0-7758-4f49-ab5a-da71b08d018e", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652722279, "uuid": "4252b73f-52cd-4a14-b772-fc6475de40a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652722279, "uuid": "b55b639f-5c32-471f-a5d0-b9c5916a7eb4", "value": "3e97ae5ddd906007391d600a54ed995c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40586824-d4ea-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652686310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652686310, "uuid": "70aa45d8-7e78-4b30-bb1f-76256cf90136", "comment": "Malware payload (Formbook)", "value": "8d029635a4f762477a76d25a34db50b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652686310, "uuid": "63b4bd14-f583-42f3-bb93-e722ad8c0e4f", "comment": "Malware payload (Formbook)", "value": "d362ffedbe12ba120a2e09612b7035b01289cc7a4942b53e093ee669c769b7cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652686310, "uuid": "5fb76e7f-c3f8-4d9a-820e-0e21af9d236a", "comment": "Malware payload (Formbook)", "value": "b2af879f39960d894b37d28b85e5b0a259407c2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652686310, "uuid": "6a28c484-6441-497d-b26c-ab0a9109f44b", "comment": "Malware payload (Formbook)", "value": "7cba347e21ea0c13ad134b8fa2e10416b4620dd17f4a28c69ccdba83eb25c5205b208d9a413a4b283a090ac96fc50c2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652686310, "uuid": "a2e349fb-d4cc-40e2-b610-0b4785358d03", "value": "T10B441240769CD1A7E9722B331EBB7B27AFFED82B546891970340344A3DA1582DB2F744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652686310, "uuid": "2f115036-d147-411d-afba-a8cd7398c6e5", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652686310, "uuid": "13665332-8b83-4da6-a01d-f390e0ddb91a", "value": "6144:LOtIO43jvuHcGUQkiQOfvavKJmSCi/JjKxUylRbXmA:LOL2uHHUovavKMS5JGzHTv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652686310, "uuid": "2057cc19-3755-4063-bdb5-4c547530c4b2", "value": 255941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652686310, "uuid": "4db079f9-62b8-4b99-b542-748ebe90e4bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652686310, "uuid": "96871780-0911-454b-83f8-4bbc6b47b008", "value": "SOFT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f5b5998-d519-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652706495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706495, "uuid": "78e595f5-5ef5-42bb-b816-61f399510b91", "comment": "Malware payload (Mirai)", "value": "e4582ba949c61fc1dd08c163ccaa3ca4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706495, "uuid": "b09602c9-e774-473e-b0c4-3c52738882fb", "comment": "Malware payload (Mirai)", "value": "d569da73baedc13d1dbd985b52e236242f7ab3689bf65a8cc205c4b130824898", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706495, "uuid": "408dfae1-83b8-4617-a1bd-025427d66ede", "comment": "Malware payload (Mirai)", "value": "043cbeb46f9ee53020b7682120f9d787fa6cd0e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706495, "uuid": "875c3446-6882-463a-81ca-cc9dff240e65", "comment": "Malware payload (Mirai)", "value": "1b1f3dd0c52436e5cd741af35bb293f0ad929a328f04505c9aaf62566a90f0af8034b430e195d66c1caa7ee8cadc54f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706495, "uuid": "f2101f89-c7da-4c47-8636-13402884d4f8", "value": "T1B0633B99B4019FBCF94BD9FA81250A0EF52262009F530F27BA27FE933E62095DD43D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706495, "uuid": "98e1cf2b-a649-46c2-92af-e7261b493001", "value": "1536:zgoKXqcEmDqMLFJQtfMwHl7Q1QLBtXb18lv4:zjcESqMLn2MwF80trev4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652706495, "uuid": "da7747ba-148d-4bba-83a0-d2fbf7d4fcfc", "value": 72628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652706495, "uuid": "08646f5c-b596-4336-a56f-981c57c03cdf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706495, "uuid": "9942dd72-6653-485a-954f-13caa6f5942a", "value": "e4582ba949c61fc1dd08c163ccaa3ca4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc3726b4-d52f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652716180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716180, "uuid": "88e0e243-8421-44ca-a97e-af9fb358c1e8", "comment": "Malware payload (Heodo)", "value": "7f579650f7a358abf3bef659a17622da", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716180, "uuid": "37d9ada7-7264-4d85-ac07-604a1119de0e", "comment": "Malware payload (Heodo)", "value": "d576c714a3607a9e24e763f5790c309c9a30f24e580f2752fc7c28c1fc001378", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716180, "uuid": "cc0bafca-5e22-46e0-a63c-a8b8c731724f", "comment": "Malware payload (Heodo)", "value": "7dd642af4154fd4aed93122a5341faeb30969c89", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716180, "uuid": "8016c963-c6da-4e8d-ae74-0c7bfda43967", "comment": "Malware payload (Heodo)", "value": "209a2e6c6c93f7606dc1f24a9b8c850364bb962a8eb3109d31c1330a151224ad5825d59b163c576a544cc983c5d3cf42", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716180, "uuid": "f352a8c5-f162-448a-ac7b-02d191c9457c", "value": "T1CF734A4AB98AC96CE615C739499743A9B313FC114FAB078B3109F3727FF49A05A0761B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716180, "uuid": "6e9b3e85-7bf4-451a-bba5-bd433f41b205", "value": "1536:tpKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg5AezwrMCtvJecvRtbTNFo:zKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652716180, "uuid": "a5357dbb-13f4-4195-9e43-4f3fffd689d3", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652716180, "uuid": "2d20ec68-b37a-41b0-8787-97f7909e9b7d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716180, "uuid": "513ca679-b8d9-4591-b84d-9620a1de615b", "value": "Mail-5442564.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee6c2af-d55b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652734814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652734814, "uuid": "5b12c630-68c3-4ab8-a230-3834edecdd66", "comment": "Malware payload", "value": "aa9ee1ccf7114278331c4053d8905109", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652734814, "uuid": "3d3dcac7-ddbb-4e4d-bc87-be402d6a1476", "comment": "Malware payload", "value": "d60363528fb8dc12b25966ce87beaafc85e06f3b11a12f4094c0afbb27018b05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652734814, "uuid": "d2444518-2d21-47ab-b275-fd3150852f17", "comment": "Malware payload", "value": "0694b9cd735ce023e9ca696ff3bb1a75b974f715", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652734814, "uuid": "8ab7d250-c7bd-437b-943c-7d15f807dff0", "comment": "Malware payload", "value": "3a8b71b5ef531abe948026a6236aecbbe04972599bb8361802857ccf3114797cce2fdcecfac87edd43dc852134b0cea3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652734814, "uuid": "4cade6d4-ca4b-4eda-b4d0-7ded48b89bfe", "value": "T10474C046B3A840BAED678338CC535647E772B45A4B70A78F13244379EF2F3915A3A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652734814, "uuid": "a1cc61af-ece2-4d22-9707-78fccd778723", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652734814, "uuid": "c9b7a677-774c-43ff-bd36-0f8ba0a36e89", "value": "6144:Es/2WX22TR72tKbxGedkr2rlsy+vbEFXYvlx6xJkUjnKd:Es//Gi7/dgDvQFXTH9Kd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652734814, "uuid": "64fb2983-19a4-41c5-8f74-8fb65571fef7", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652734814, "uuid": "7647e823-d98d-4939-8c91-4018d4002a73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652734814, "uuid": "afb5ef98-9cdb-4e16-bb93-511bd63d5478", "value": "aa9ee1ccf7114278331c4053d8905109", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8768ec2-d511-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652703262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703262, "uuid": "3ab62848-5a31-451d-bbb3-bee1a6622351", "comment": "Malware payload", "value": "6b1a57ca776ebc30d4e52a85b1ed6be0", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703262, "uuid": "b5790be9-ea7a-4103-b470-2cb19c7abe34", "comment": "Malware payload", "value": "d64dbffa45e8de8cbe5d5815a1ac60a02b7979b5fa202d754dc91e1959e3439a", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703262, "uuid": "d551f4d0-56c3-4843-b9c6-ef7c476f5e24", "comment": "Malware payload", "value": "f2c7651cda7ebe9428d03b8cf84a97a62da24451", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703262, "uuid": "cbf0346e-9f3b-4f08-9b6e-2913adb89daf", "comment": "Malware payload", "value": "3ba147c3f359a30514d1dfd7eb5f806fea08ab1b92377006fc9365f11a44e7c53dc174b2ccd57657421397108542fe0d", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703262, "uuid": "e63fc0e4-63ca-4599-a09b-be28913ec438", "value": "T1452412993E8CE1C4D4798A354DE98EF66764CC9A6471408B88D63EAD253393F3D6C332", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703262, "uuid": "8ed17738-63a3-4d57-a4be-0b1e644b95af", "value": "6144:SSd1fR/h3q/3rzXkWPrLrC/a+3NPrGIDl/G4sfdts:ZZ53qPrz06LrC/a+5aIDl/kFts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703262, "uuid": "a22f4ae6-6dfb-47b1-9e90-77e4353ea693", "value": 229256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703262, "uuid": "2d0968ff-0b7d-4adf-8a52-4a362e94ddb8", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703262, "uuid": "4964cbc7-2a99-43d9-a241-c77827b5547a", "value": "comanda.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d8a8c4-d561-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652737457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652737457, "uuid": "639f5c5f-ce7f-443f-9d27-478d3877450c", "comment": "Malware payload", "value": "33a273b8e30992f9f586c5df3f2f1d9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652737457, "uuid": "569ffda1-f5e4-46a4-8f55-ef228f9fc46b", "comment": "Malware payload", "value": "d6c477ff50dbfc2adc474850fa7ddec085d82147440cd77a880cfe2ad5918b81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652737457, "uuid": "5d3d3ef1-4bdf-4628-983e-c5d41b92dc04", "comment": "Malware payload", "value": "de423b1be17b0b696bcfd73e98116c2b626589a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652737457, "uuid": "fa933b8a-85e0-4c03-b987-aff3738b1af4", "comment": "Malware payload", "value": "30ef55e05e48df77d19cdaeb7f12b5b0f91dfbc0564dc39c48512288dd7c87a5470d144c7d1ac07bd2b7d07b041a9c06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652737457, "uuid": "78882673-1ab1-475c-8599-02f318d72867", "value": "T14F84C04673A48079EDB79338CC574A47E376B86907B0678F1364436A9F3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652737457, "uuid": "bc01987d-b155-4a7b-9101-2ab0b3eada86", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652737457, "uuid": "4bd56488-6e9e-465e-a1c9-30d996f5161c", "value": "6144:EbmRW/X22TR72tKbxGehkesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/hpRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652737457, "uuid": "883403f6-4b27-4ba0-898b-ce698d23fa38", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652737457, "uuid": "9579839a-9379-40c3-9588-0f5df08cb0a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652737457, "uuid": "57492033-34f1-46b7-b690-40188cc0f717", "value": "33a273b8e30992f9f586c5df3f2f1d9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4938fc98-d4e0-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652682030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682030, "uuid": "165ab588-02d8-4dfd-922c-7c27f4f662d8", "comment": "Malware payload (RedLineStealer)", "value": "7594d62b7df60baf29174f5ab53f056f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682030, "uuid": "639a5b20-781a-47ad-b105-221c42d72eb6", "comment": "Malware payload (RedLineStealer)", "value": "d75bff3d5da17db5512227b564aa4e1b76a7471cdc7b847c05bcd5c6f862b35b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682030, "uuid": "5fa31b05-3b5a-4e5d-a88a-0bd4f9076b0a", "comment": "Malware payload (RedLineStealer)", "value": "c50a7c2e8b768352b56815884259f75e77a0fd67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682030, "uuid": "ac1059c9-5aa9-4792-8125-6726acbef6be", "comment": "Malware payload (RedLineStealer)", "value": "894204df6d538be1a12967bd95e586d04e0cdfdc672cb2b52f59949964d30a8249109d8e55148c94ab8630bede51cd51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682030, "uuid": "debad44c-4a30-4f82-9732-bd5dc92311a5", "value": "T10A74F122BB91D030D49619344478E7765EBE74B26BB4C48F27642FEE1D707C09BBA389", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682030, "uuid": "953f44a0-ce88-4198-9805-33d8e37afad9", "value": "26059d8256cec7c44798a1a80fd59686", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682030, "uuid": "7ec71ae0-9e5c-4a75-a75b-76eccf292dca", "value": "3072:YNeomfbuJvdXUWFGeWahhrlEa+RqYLtiZ8jvXeM4xwrbmkIOZajXgcf+bEhRv6D/:R8JvdXUwGXah8R+2j/eVxQ/B2Yyafn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652682030, "uuid": "08ac03d9-9485-4e67-9d14-e674da3f420b", "value": 355328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652682030, "uuid": "bc103709-dc1d-4ad2-a4ac-24ca7ba4a631", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682030, "uuid": "f2b92092-9bee-479b-ab15-af696aee412a", "value": "7594d62b7df60baf29174f5ab53f056f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51186da4-d4fe-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652694928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652694928, "uuid": "47610ed5-22f9-4a1a-b1ea-2c49ba6080dc", "comment": "Malware payload", "value": "8bbf1678397838a17becad17433989ed", "object_relation": "md5", "Tag": [ { "name": "pw cm2FrCxH", "colour": "#3ED7F3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652694928, "uuid": "d315c1cb-2943-4616-8291-112e66eadad3", "comment": "Malware payload", "value": "d81994b0a490c2a520ec68342a9b79c455a2fdb42ad598f10be9188bea88b000", "object_relation": "sha256", "Tag": [ { "name": "pw cm2FrCxH", "colour": "#3ED7F3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652694928, "uuid": "6211534c-fe63-4fe9-9126-ea8326c1952e", "comment": "Malware payload", "value": "25fe305836141df46abd7c9ba5ede38d4dd9c765", "object_relation": "sha1", "Tag": [ { "name": "pw cm2FrCxH", "colour": "#3ED7F3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652694928, "uuid": "b402500b-35e5-4b3c-be7b-f3454777efad", "comment": "Malware payload", "value": "11f890263ee5a95004a882d841533929f8bb3cc25fd934fcd237d4e4ddc9d4f82c5a70f56d140a63aaf0b2c4982b3ee6", "object_relation": "sha3-384", "Tag": [ { "name": "pw cm2FrCxH", "colour": "#3ED7F3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652694928, "uuid": "b46a4f70-4a63-4ddd-a094-8a22a491014f", "value": "T11D31B5425B6C8B0CEE4B3CB4063565FE6E961B6B5918F69F854A34126423796D4C0446", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652694928, "uuid": "7fc66064-9eb4-466b-a672-4883bb2c5bdf", "value": "24:H/PGQYKwgbqjv+bSKBDDWjZd20xbfV0HN5eJhwgVhvM86K0gvx3yCeishqbXdZMR:H/+QPbqjv+bSFbitYjnr6KzeuA24yv2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652694928, "uuid": "076ef59e-b904-494d-a467-f14f61bd2ef6", "value": 1544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652694928, "uuid": "d5b10cf9-9597-44da-b497-f000b1346bc5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652694928, "uuid": "31285381-8240-46e9-abd1-c7f520721d7c", "value": "Fattura n. 8139557 del 16.05.2022.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4ec9d22-d4f4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652690881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690881, "uuid": "57f501a6-3ac5-4542-8846-47b56a407ac8", "comment": "Malware payload (Mirai)", "value": "15d6bcfea958678d7f1ca539fe812a91", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690881, "uuid": "11cb55ed-ac4f-44bb-8cce-eed985717e50", "comment": "Malware payload (Mirai)", "value": "d89589fbebd47c14ad8274db3eeac8fce88254fe741de2b78686745ffbd6a08f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690881, "uuid": "39735437-2575-4b9e-b212-2ed2b18f435f", "comment": "Malware payload (Mirai)", "value": "4d07658cd2d67d9eaa5a5fb8012fc51f12aa59d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690881, "uuid": "e9d3cbc9-305e-4881-9446-19e4375e5b56", "comment": "Malware payload (Mirai)", "value": "537772ce483d191b4c16fc843cbdc21af4c7bf5f9bd49ae00246ef27b4466f86445932dc4a8c768fd89f7c5def635fb5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690881, "uuid": "49f2be60-dff1-42e9-9055-11faeb9dc7b2", "value": "T12D93E896B8C28E15C5D423BBF92E00CD331667A8E2DF72129D106F2477CA92F0E7B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690881, "uuid": "af7dda4b-1424-4743-9153-cf272d1f3a74", "value": "1536:lwNn21vn1P0YAvT7C+P7V2o6Ahb0rkHP8UijOXrw6M1axkwU856//5XFYcpITigC:lFP1sYu7JPZ2oP0r+0UijObXMMBHWECP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652690881, "uuid": "6ad4f93a-f4ee-4eab-89d5-c75cceb89b81", "value": 91440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652690881, "uuid": "71cc0561-df8c-4224-91e3-32ad40f83581", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690881, "uuid": "5fc2f43f-5bf3-4b30-a3e8-227f698323f9", "value": "15d6bcfea958678d7f1ca539fe812a91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de90296-d50b-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1652700587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700587, "uuid": "58e43c90-9415-421b-9fe2-4dc7fa3e6da7", "comment": "Malware payload (SnakeKeylogger)", "value": "58aa6bea2d317dcd318339f05591e5fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700587, "uuid": "cdaf58fc-464e-4080-85ba-72177819621d", "comment": "Malware payload (SnakeKeylogger)", "value": "d8a66c6a7bd51593120a4172cd5875b300be2fe03ea23dd0689a3f143f0465bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700587, "uuid": "25fb745b-06fd-4bcd-a09c-cb954553eeca", "comment": "Malware payload (SnakeKeylogger)", "value": "ec30aa67161f7a7830943bf23fb3872f9d648b97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652700587, "uuid": "e9dc2946-fc0f-40c1-9c6e-890fa766280a", "comment": "Malware payload (SnakeKeylogger)", "value": "621547ae8a49f3e9cf5fa5df80ba711a15680181f8ad652174df3749606d6d836251a1bc02186ee5549b0d46148d646f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700587, "uuid": "4906576f-4735-4d77-9f3b-e45a9dd5f94c", "value": "T11264BE4073AC6F17EA7F97F55821608187F7A96F6721E3941EC360EB11A1FC086A0E67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700587, "uuid": "bdc083ed-707b-4f3b-b2ce-2155a6ac4bf6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700587, "uuid": "8f77e4ba-896d-4e9e-aa6f-1b9b291c2cd2", "value": "6144:+KYG+H3dY9lSSxmJpSs88qF9Ym7c1K+BmJEI86XdgzzYkURrUUPX:+KYGKqSSScseumGKGI86Xdg1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652700587, "uuid": "dfabf6c7-9d2b-4e38-99f5-da3c91d36789", "value": 330752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652700587, "uuid": "fc7ac526-9ded-420f-aa9b-36c1a25972c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652700587, "uuid": "281684f9-f858-4605-a9e2-0b421b371ae0", "value": "58aa6bea2d317dcd318339f05591e5fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65cac614-d4e2-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652682937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682937, "uuid": "87b84d45-8f64-4b24-95a9-416479f3818d", "comment": "Malware payload (RedLineStealer)", "value": "fdbd823d5dd58286a119257a76e5c430", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682937, "uuid": "2f81b160-a2b1-4907-b6cd-a4c40270ff07", "comment": "Malware payload (RedLineStealer)", "value": "d8e8134f089b633b3ab11656e438a40c02e2c4c50408a781354edfa54c7125aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682937, "uuid": "f6ae00ba-69ae-4577-a943-522d61c860b3", "comment": "Malware payload (RedLineStealer)", "value": "6f812221a034e8ce2f324dc03ae2bcb020a3a60a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682937, "uuid": "87eb8598-e543-44a1-b527-701a93a7701a", "comment": "Malware payload (RedLineStealer)", "value": "5e71094af9aec99f3755473a9b3aa2c209267513c0f454801950ce57edbd8835895cc05407897d1ca998a2d5aaad2cec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682937, "uuid": "f6bd5448-c336-49fa-b226-86f88874b030", "value": "T19A74F121BAA0C432C0A75A341521EF765B7F74622731488B6BA01F7D2E747D08BB679F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682937, "uuid": "6c9e086e-fea1-4074-bca4-8bd6a0849700", "value": "0cd33c6e999482610a616f4f885bbf79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682937, "uuid": "0ce4997a-4f06-4ddc-b3f6-48bf0f790415", "value": "6144:TTJAiyQCtA3G1fJb/wG44DxR58LKwwzhQLs9fvR4dPn79fD:TTJAiyQUFtwG44VRiKwwzaWfvc5f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652682937, "uuid": "27467d30-da09-4325-b631-5dc101d26a0e", "value": 355328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652682937, "uuid": "318a8bae-aae9-4750-9295-6ab8ee836865", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682937, "uuid": "c25f960c-784f-46cb-bb9e-70a905b3a4cd", "value": "fdbd823d5dd58286a119257a76e5c430.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16206636-d517-11ec-8e58-42010a9c0032", "comment": "Malware payload (FormBook)", "timestamp": 1652705567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705567, "uuid": "c5088e8b-65c9-4663-a35a-813bf2c2400d", "comment": "Malware payload (FormBook)", "value": "96f089a03d1d9087348a95df0e73dee7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705567, "uuid": "b0f7cfa4-61c8-4504-bc68-8dd50e92d423", "comment": "Malware payload (FormBook)", "value": "da7d5d4f66ec3b6d1bdb4301b01d1b9849c6c06c3345d72400a5652f7ac8a52d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705567, "uuid": "9d4a9622-c810-4d5a-bc75-c1b5201d4bb6", "comment": "Malware payload (FormBook)", "value": "e8bcaeb86a2d63d87bfd9648277c5810e8b1a5e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705567, "uuid": "89d645bc-cae0-42b8-9a28-2a7fd2e1e56f", "comment": "Malware payload (FormBook)", "value": "853879d20b134e5b06f9e8e4b443ff2a57074e8eba75ee7d46e50d078baf9f2c726549e5dfb3ed190cfba52361820712", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705567, "uuid": "ad674896-9cd7-4d93-ac67-c1d36dc40912", "value": "T1AE15AF22A2C4E69CDE2A72F2EF5D4C722293BDD9404186A6D17E37A64572717CC13B0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705567, "uuid": "9c292ca9-245f-427d-920e-46665274da50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705567, "uuid": "6a4cd0d4-9f20-4672-97ab-1e974245da8d", "value": "24576:s8KAC+6OKpLeoP0MAfkxsBwoyGKnzRLsVKAC+6OKpLeoP0MAfkxsBwoyGKnzRLsw:s8KAC+6OKpLeoP0MAfkxsBwoyGKnzRL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652705567, "uuid": "43365c77-e318-4e8d-915b-461176068d7a", "value": 887808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652705567, "uuid": "1d749c6f-81a9-41be-92a1-c4bb38a37acb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705567, "uuid": "2fba1f90-0783-4d89-a88a-75efa92b3b24", "value": "6ep.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "402efed9-d523-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652710791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710791, "uuid": "30622415-52c2-4657-ae64-9f428608dd2a", "comment": "Malware payload (Mirai)", "value": "981fee6f7e60884b5923aeb26409ea79", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710791, "uuid": "6b3d3d4c-debe-490e-ae16-e91d65897ef1", "comment": "Malware payload (Mirai)", "value": "da855ab847cec951331750102e2752564a2b20dcfc94c26c1268c84033463c1e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710791, "uuid": "e1842690-4149-4b1c-a8e6-06906e7da168", "comment": "Malware payload (Mirai)", "value": "7beb3dd36ffba42550fcd150eddb9cf7214095e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652710791, "uuid": "cc7e56ae-fb01-43b1-99cc-1726ee8cbed5", "comment": "Malware payload (Mirai)", "value": "819b50f54ebbecc54eea89046c6a40d8d7c1e6b55d6ea6ce9e6b9b12d7f0f03b77bf17d8768f5f875acc452594f5e61f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652710791, "uuid": "b209ae9b-decd-4d8e-98bc-0442330d0741", "value": "T192C2D06EE08974DACD8D287F814C16B1DD90B1B12636AB1E63178CE5724B747B44E8FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652710791, "uuid": "ba516b6d-af51-4dc7-992d-35e1a3d2f70d", "value": "384:qXB5f+XS5+1U4M3YVglQm63hbGL8BsAhTBHB/8f+loVRWGVCz0Nvkq:ov+/ceVdWin/8xDWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652710791, "uuid": "22d4bbec-3e4f-475e-9119-312e7481661f", "value": 26368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652710791, "uuid": "ba21c012-24fe-4db2-8852-acbaf2fb758c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652710791, "uuid": "38b34090-d0bd-4d72-8e0b-67bbe194fbbd", "value": "981fee6f7e60884b5923aeb26409ea79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb77b94c-d4df-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652681873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652681873, "uuid": "936b061e-1d91-4569-b8dd-ddd467774523", "comment": "Malware payload (AgentTesla)", "value": "1ea7fc5bd2b94e9c62fd909787b07af4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652681873, "uuid": "a91a7a7d-d2c2-4a7a-9569-97ba85fa426c", "comment": "Malware payload (AgentTesla)", "value": "dba8ec09d04729a3bae55fc6d962fc7f03add01bc96b750f1f7889cbdba04fd5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652681873, "uuid": "fde90d1d-e510-4143-88de-141af2e8be36", "comment": "Malware payload (AgentTesla)", "value": "9eccc230db6efafc960885b104617ddd448045d5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652681873, "uuid": "98e6a75b-5b41-4fad-9111-28c390e60b03", "comment": "Malware payload (AgentTesla)", "value": "9afd078775478c7278b2b0df3e018337bce4a0c32f6ed5e7684082da898047af307fe2ce327658ba8ba5d2822957507c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652681873, "uuid": "b3febb29-e099-45a4-b49b-d117e9277dcc", "value": "T188F4079B213CE1DEF85EBC718A544F64A6706C6E663AD107D02F3DD9E93B647CA100E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652681873, "uuid": "9c9e631b-f4e0-4f75-a808-dcd42732e25a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652681873, "uuid": "e0a22f7a-0cff-4378-923f-e12afd9780ac", "value": "12288:sAt5xcu9zgYtnJnB6LeKY1LSiJmnxpsA3Dh20oXTuJQGI8elBXoyKsPOCn3H:Rqu9zgYtnBBHKW2Ycxpr4rXTuSGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652681873, "uuid": "54acad45-cacc-4e90-b0bc-b80e4be8a404", "value": 746496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652681873, "uuid": "007ccef4-4302-417c-9431-09488bd6a444", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652681873, "uuid": "d556dbf6-d1ad-44d0-a96a-1a341628868f", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f3743ab-d4e8-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652685476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652685476, "uuid": "433228db-9cb4-4b63-b4c6-e050d03969aa", "comment": "Malware payload (AgentTesla)", "value": "66b72e1915ac247789e7467d7dd4c9c4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652685476, "uuid": "985ee543-57c3-4ad5-86e3-ce1f7f6fc9ae", "comment": "Malware payload (AgentTesla)", "value": "dc321109137bee0187a996e6f4bb2209393ba6995978f40a58fd6a1222428cc1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652685476, "uuid": "0bf60f90-2006-457a-a309-194ce5910144", "comment": "Malware payload (AgentTesla)", "value": "8960a5374bee4194c999a11f89be9608f5be14ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652685476, "uuid": "a1adde6f-b9c4-4cab-af31-30788cd02fe6", "comment": "Malware payload (AgentTesla)", "value": "28c8f21699160ed8e48965c03aa369e4b5ea453829c0e7bcf936ae65c06fd4da70f0b20d51d26ca32dea5d2dca081514", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652685476, "uuid": "98536c31-3e40-4bc6-ade7-2e1bdbd734fa", "value": "T14E25CF9C361C75DFC85BC572CAA85CA4EA20787F671B910790672A9DAD6CB47CF200F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652685476, "uuid": "e8110e18-fe72-4fa7-afe6-44e93cd264ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652685476, "uuid": "1e8abc93-fc59-49e3-9a89-1a212ef87203", "value": "24576:PsTu9zkDUc4W6OllLgnhBXphJYeGokVBu69:PN963rDgnhBXqnz6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652685476, "uuid": "c75d029a-e9be-4c07-863a-a752812905f1", "value": 1007616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652685476, "uuid": "fb62d205-bb9f-4ecf-9c71-8d2ea08f9a94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652685476, "uuid": "7ff34b33-4ea7-4393-bb4c-3f3649f64144", "value": "D8AxghxN8GgEEYO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0013dab0-d542-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652723998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723998, "uuid": "930b5347-e8d3-490f-868a-083125f2fb87", "comment": "Malware payload (Heodo)", "value": "24fe237a968d2b9cddfef1bef4cadeac", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723998, "uuid": "56db5076-2d52-4729-996e-e86c98ada91d", "comment": "Malware payload (Heodo)", "value": "ddbee23174be2d24ff7622990c654155c68b96e60d083f972322627e87b74aa2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723998, "uuid": "d5fffc21-41f1-4e3e-990b-09409d137a32", "comment": "Malware payload (Heodo)", "value": "394f66e63fbf6cf758180ef6ab5c83e420b2b742", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723998, "uuid": "992d3b41-f657-4ba5-ae26-7195960e25d9", "comment": "Malware payload (Heodo)", "value": "6d2e32847ca013461063872eb114d43e179137bbb4b56c5dd005af8e7ca6bbb7432a70e53144d95b9954654828160c8b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723998, "uuid": "208bc753-184a-4cc6-a792-5da38cc95861", "value": "T12784C04673A48079EDB79338CC574A47E376B86907B0678F1364436A9F3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723998, "uuid": "e802e097-d629-42e1-92df-20924314ff5e", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723998, "uuid": "15ec2c36-94a0-4dfa-a784-bafb76500c37", "value": "6144:EbmRW/X22TR72tKbxGeWkesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/WpRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652723998, "uuid": "b4f233f1-06f0-499e-acf6-526f48edd992", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652723998, "uuid": "c6e7081b-1811-4e80-a422-5ab250fa052d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723998, "uuid": "41d65e12-d047-4b1e-ae71-441969c322e1", "value": "zecFAeqj8UHptY8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebd156da-d511-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652703348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703348, "uuid": "18d10747-9fa7-46d6-b0c7-2d4b3f2c5773", "comment": "Malware payload (Loki)", "value": "efacc7cf15e295be9b4b834f74d79ab0", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703348, "uuid": "cc8a3f9f-435b-4131-b8e7-c078d53f7042", "comment": "Malware payload (Loki)", "value": "ddcdddde4db0e9c4b02e31e874b29bc63beafc1c33ed87f725208afabcc1219d", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703348, "uuid": "7682d255-05f2-4683-8704-933ed41b337f", "comment": "Malware payload (Loki)", "value": "4b507edb5b29cf521c45e71a4074dbb9b5864b44", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703348, "uuid": "0e9f4268-242c-4cb8-8146-1daef85e4115", "comment": "Malware payload (Loki)", "value": "8d51a690520947c7c88a0aed04f682822515f41d63e09668b73369e4fcb822215a14d8de466f40b5f85bf085a09be60a", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703348, "uuid": "d778d188-3ce8-4ba2-aa3c-e91273aab4e5", "value": "T1472412737F213EACD92122360FEFC99B2457DD1ABF2A652200FA33183975D702B58695", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703348, "uuid": "8615f11f-0cf0-4a02-8d61-c020c90f5667", "value": "3072:J24Ha6bgogM2SqPP3dK9wtiV5pzJdniFBe/h+GtaD6TL8kQxwlT440eVfhMLVkgg:o4Ha3X1PPEqUn82h+a8QJ4Jecal5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703348, "uuid": "1a99ddaa-74df-4d91-b158-cdf1e5d21933", "value": 229000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703348, "uuid": "45bf05d3-b2b0-4332-943c-5fbd0cb10f2e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703348, "uuid": "a28a50c2-df51-4278-8bb4-bb9d67bc8233", "value": "POP18620782 20290007.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81793071-d517-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652705747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705747, "uuid": "64ff05bc-b8c1-4b5c-a0c1-3d5a1167af7f", "comment": "Malware payload (RedLineStealer)", "value": "450be6421a1e9953154800ff26d70602", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705747, "uuid": "9782da27-272f-4895-9ee7-f60aa82dd134", "comment": "Malware payload (RedLineStealer)", "value": "dde990b668b346c6aa6fc6775c1297f00acefe6118402726cc40be11600256f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705747, "uuid": "5bf276d0-b72f-459d-ba2a-d9ba452c4540", "comment": "Malware payload (RedLineStealer)", "value": "c19697c344e10a3dc788d51238303d564e30447a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705747, "uuid": "e284aab3-0d93-4046-81f9-3df90fdd1008", "comment": "Malware payload (RedLineStealer)", "value": "dbb424ed96d2b396fb8ae9c3819145d7225731779d741b2f6239bde8fbbce2e7e4b79e5d81454db0dfa579dbdca8ef3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705747, "uuid": "7eb6a446-3947-4628-b15f-88207c3d7b6c", "value": "T1C474F161B790D476E2E71230453597629E7B7C322A37410B73AC07AE1FB03819BB67A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705747, "uuid": "a26ccd4b-7bff-43c0-801e-0f5d68d2c340", "value": "4556af061fe2abccc21c2f8048d4d531", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705747, "uuid": "60d6f3e4-d180-4cc7-92ba-8ff49a69c578", "value": "6144:YrGfDTzXYA37pGDyiKcbpvuE0upoj2S/n2DxLoKr:oGfD/Xh3FGw+AEv2V8xLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652705747, "uuid": "5b460c3d-3cbc-4637-ac73-344f6998c1e1", "value": 354816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652705747, "uuid": "eeb68eb3-983f-4531-ba04-96b2bd5a93c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705747, "uuid": "2ea967e5-bf93-4497-8c5a-43bf80d50495", "value": "dde990b668b346c6aa6fc6775c1297f00acefe6118402.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee98f94e-d4d5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652677583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652677583, "uuid": "4f455bc9-58ec-42ac-b703-0d6674dd1ce1", "comment": "Malware payload", "value": "b7c02757b02bce3207601d6b3a68130e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652677583, "uuid": "f8a62a51-2da6-48ad-8246-8854e67d4dd6", "comment": "Malware payload", "value": "de0083e9ee4a9063d463fb09457dc8af11219c6860dc10cb1c7be631f8931d5a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652677583, "uuid": "91c2726f-8d0e-41dc-bdab-f1567e204ca8", "comment": "Malware payload", "value": "b213a77e8330f29b39e9de4f7ddf6b2b4a7dad1f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652677583, "uuid": "b608ccd0-f6fe-4f4c-a8f8-ec316074cf3c", "comment": "Malware payload", "value": "9600df0c9e353829f1c1e5d58db66ebda69f76f98c8d1e79a8990d0fce5fcd688baf9baa6355e602a87ab072e8410e75", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652677583, "uuid": "a05f8f02-4155-4ac6-85b2-95af56bf4067", "value": "T137F00555A785327C0624372D550EA17D697D84F854172579A01D75C724D33751412915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652677583, "uuid": "1f3b83f9-0100-4cbf-9c89-239f8f1ea0d5", "value": "12:ZcJ2/UTHlzWNQe+6bPWCJcGWpQbteVV3sk1zA/jg3vw+:Z/WlzWNQdW+CRmsSskgjg3vn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652677583, "uuid": "4dc89d5e-7280-4e50-9569-cf9edb811d15", "value": 502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652677583, "uuid": "6ece7600-c44d-4db6-ba83-d91beb0c6f72", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652677583, "uuid": "f5b5b4dc-c64e-4593-823c-ad301a8809fe", "value": "Estorno-PIX_164368024.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad8f92e6-d4fe-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652695084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652695084, "uuid": "fb5ba627-2e34-4cf9-9428-a2106dc6202d", "comment": "Malware payload (Formbook)", "value": "886f9714d4d09a7f78320d55c1aa4ac4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652695084, "uuid": "1a457c72-6209-4fc8-9d4c-8116579c27d7", "comment": "Malware payload (Formbook)", "value": "de169c8e113efa4b4899ce2031442d81b243354cab40e8175dbefa7166c371d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652695084, "uuid": "dc4b536e-429c-4636-bf88-1bd8a2676d7a", "comment": "Malware payload (Formbook)", "value": "e04e710ca88703eefe34049bb2d8b58392030461", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652695084, "uuid": "3d1f9249-0fbb-44a2-a58d-a3c6107ecceb", "comment": "Malware payload (Formbook)", "value": "357621711f1e57b681ef2d54e698ae638401bba9c0941a9b381a3d79eef39aef94adc57db31bf4fad45158430fb9d75f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652695084, "uuid": "8a9af3cd-05c5-4122-b686-1746c68d71b2", "value": "T1C6B4E06F9359C109ECA47937C8FBA3217704BE515273D33B68E2289BD827BEA7D40254", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652695084, "uuid": "e84359cd-016a-4b61-a5fb-8e565236800d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652695084, "uuid": "5b6b426b-e7d7-40ad-b4c2-b495862f8bdf", "value": "12288:x6P8Tv/020nUptS6+s7yQycA1FBSvsQnMm:xz7RgUptSbs7N5CFInv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652695084, "uuid": "cfc2ffb9-4c69-4d65-8de2-c3e4a988573b", "value": 514560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652695084, "uuid": "9214a04d-39c2-4a11-9d80-0e8ad1558e4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652695084, "uuid": "66be2a0f-3c6f-4ff6-bbee-c70bf535d085", "value": "PAYMENT SLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ca75e4-d54c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652728301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652728301, "uuid": "b8ae891e-9d2d-48b2-8839-0e570eac60ab", "comment": "Malware payload", "value": "760d7c9f7b23b4cfe84161b8baed1597", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652728301, "uuid": "0d93b302-1569-488a-830b-2215588a6414", "comment": "Malware payload", "value": "de210b3d99fd7548f0e0d7455f0e5b52cdf8fbd84350df87630980950eec62fe", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652728301, "uuid": "a624f4f9-534c-484c-81a3-3ccfd62946ca", "comment": "Malware payload", "value": "85b93f180bcd4123088d016f62e1289beca4f439", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652728301, "uuid": "a20b61a4-a857-495d-9596-901ac2607698", "comment": "Malware payload", "value": "52e7c7ffe7c08ce1ace4072e7979cb5c68b6ed760e7e4b6b42f25a7fadb89d605a0063a9e6d5776006b2aae8f3eb775c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "iran", "colour": "#114712", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sms", "colour": "#5407E9", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652728301, "uuid": "f8c2c701-0f3e-4bc6-b790-f5fde22651a6", "value": "T1B4C52353F2A5A86ACCF3C3322135163560331E1D8B47E78A2959B3BE64F7EE84B459D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652728301, "uuid": "e7298e98-e1bf-4b9b-a1ed-a98dff09842c", "value": "49152:5a/yaR2dMMA517nXPqa/ouKWxi0wkZaAoreU6HLPaWU5cPsEQTFwGkPIu3NeFi3:CtR2KMA517PqawuK+ihBXreUkDXU5cPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652728301, "uuid": "0e7aacc9-72c0-4afa-a992-143e4c997260", "value": 2729515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652728301, "uuid": "6f0ef056-0160-4d5e-a992-65c5d070428b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652728301, "uuid": "28ced263-d319-4326-89c5-c2c92e7f6fc5", "value": "EDALAT.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "409d172a-d4f6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652691465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652691465, "uuid": "e217085d-f465-403a-899b-3822e8456286", "comment": "Malware payload (Formbook)", "value": "7a93aab9dd3829fd66ec06b9e1925798", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652691465, "uuid": "5bd2d48a-8d02-4713-bda8-17c9553ab99c", "comment": "Malware payload (Formbook)", "value": "de36ea5b8c40db020f6292ee0ce1a0fac7b33d58bd8691e4371a657ca80d8665", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652691465, "uuid": "55d4e31e-92ab-4664-82d6-d1dead467223", "comment": "Malware payload (Formbook)", "value": "6160dce347980fe946bc3c594fbf91343ae5722e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652691465, "uuid": "7da4fd6c-ad07-4724-a0e5-bbc1d9b69606", "comment": "Malware payload (Formbook)", "value": "e4c8a3766dbae27852084d514ecfa0c49600972e06eee223234442cd912e0cb2b2a7f99d9deccf078dfef747f3feaef7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652691465, "uuid": "93cd9194-661e-429b-a8d0-2331c6e93aeb", "value": "T18DD4E1AC321836DFC857D875A9A91C68EA617C77830B9203981372ED9E7D997CF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652691465, "uuid": "99d9ff87-3c42-4fa0-b602-0083e40f2d42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652691465, "uuid": "7ae5b205-b720-4538-abb1-d541831491a7", "value": "12288:vscNXR7LzgeYpp0GaCz5CaBqVX5G876/WILsY6SDeUamEO76Q:UeLzob1aCHBqjW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652691465, "uuid": "fb5eab2c-76b1-4ba3-b8fe-7fbe345d894e", "value": 601600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652691465, "uuid": "94545efc-a334-4e3d-9a12-3d1cf011ba9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652691465, "uuid": "9a95ffa4-6174-44d8-bc6f-3cdf2c9d1960", "value": "Neue Sachen.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d9de226-d506-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652698466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698466, "uuid": "95ddf940-9403-4ce2-8372-43ff6f760100", "comment": "Malware payload (Formbook)", "value": "0529615e2f1ab87a7d709156050f3aa8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698466, "uuid": "804fd1ed-c344-48b0-8887-aee6c0383da7", "comment": "Malware payload (Formbook)", "value": "de463868a03e77e9dcd4679051ff3e4efd5910d3c15e0228027772ca3ed87f04", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698466, "uuid": "c61d0c54-d97c-4663-83ab-090e9142075f", "comment": "Malware payload (Formbook)", "value": "a1324d656824172bec3b07bfddf041804dab9dcc", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698466, "uuid": "c6dd784b-0ea8-424e-9caa-6b088d6b5a01", "comment": "Malware payload (Formbook)", "value": "90ebd612848e6452c7874bfaffca3d49b2e13f3e0d52c3d5c5606ce3c646f9a88eb13b7573f78ab4197302acb132485f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698466, "uuid": "7d798963-1245-42fe-b3f4-0fcbd5904606", "value": "T1D794232ED2DF8142FE44013AD2A5BC536A7A998C526A9434094159F5E27FF503B8CBFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698466, "uuid": "cee9ada5-deb6-47e1-a38f-abe852c2c423", "value": "12288:gkq6PETzTe2OBUptK6+sRyGg1kdDMmaJxk:mtL7oUptKbsRNg1iDvAxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652698466, "uuid": "d7827f80-7932-41d8-9882-3f4c8bbfa65d", "value": 410078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652698466, "uuid": "cc44d130-a39e-44b2-b0a2-9251260c9057", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698466, "uuid": "03371bdb-2b4e-4b33-af68-d9819042bb64", "value": "PAYMENT SLIP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14d05957-d4f9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652692680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692680, "uuid": "ee5d3f76-757b-4b80-b42b-f34def721b3e", "comment": "Malware payload (Formbook)", "value": "1f28d80c098c34060fa4743aeae08c20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692680, "uuid": "9deebe3c-06c7-4629-bf4f-ec1ef8df31fd", "comment": "Malware payload (Formbook)", "value": "de71af66a8c1bb33f1d3302d504cbd585b8ccff68d7fb3ae4cca382454b716f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692680, "uuid": "f6398379-f2f5-47f0-ae03-5995c041c4ca", "comment": "Malware payload (Formbook)", "value": "84a7d2e30ef7137687f25c6fb89feea2f05abee0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692680, "uuid": "b9b22e6a-a3f1-430a-804c-f050ba7c9e61", "comment": "Malware payload (Formbook)", "value": "dc73f39334e555b8d68ddf4a06c1e52ef59534a1be650dd80ffa680364a30f9c6a97f7889f1746fbbc58d30327bb9a25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692680, "uuid": "f4bfe08e-e428-4af0-957a-bb4eb6dbd494", "value": "T15BC4E0AC322472EFC957C5769EA81C74AB60707B531B9217945790E9EE0DA8BCF240F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692680, "uuid": "4b395aaa-f513-4b8d-a540-f920154aeb87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692680, "uuid": "5bab5070-5080-4781-a2bd-1857a8737344", "value": "12288:B7td0LZK405C/FRiGBuwX7pDHvWCDyBhBS2tK6U6WuqDhoM/zAWG6Q:lK0ORSwX7pDPDyBXSmK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652692680, "uuid": "8c9d9f39-e426-420f-afc8-c8815b891bd1", "value": 578048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652692680, "uuid": "9f9a2cd7-df10-4808-a242-d6df2fd98e8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692680, "uuid": "ca32bae0-9b41-49e9-9468-d0f18cc1bd93", "value": "qM18w9jOIHl7ByY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a330e55a-d554-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652732003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652732003, "uuid": "0eb61b62-7126-4eb6-af48-daa0178a3624", "comment": "Malware payload", "value": "85674245f63ec362647f73b389a60e67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652732003, "uuid": "61fa58bc-4718-4003-8f39-d401884e0061", "comment": "Malware payload", "value": "de7962a33223332ba94557dc1f2b4ea9fb2436a3aacd802285fe32b1ac276fa7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652732003, "uuid": "5339da8b-acd1-4714-8e06-55bf12e9bc29", "comment": "Malware payload", "value": "6519a6dade4f8c75f6972284507943d6f4117ee1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652732003, "uuid": "e7a8c71b-e29b-4da2-9b3d-504d7793e4e4", "comment": "Malware payload", "value": "c50f86d5857ecb0ed8466a42047169018d1be3def26a9a1d302cc90c6ade09383d40e70627b0d5fa541a469fe22c672c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652732003, "uuid": "ba337c93-3036-42d1-86bc-cf3ebe7a1ced", "value": "T1A874C046B3A840B6ED678338CC535647E772B45A4B70A78F13244379EF2F3915A3A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652732003, "uuid": "9a3ed7eb-86d6-4dfd-88d1-5ab2f1b03eaf", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652732003, "uuid": "34be22f3-541e-424e-a1be-6ea6612ffdaf", "value": "6144:Es/2WX22TR72tKbxGeQkr2rlsy+vbEFXYvlx6xJkUjnKd:Es//Gi7/QgDvQFXTH9Kd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652732003, "uuid": "3da2fab8-7d57-49de-9ed9-0908cea15321", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652732003, "uuid": "52d1cdc8-5279-4e2d-9ffc-f46142a6c0ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652732003, "uuid": "6b0ff805-603b-4ca8-a32c-6a6db4296f52", "value": "85674245f63ec362647f73b389a60e67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b00b16fc-d4f4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652690793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690793, "uuid": "c456eadc-e088-42e0-86f0-ad7cacf56837", "comment": "Malware payload (Mirai)", "value": "d0aef78890e4c66aa0af81b4a360ae04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690793, "uuid": "e2eca089-0700-44f5-9067-aa2c658aca52", "comment": "Malware payload (Mirai)", "value": "df0698e48ea30a83980ec83ccff493a9a8537d16531ff7647e285678deb72bda", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690793, "uuid": "8391483c-7b20-4264-9aa7-c2c070def64e", "comment": "Malware payload (Mirai)", "value": "12678d88f02e2520d0fc2f77cd5dfd1492cb235b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690793, "uuid": "20c589fd-c7ff-4033-ad5c-c968766a3e8a", "comment": "Malware payload (Mirai)", "value": "103125d3fba14f8bd2575bcf0338245c0e049dbdb0affd01ebde0dc504a82cc635c2070631d3dc583283206044048c62", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690793, "uuid": "0b57c20a-3f14-4ece-aca0-77619cd7b1d8", "value": "T10FA3C71E6E15CF7CF79D873447B78E219688338B2AE2D141E15CDA015EB028E741FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690793, "uuid": "4fe79e89-88e4-47c0-87fd-7efd907a1d17", "value": "3072:pqunD7x7pJVnEbc3bQqGdbKba0faazOBCOM:pqunHtpHJGxK2gaazeM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652690793, "uuid": "4f6d6a02-1197-4551-8525-7b12e2e12525", "value": 101132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652690793, "uuid": "95561c46-9a79-406c-8970-6e5cd12cdeee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690793, "uuid": "dcca20f0-b5b1-493b-97b6-060ad13bc606", "value": "d0aef78890e4c66aa0af81b4a360ae04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "736f81fa-d506-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652698422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698422, "uuid": "8f97b70a-b7ae-49d8-9311-8f004e98dcad", "comment": "Malware payload (Formbook)", "value": "da67b873c4f139bbcf764ae4e3ac7a60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698422, "uuid": "92134726-8d34-41f4-bba8-6a843c98cb5a", "comment": "Malware payload (Formbook)", "value": "df169a99bfcb3504b9f804ce76d8a4499e96e41c0a18bff298767b6508e3cea8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698422, "uuid": "dc5d922f-3dae-4ce9-9e98-0f7395a3bf85", "comment": "Malware payload (Formbook)", "value": "e01ca813b162d9dc328271eae0dbbb7a9d05ec19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698422, "uuid": "6720a257-6ff2-48fd-b307-cc0478d1bdb2", "comment": "Malware payload (Formbook)", "value": "53e48832a42c1b1356f8e010039278cffb0d79c8cead297152a01fe2fbe3f278b3005167a4663590e9f0501ea2027f00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698422, "uuid": "89d20d4e-f1b0-43ec-9d05-c3df1f9df869", "value": "T1066437F7538CDA60E93351B3F8550630E60F8B8A0C985135FE37DE0437B65125EABA9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698422, "uuid": "ad688331-9c89-44a9-843c-a5e6b8a3a40f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698422, "uuid": "e1c09f75-c13c-4b09-bc2e-6dca5f2ecf84", "value": "6144:aYa6PipODPZQDAT3FfD4M8IqBsP9G+dyOCThu9Z0oPcL:aYlipODP0AT3FfT8IquddUu9Z0Sw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652698422, "uuid": "07884a56-78e3-4e9d-8f39-826267ce7687", "value": 336033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652698422, "uuid": "11b70b48-74e3-47d6-9f40-afe3f14df58f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698422, "uuid": "8339ffdc-9e2c-4e6d-a3a0-215a18e71632", "value": "NEW_ORDE.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc38f429-d4fa-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652693444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693444, "uuid": "1d11b045-f30b-41b4-b8e4-25920fe985ff", "comment": "Malware payload (Heodo)", "value": "2bdb00c86bb09e7f0d4fff232ac9d9a4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693444, "uuid": "bf8ea094-f75d-440f-8e99-1082608674f2", "comment": "Malware payload (Heodo)", "value": "df78a8dc695b22d7983a425f67cb59614233380f63c933c0084ce5fd605b83ac", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693444, "uuid": "b5c71945-c3e1-4747-afce-29f9559fb8a3", "comment": "Malware payload (Heodo)", "value": "90b1bacc88c734703a0de5eb2f3c6bdb7cd422c6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693444, "uuid": "cbad68ab-ddf8-4c5d-83bb-92e47fce3510", "comment": "Malware payload (Heodo)", "value": "324bd7404f37d35704c9b575821640c15593c63a4a3f6c8ff0ee35fbaf89aa56ca04e510aa1be27e30e9554e72d5befd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693444, "uuid": "586e1519-3268-4fc6-9716-610e2c18b2dd", "value": "T1C3055A35FB6C8492C6A3953D88A34B06EE6AFE840B6183CB1290733E9E777D45C35671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693444, "uuid": "640a9277-8a3c-41a6-b48b-f2433853d705", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693444, "uuid": "c97cb910-ea5d-49d5-a075-cdf01221fb08", "value": "12288:Q9983xioz0/7aG8GkZHFT1YicDAXmvQaZsbNg:A9UUozAWGxGx16AWvVZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652693444, "uuid": "7f803641-dfec-4ac8-afad-d54c72eb9839", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652693444, "uuid": "139089ec-2234-4f63-9782-daa0a08c887f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693444, "uuid": "0fabe080-f37b-4a86-93df-11916fec4939", "value": "2bdb00c86bb09e7f0d4fff232ac9d9a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e42ddf1-d4f9-11ec-8e58-42010a9c0032", "comment": "Malware payload (AZORult)", "timestamp": 1652692696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692696, "uuid": "39b046bf-be41-4fa4-926f-707757464b4f", "comment": "Malware payload (AZORult)", "value": "9adf931c7aaddc6e1fef7bba30fc2c8d", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692696, "uuid": "707e9da7-941c-4e9d-a41e-5159a3bd3c63", "comment": "Malware payload (AZORult)", "value": "e01b88bcb9ad4091045a8c9c049465de103f32df8382b17024fe9a0d91c6194c", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692696, "uuid": "00f61eb2-e991-4975-b938-e273ab0618a7", "comment": "Malware payload (AZORult)", "value": "ca9da50120573c90cac777ce174be97b35c5b367", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692696, "uuid": "9451e6a1-6d19-47f2-8f2e-7c26ebd0b86c", "comment": "Malware payload (AZORult)", "value": "235ee3aea525a18feb366596c5f086f9b12e9ecef45fb3f77d3ba38ada602881fe46a01f5a5e0aac2d6b77b24157dd0a", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692696, "uuid": "dd95774c-71cf-476e-b412-f6244466c457", "value": "T1DAB4C30067FD6605F6FBFF2169B461514ABABD9EBE39C10D1A92008D4EB5F40DA60B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692696, "uuid": "264b8d47-788a-429a-97e4-3022261a9739", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692696, "uuid": "bde82513-6e2b-4de2-bced-336cd4d77d03", "value": "6144:RDNKHBTaqnz2WSx+mBUV22a2zKpwFgdYm4wagTwWTjEnagXWrpJ+oZKN:JwhityMUmpzdYxlw4tWdU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652692696, "uuid": "4b6fee8a-4cd4-4f30-947d-a1ae83b9a420", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652692696, "uuid": "cf17a27f-a0be-4c8c-80f6-70f66bcbbff1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692696, "uuid": "2b8be8d7-72ed-427b-bc41-6b84d9f9a441", "value": "vendors form.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ef8688-d4fe-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652695094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652695094, "uuid": "9d3a0a9b-446f-4373-9b9b-79962a9c58fd", "comment": "Malware payload", "value": "b1f72ab4ba70275a326c1411eabbe9b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw cm2FrCxH", "colour": "#3ED7F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652695094, "uuid": "2bc5fff6-94ae-451e-b3b8-6816a7b57e95", "comment": "Malware payload", "value": "e0220f2657aa538667c6ff5bd161083ee9f34adfd593936fc8f92624e92d9ea4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw cm2FrCxH", "colour": "#3ED7F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652695094, "uuid": "b16470d6-de54-4edd-9fc8-74577ffd7bc6", "comment": "Malware payload", "value": "d4487a5ff8d8365a973ba97ae521072770240397", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw cm2FrCxH", "colour": "#3ED7F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652695094, "uuid": "fd3696cf-ccb0-48ac-82ff-fc7b43064238", "comment": "Malware payload", "value": "7e85b2fcdb9ac028928ac280d0a31eba7f1c8c2731083a828c63fd7b7afdef8fdc23d16efaa43d24903a80379b0de530", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw cm2FrCxH", "colour": "#3ED7F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652695094, "uuid": "40ea0352-a871-48f4-af60-4d03b4df9954", "value": "T13C055A31EB6C8492C6A3553D88A34B06EE7AFE940B6183CB12A0733E9E777D45C35671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652695094, "uuid": "67255bf6-f9b9-4cd3-8fcc-b0ffae970324", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652695094, "uuid": "20b6eaaf-db7a-4a62-8ab4-b32e81724b52", "value": "12288:BeI3xBoz0/7aG8GkZHFT1Yi5a8kL37eGfv37:cYbozAWGxGx1Na8kLqGff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652695094, "uuid": "f11e5554-9a45-49b3-a916-8455aaf954e5", "value": 800256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652695094, "uuid": "ec241027-f761-417b-b9fc-a592064af778", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652695094, "uuid": "4c022919-0ce2-430d-b9a6-8ec2bfba55ad", "value": "vfKUlYqeRU9KqkdltaYCxVVfsWs1FCLHEJ.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f68095f0-d541-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652723982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723982, "uuid": "62b225f2-0305-4c04-bb50-7f515f7eaae8", "comment": "Malware payload (Heodo)", "value": "6ab6d397ec8ea9ebefdfec81dd0b92bd", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723982, "uuid": "d47cb630-e65c-4774-9b99-1345781532dd", "comment": "Malware payload (Heodo)", "value": "e076286b7fc1504710fc76be87b39575f27c65534be4a9d08103893312eefd67", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723982, "uuid": "a4f0be6e-6337-4073-8669-acd7f1ebd54e", "comment": "Malware payload (Heodo)", "value": "74bd47c80f30818f3dc9e4eb978a5aae3320c86a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723982, "uuid": "fea33c69-5fff-4d06-9a29-db4bccaa2d81", "comment": "Malware payload (Heodo)", "value": "2f6e1724dda2d937000ae5fa8f44abf73e77d8ce2651f37c82ed03b8d7a2f7170f6f64e1b594b4109021a7a58a41b516", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723982, "uuid": "6173f424-2110-4b75-a2ea-c405fb636d58", "value": "T1FE84C04673A48079EDB79338CC574A47E376B86907B0678F1364436A9F3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723982, "uuid": "e0bc1188-8b49-4a37-ab3b-1ccef2e1005a", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723982, "uuid": "470bde53-06b1-4fae-a626-11cd42b50b80", "value": "6144:EbmRW/X22TR72tKbxGehkesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/hpRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652723982, "uuid": "32fad17b-4273-4af8-83a2-7e95f969af8a", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652723982, "uuid": "d9d154eb-3ce6-45ff-81df-a8540b609f20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723982, "uuid": "7ce636e8-2d44-4d33-ab65-a0bd7a27ea2c", "value": "ouD.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1db19ea8-d509-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652699567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652699567, "uuid": "73761fdd-fdef-4615-ac8d-1c217a4503b2", "comment": "Malware payload (AgentTesla)", "value": "779cf722377b4e0a080b77ce18f5ded0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652699567, "uuid": "abdd86bc-5707-4df5-9070-5cc4117ac019", "comment": "Malware payload (AgentTesla)", "value": "e0896f3de4452ba8a69e37e0449fbbbca187f7cadd1dffeef70a8e55f2ae6e6f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652699567, "uuid": "74759867-4998-4deb-b1fc-13949166668e", "comment": "Malware payload (AgentTesla)", "value": "8d3813a60beb07b90015919e5795ac635329b484", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652699567, "uuid": "b7114c0b-4e3a-48e9-b1a0-d9ebd4b4f9c9", "comment": "Malware payload (AgentTesla)", "value": "f2687108d5cfacadaef819d4a0a42c5ab268c6f06be6dcbc03b76f61c2723c5720a59309059275e5aab432c17510e212", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652699567, "uuid": "e71acec6-4a69-4360-9c45-dea0e92d9595", "value": "T149E4013EF2E78E22C7991271C0D3161003B5961AB673E3DF1E4501E99E227E75A89BD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652699567, "uuid": "30723a5c-a374-4230-b679-596f6b9840fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652699567, "uuid": "c408e5d5-9c90-4f00-84f4-f00b4ba05483", "value": "12288:QudDook4GIliSzO47QYWfjfVfbjkwEvQtehf3X6iC7fXg+CVx:75k4Rk9TrfVfaIQtMgZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652699567, "uuid": "befa65b8-cfa4-45c5-93d5-59036ea78bd5", "value": 681984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652699567, "uuid": "a3349437-52ee-4ee9-9f8b-5d6dea984954", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652699567, "uuid": "10249d68-5d42-45f5-a2c3-ad5af29be69c", "value": "3532CORDERCONFIRMATION,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17d4786e-d51f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652709006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652709006, "uuid": "af54328a-6369-42b6-9eac-5281b8a24430", "comment": "Malware payload (Mirai)", "value": "2301ced85b23fda06e6f58c14b586d63", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652709006, "uuid": "36084443-4b7d-49c6-a1ea-2b1b957bc07d", "comment": "Malware payload (Mirai)", "value": "e09fd8caeacbb90e8ff636212f84be48f3514b06deee21c653c9f3c26680f0df", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652709006, "uuid": "b9d431ae-a604-47cc-bae3-db8735facabe", "comment": "Malware payload (Mirai)", "value": "0de6c5bad0ae648fd3a233119ae19e4cc2044121", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652709006, "uuid": "e223dac1-a86b-40a1-ba1a-139c51e36706", "comment": "Malware payload (Mirai)", "value": "b7a0ebc764170e267ffd1bbcdbbb2708a82cc0481a33218e1f23c05d057508067899eea734367bfa39deddc2a7bfcabb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652709006, "uuid": "5c93b8e3-8a87-4005-a24a-011baa0cb86f", "value": "T19FB2D070D3A16871D620BD7ADD2413942F5BC57BCEEA7438291401A835C7C9E7DB8EA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652709006, "uuid": "d21a98cb-a299-4364-ac31-1a1dfb1f2556", "value": "384:9Hfeqjh7fKiQ+Z9pkioTC0naUAaGssejvL4jVtyPmw/FgiKcqdFYMDhVhymdGUo+:ZtFDmWUkWhFsmL4B0PmqNL+uMDhVs3Ut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652709006, "uuid": "156380b8-66bb-47cd-82cf-677aae8f769d", "value": 24052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652709006, "uuid": "a208cab1-d406-43d2-9cca-44bfa9141962", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652709006, "uuid": "8eff0246-ef0d-41e0-a9b7-71469f9e833f", "value": "kwari.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1dca034-d530-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652716592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716592, "uuid": "15042e5e-bd61-4d13-92fe-ac593b8a9a0b", "comment": "Malware payload (AgentTesla)", "value": "74866d05b96929841d9b8654c5a3b7e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716592, "uuid": "89351225-bff0-42c1-84d3-e9425ed6a6a8", "comment": "Malware payload (AgentTesla)", "value": "e0f1f446ce8b6d486d8724d26c92a53f612882429ea4df8394eabb9cf7307ac2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716592, "uuid": "e65910bb-de75-4bb7-97f8-222aa97a6d84", "comment": "Malware payload (AgentTesla)", "value": "b9448b42593198d306acde2d0fd048998e5c7fc4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716592, "uuid": "3b86264f-7fd2-456b-a1d4-ab3a19d1c795", "comment": "Malware payload (AgentTesla)", "value": "835906d269a5d97c09251d9f14a1973a3cb0e033d6444187ee77e0bc4bca59e46165077722e3d2adbe5796a1e8507f53", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716592, "uuid": "3127e3c9-dbe7-45f7-8516-1d52d9bf8f45", "value": "T160A4F0143BAC7A11CAAFDBB511A1C1404775C19FBE63E32E2FA30CDE5805B49D2A1B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716592, "uuid": "9155b3f2-7f59-46bc-bf96-16220046ca6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716592, "uuid": "22636d13-8f37-4d2b-8db0-6e8fc2900cc4", "value": "6144:Ttfut4j2WCDMoIp/vhWRFWZTT0oSRPP3cqry0oxEdjeL/jTx9CvcacdfzrbNBzjJ:JaMoC/vCWZvSVsqoxBLG7m/R9Go", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652716592, "uuid": "43925772-0899-4bbd-a939-d4fa78a8c0cf", "value": 461312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652716592, "uuid": "5d9d82bd-61fc-43b2-a9fe-49434c3f5384", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716592, "uuid": "bbb4cb1a-21b3-4489-93d0-e30f00d1837b", "value": "NEW ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "806e63a4-d4ee-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1652688136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688136, "uuid": "a2c4819f-1d25-468a-93ed-e5bf140fe3b7", "comment": "Malware payload (GuLoader)", "value": "8aa0ab68503e74b6e2bc567a30553288", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688136, "uuid": "848dcb3e-9664-4821-8c59-52865e778cf6", "comment": "Malware payload (GuLoader)", "value": "e1585ed6f68030eef12e09f8360c7db1f514ac163ef9d29240ccbf2f857b7ffd", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688136, "uuid": "55c4211c-18b5-4268-8d9c-f6aa82647b8b", "comment": "Malware payload (GuLoader)", "value": "fc941b92bf51dc53f399bce39cc84ba34008ba52", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688136, "uuid": "dbe1a8a7-4476-4752-9878-db90081728bb", "comment": "Malware payload (GuLoader)", "value": "d08937d9c21e9d8c9ec6835b0614bca5bf975e7b20c82ff8044bf3bc10ef2706eee1cc2ee68fb2807c3941da2d57fdac", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688136, "uuid": "89fc8a5a-2112-46cd-9d20-a23c28f8218b", "value": "T16745CEE4614080E5EBF506B0CC7AAF35A651ACAE54940D0771793F973FFD2A3780AA63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688136, "uuid": "08b2b4c3-d81b-45af-983f-7d9d28ce9084", "value": "6144:aYa6f8fGGGGup95aGnGkG8p5HIHj3mdAKvBQqzyBjJkOANGN3D+GrS3SIUXsgUlO:aYPoW7zytO7NGtiTPUcRTqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652688136, "uuid": "b6cf1fdb-12e9-4e8e-8b40-a95b010e5ced", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652688136, "uuid": "26305c9b-5493-472f-a39b-d5e69ff47c0a", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688136, "uuid": "c4a31d87-74e5-4f8a-80ce-b97ff2842b6f", "value": "PO140785.ISO", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b29e21-d514-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652704273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652704273, "uuid": "7b18ef6c-5a1f-4009-9f8b-07b0395f9763", "comment": "Malware payload (Formbook)", "value": "7d9b2802bb3b8f007f642907f4bc8e5e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652704273, "uuid": "e33f996a-c366-4a0c-9222-d0022e0f3f23", "comment": "Malware payload (Formbook)", "value": "e16a6b4f8f40398226babe7697203cb3cafcba921ef1328eef4ee46714f0f2a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652704273, "uuid": "7d8c8918-8a97-446a-baa3-ffb263f17961", "comment": "Malware payload (Formbook)", "value": "b77d5372e84cad5a74ab58fcf7427630ccea9435", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652704273, "uuid": "94a5cb3f-b9bb-4e9c-8c4b-1e1ca0b8e3cc", "comment": "Malware payload (Formbook)", "value": "6dba6b176f89f24c2cffb014d471436e341af92dbb7d5a8ffd8a5a55d9ee39bfad3499c28e3f9f6ec3bf424f3e0b034c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652704273, "uuid": "125ba440-23e1-450a-946f-8c48adfb25b3", "value": "T13BB4228473CCA622E0FA65B5BFBE045416B1B60A7513F22C5ED3A0D62DB2F45CF405AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652704273, "uuid": "90194222-5168-4b64-aad5-c8d0a44e4e76", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652704273, "uuid": "182cb2e5-18b2-4078-a613-f5f17f780cff", "value": "12288:D//Ix1DOpJbqdDtzCmSYAk69k9ycXnZAwlbjd4dnmgJ2m:DgDIqdDQvkQoycXnZAUbjqnmg4m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652704273, "uuid": "33d066a6-e8f8-4152-8bd0-0c7fa7db65ef", "value": 532992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652704273, "uuid": "633cc91d-c900-44fa-9239-036fbbf45860", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652704273, "uuid": "4150d399-b4c4-460f-ab3c-44b946bcad97", "value": "7d9b2802bb3b8f007f642907f4bc8e5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a371ce72-d4b3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652662854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662854, "uuid": "0d3f3186-e0d0-4579-908e-7bbeabd1d728", "comment": "Malware payload (Mirai)", "value": "fbb70a83255505f38d7715d681f3e80a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662854, "uuid": "8c89cc5e-1008-4be6-9bc4-02057b26fd49", "comment": "Malware payload (Mirai)", "value": "e1ec7cc46063fa3d6341e903627b9b9f15025acf4cf6f83771200f36c0718ed4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662854, "uuid": "95d1311b-f729-49e8-8cc5-a7b909bc8f60", "comment": "Malware payload (Mirai)", "value": "fcbee6002541f0c349c25956af20ef346b04c836", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652662854, "uuid": "7ca878ee-db35-495a-acff-1940067da12e", "comment": "Malware payload (Mirai)", "value": "4e108f910a341ea7a50a568190f32a4ea29dd32877662ff14412b69b059da4650dfb5f80fdac7952733af12008c409ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652662854, "uuid": "a5e51209-fe05-43fd-85a7-13cd0618b101", "value": "T189631895BCD18E13C6D061B7FB1E428D332A43E8E1DB33139D26AB61378692B0D7B651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652662854, "uuid": "fc48b1e3-f7e1-4faa-8b9a-052c93bc9f64", "value": "1536:CURMawA+9xKMo8PoHMWNDmGGkcyf0v4S:CUOxn3PoHzNDI1L4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652662854, "uuid": "346bbc60-3357-4bd8-a83f-fda75bcb0129", "value": 67084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652662854, "uuid": "11f82aca-5e30-47a1-ab06-1d7ad63c4a3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652662854, "uuid": "cb0a1ac2-9a9f-41d7-aee9-e4f4b1502793", "value": "fbb70a83255505f38d7715d681f3e80a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c479f7e1-d52f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652716167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716167, "uuid": "5021c46b-8716-4cb7-afc3-2e65735d47e6", "comment": "Malware payload", "value": "2c93aa9536a22ef3871ef1e98ef52a8f", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716167, "uuid": "aa265be4-72a0-4a68-9dcc-20dd4bbe3a52", "comment": "Malware payload", "value": "e24904ccd67c243801cb0ee0a9072aa9b61c51ce2d0caf32bacbd14fddb89ae7", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716167, "uuid": "fecc2cd4-5251-4677-aa51-22f85a031626", "comment": "Malware payload", "value": "4cf967fe1293ddba709ee9723a233c687b65ce01", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716167, "uuid": "1a1d9b2c-60b6-4864-973c-813c00aea6cb", "comment": "Malware payload", "value": "4917c4b75cb333c49aa82f9a89172c2e6402a06c84d0164cc7351a8e6ffae2fa5d4d35e663d3c48b31d0de78d840d16c", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716167, "uuid": "1334ee48-2206-41bd-b557-bb5ea0582185", "value": "T182127F29E9136CCBF062CA907A9ABB460C4B758A9CC4A4903D5D57574080FF2B2D68EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716167, "uuid": "17efa3a1-332b-420e-9356-a7c8701a11ca", "value": "192:AL8rsLYqf7atAQ/Gzqac+KNLJIWYCNR1arUC2iTYjX9LgSiQoEpau:ALgIYe7rQuRKNLSWJsrUC2kYjNLgFzu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652716167, "uuid": "0523517b-a301-418b-a266-ecf83e7d986d", "value": 9290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652716167, "uuid": "766ff0de-97c6-4e98-ac02-a72f80ef8887", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716167, "uuid": "8467cc58-3d9a-44f3-b135-77c006ff3d74", "value": "Company Overview.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9999d833-d4ee-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652688178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688178, "uuid": "75a18c9f-fc0d-44dd-8648-7004bbaee6b1", "comment": "Malware payload (Mirai)", "value": "a4266bfe129778bf08fd383fb170eb24", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688178, "uuid": "d8511ed6-30f2-4c26-a57f-b42b81e9b40c", "comment": "Malware payload (Mirai)", "value": "e25b6aade29a689c5dd75945f367cc9225819d77291ee6aadb004ae91f478831", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688178, "uuid": "dc78094c-256a-4556-b38b-81c90d0e771a", "comment": "Malware payload (Mirai)", "value": "722ccba8d3f70804db8e5a8196ed68259155cfb4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688178, "uuid": "b1cffe6d-0cfc-474e-8c4e-3a128d2e9ea6", "comment": "Malware payload (Mirai)", "value": "69de772613d8507902c6315098f4b095aca264f738304db475b0283903e6d78b58ade603bfa228d75c514d7dcedc84f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688178, "uuid": "c0261f01-5fa6-4468-a364-60257d9ed1b7", "value": "T1A4834C20A97D2E26C1D0B57F22FB8315B2E2270E26B4965D7C760F4FFF2464068572B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688178, "uuid": "b79cd67d-b3b5-47ed-8071-3d92b9791374", "value": "1536:49eb2RVvTRssZva1/2ncGZcq7x3axNcFFhzki6vFf3fAfiqFtBFFp:ch+NcKvFHAffFt1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652688178, "uuid": "4abe1a29-e73d-4244-a5f5-ce09c60b5b2c", "value": 82764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652688178, "uuid": "d1d7ba2d-5ee8-4082-85ca-4ef24794b01c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688178, "uuid": "86561eac-320c-49d5-a483-2c11c48870fd", "value": "a4266bfe129778bf08fd383fb170eb24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d37a539a-d4e9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652686128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652686128, "uuid": "f8b8d490-5422-4c64-8403-235459979a01", "comment": "Malware payload (Loki)", "value": "37b71364dccd64ebff15801ff0a6e523", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652686128, "uuid": "775731cd-2ab9-400d-bf1e-d2c23edd9322", "comment": "Malware payload (Loki)", "value": "e2d411f31f375bc6c579c9dcf96823304238df812f99c99e1b7a70cc5b4ac520", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652686128, "uuid": "aa77cfdc-832f-46ce-880c-b250f5e844d4", "comment": "Malware payload (Loki)", "value": "6c2b22d6d4dc0cd15b5890b7bf48e3af41e9b052", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652686128, "uuid": "fc8c85f8-f56a-43a6-a78f-e1ebe3271751", "comment": "Malware payload (Loki)", "value": "7606e2adf94264e1cb6c87a6d98bf7804d99be6ecf3057d3dc5a10d0b0553eeef26fef2559bd072ac17ad09203974f0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652686128, "uuid": "33016f70-9097-445a-bde5-fc2a5e125d44", "value": "T10334CF22B7B0C033D1D71A344475E2B1AE7F78325B75998B67A41B3E1E603C09ABA357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652686128, "uuid": "0e801025-fb1e-483b-bc45-821854eeeda5", "value": "c4fe96246b42ed89eba209a1ad1599eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652686128, "uuid": "af71eb13-cb64-492d-aad1-8b87516927d1", "value": "3072:wSLisf5cqzMSmNU+1a5MboSMv1VHxb7jjsXU0dyN7t:ZiKfMSmNUOa5M8DVFvb06Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652686128, "uuid": "1de5ab9f-f65a-4d39-8094-8798c32d9a34", "value": 248832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652686128, "uuid": "3b1b131c-40fe-48cc-bc98-52d84b6360de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652686128, "uuid": "58547436-5528-402f-b87b-423f7464f2ba", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8512e7a7-d562-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652737965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652737965, "uuid": "c9a6968b-b000-4708-908a-e2959df15a47", "comment": "Malware payload", "value": "584b99098eaf7e70bfada26e4f0e6635", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652737965, "uuid": "66a4f4a2-0bab-4736-85e9-6477a63c85c5", "comment": "Malware payload", "value": "e2e09b80ecdab5796d7ceeae52b048f12f8c4188752dc54384d78df6122e4de9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652737965, "uuid": "1c6a8a36-8d9a-4bf6-aba1-8f4598cd76da", "comment": "Malware payload", "value": "55447aceec2a7a10eb05132e2228de724674c421", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652737965, "uuid": "436ca67a-1082-445b-b172-36344d93a065", "comment": "Malware payload", "value": "d6267a651fe66eb42b8dd4c773575962b65c0608e71f7da5e5bdb857e08eeb57ddf40ffa1c4bc845688d287a3658bfa3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652737965, "uuid": "f1c4451f-a730-4e76-9088-31748f801b9a", "value": "T11D84C04673A48079EDB79338CC574A47E376B86907B0678F1364436A9F3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652737965, "uuid": "760f7079-6298-4b3d-bd17-7ce53d924f01", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652737965, "uuid": "78eb3637-fdee-4c4a-a1fe-24ce4c7a1d43", "value": "6144:EbmRW/X22TR72tKbxGe4kesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/4pRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652737965, "uuid": "55a6c9ed-73ee-4de9-85a4-3650b2a021eb", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652737965, "uuid": "10135e9e-62a4-4869-a126-282395763586", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652737965, "uuid": "6f52a189-1dfd-48f3-85b9-ce5b55969610", "value": "584b99098eaf7e70bfada26e4f0e6635", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f0dbd44-d505-11ec-8e58-42010a9c0032", "comment": "Malware payload (TeamBot)", "timestamp": 1652697985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652697985, "uuid": "1c5b7c9f-3dfa-4f56-9c67-5f789c97a872", "comment": "Malware payload (TeamBot)", "value": "1d31d98bb67d56dfc57dee908cb90187", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652697985, "uuid": "4ba14ad4-c617-434a-aa04-25340cda7347", "comment": "Malware payload (TeamBot)", "value": "e3387d3f62414fb262da20e54d5775a647443b88cd8a0e738cdc488b95477d4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652697985, "uuid": "766da1ed-7cbe-4006-a394-02077b89946e", "comment": "Malware payload (TeamBot)", "value": "0856cef58fdd7a2c02952f36df97310efb5e560b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652697985, "uuid": "ab7b4343-62df-472f-a1b7-584d1f2ddc68", "comment": "Malware payload (TeamBot)", "value": "cdd9cbd76d9598cf01555629b2743959c8f53f4bea6811744e32fdbe11ff564555c58a0f5e54d9ef7f00e61294cb5e45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652697985, "uuid": "0c3a0f2d-ed1e-4ac8-ae61-c036c2f0c38e", "value": "T19C06330DC0C2D8D1F89968B09CAF0D50FB66D50AEB6D638677321AE93077127923DAD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652697985, "uuid": "96a74378-79bd-44eb-8ea8-358a382b8da6", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652697985, "uuid": "b9508686-d928-43b5-a9d1-6b10096fd724", "value": "98304:JcZYZ2jXqEroKYN0nfSDg71uuvrCmcuCB+2F1hkI:JDmqEEKYEWuvcuCBRF1hkI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652697985, "uuid": "209a9f52-74b6-487f-a71d-4040a953fc95", "value": 3928457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652697985, "uuid": "e737382b-b91e-4462-b309-91a0f671c646", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652697985, "uuid": "05314eea-40f9-45e2-8e35-b27fdefb0a97", "value": "E3387D3F62414FB262DA20E54D5775A647443B88CD8A0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f19d1fa-d51c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652707810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707810, "uuid": "53323d85-05e7-40b0-b5c1-492b63ffcbfe", "comment": "Malware payload", "value": "bd78b96047a5937a867d1eab856cf9d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707810, "uuid": "aed9dcec-7f45-45ba-8f4f-0c9dccda1d7b", "comment": "Malware payload", "value": "e4062a127493a4b846404c08da332b3b08d7d5406b6478d228c11f6125fac07a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707810, "uuid": "5f364557-bf45-43e7-8f0e-294e7e2e6d5d", "comment": "Malware payload", "value": "0e5208565c28865fc04d75f2b81c2398b46e2604", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652707810, "uuid": "dc569c84-cc4b-42c7-84d9-bf6584c9683c", "comment": "Malware payload", "value": "066d5185322c7db67d1884f0a337847f95ebf562b10882d026f0fab763b6a495726df8d628e281381353e01d6cd8281c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707810, "uuid": "93d05338-d064-443d-bcdd-b102bf6da4e1", "value": "T139845A8522A473F5F2B6813AB8411A45DD2A7C547771865F0360637ABE33F60ED2EB23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707810, "uuid": "0e389bec-a83c-422c-8a3f-7b128a703c8f", "value": "5b140b0660c6f3fb0df299cb15d538c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707810, "uuid": "0092fe02-74b2-4f10-9a23-5724a3e465d1", "value": "6144:KFsIGb8OLRnNWfrH+Qzpp5k8vB0TmIEp4QIztPXklyUVmTSvkeWT47vvk0gYMFI:KFvGQsNWD+uV4s4QIClTVmT6WIIY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652707810, "uuid": "760ab263-24f7-4a04-8ee9-9d0c81a4df3d", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652707810, "uuid": "cc9a3962-cf74-412f-bc7f-aedee35cb0ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652707810, "uuid": "6166bd0f-c5d3-4de1-b355-923bf8fc328d", "value": "\u70b9\u51fb\u6b64\u5904\u5b89\u88c5\u7b80\u4f53\u4e2d\u6587\u7ffb\u8bd1zh_CN\u8bed\u8a00\u5305!MTQ=.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1f22db6-d533-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652717881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652717881, "uuid": "5a6edbc9-d7be-4933-b1f0-f6e87fdc8d89", "comment": "Malware payload", "value": "96ea1bcccd594f685ebcb6a311ab0e01", "object_relation": "md5", "Tag": [ { "name": "ContactForms", "colour": "#70123D", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "TA578", "colour": "#3A3EE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652717881, "uuid": "79ef12b4-008e-4339-8331-1ec5f28f6bdd", "comment": "Malware payload", "value": "e472b696ec89d0d6215c0d21304408a2b9a1257727c971279103dda68738592a", "object_relation": "sha256", "Tag": [ { "name": "ContactForms", "colour": "#70123D", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "TA578", "colour": "#3A3EE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652717881, "uuid": "6258ef4e-ba0a-48fb-9234-95d86b7ef04c", "comment": "Malware payload", "value": "37dfea813285fdbf81a3e67ba447fcc3855c9949", "object_relation": "sha1", "Tag": [ { "name": "ContactForms", "colour": "#70123D", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "TA578", "colour": "#3A3EE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652717881, "uuid": "3f036e43-861d-46e2-8084-61363a367610", "comment": "Malware payload", "value": "d2d287a5015359331af24e0a808ec738257cdc6cf1eebac27d49025157d3a615511eee15fe49ab61ff79452909438c8b", "object_relation": "sha3-384", "Tag": [ { "name": "ContactForms", "colour": "#70123D", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "TA578", "colour": "#3A3EE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652717881, "uuid": "123b3864-4380-4c11-b727-1ed7a5978c00", "value": "T134B5B0B876043CD6E56F177BCA97ADED13B526628A8BD8CD40A4B7C30963371FE12805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652717881, "uuid": "d053af59-c926-41b0-8d94-cad1ca49445e", "value": "24576:2L0w7QYqOn4zRayIUo9JLv2mcOW3ZwvEv:2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652717881, "uuid": "f90d662b-9ddf-404d-a8cd-887e53600d74", "value": 2424832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652717881, "uuid": "1d99023e-bc91-4e60-b33d-10cb042e136c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652717881, "uuid": "abffad76-b150-4a5d-9064-5bbc4a164092", "value": "document.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc6603e5-d51d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652708423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708423, "uuid": "20a2402f-5725-4efc-946e-f59b8980ead8", "comment": "Malware payload", "value": "cc56c51108b052de9e888cd9e09e69f1", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708423, "uuid": "da3a98ff-bc17-4085-91cb-20c9ced9d20e", "comment": "Malware payload", "value": "e4c3176a4fbb4e11f0665659088a46d6b2041a663993a16a40fe24e1424a91c3", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708423, "uuid": "dc496759-9c87-4b8d-b25e-2679440f9dda", "comment": "Malware payload", "value": "7dc3011b84b3094f50f5a83b6f1ba8605d4c7f3a", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708423, "uuid": "34d29ff7-260f-4f38-b822-6485b153d2d1", "comment": "Malware payload", "value": "cf20261c5347002f2ad978a7d6e982706ff031788b42ac4e7712495686181c7ced8021deeaa948f0ceb1f6c4a447d492", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708423, "uuid": "76731d36-d54e-4de9-8b60-7f6b9de593b0", "value": "T1B8F433641B4EE758C9BEC5F387B62991D084064F2338DC2B5A75504FBE7204DB2BB68E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708423, "uuid": "a84edcfb-7576-4d34-a9d8-5692ae51f507", "value": "12288:kkXkgDV2Q20LOMT1O7867CxbVLCUZzYA72acuVg9+5dKOLb46Vs7KON9/9MsF4+a:iOZlA4sCxp+rACacuVZ5d5vVgH/9Mqja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652708423, "uuid": "4bdc47b3-acfb-4a20-aaf4-3391e74c36ac", "value": 776058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652708423, "uuid": "511a9b22-ef1a-4ed5-8062-4118d8d3da3f", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708423, "uuid": "2f814465-9200-43a0-b2fc-55d66ff16ef2", "value": "Log.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbc2df83-d513-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1652704180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652704180, "uuid": "8b9c270a-d596-4c25-932d-ca6195940b06", "comment": "Malware payload (Smoke Loader)", "value": "3f21ab537b6ed0fe7cefa332d975aac6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652704180, "uuid": "f29a1f5b-a013-42f7-b598-a79707148ad8", "comment": "Malware payload (Smoke Loader)", "value": "e4fc635ea1f2fbe988ee1df4535bdd2648eb701f7de8130abeddeb9d17b9bb04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652704180, "uuid": "523c4b0a-9c9d-4c9a-b079-9026d9c67cfe", "comment": "Malware payload (Smoke Loader)", "value": "40c41979e539dbe5be944b16aba6ce226c4fab8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652704180, "uuid": "595faf35-3f6e-49a1-8bad-2f99890a1adc", "comment": "Malware payload (Smoke Loader)", "value": "2b55e863cb3e0b1de0c97cf1db5f37d4de36fb7fa69c64ecca56df8fe9633113ca4d2a0aec9ce54f159f4e2e260dd43d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652704180, "uuid": "7fbb50c0-f4df-4db7-9fb2-8af76c969b19", "value": "T147E21A23731D8539FA32CB7EF8528EEC0A2D8E41A575A6C718D0703F5F66A510BE2275", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652704180, "uuid": "6feab24a-3ce2-4a2b-bfcd-6307f6933252", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652704180, "uuid": "6f4e8983-a661-4521-9e48-b1da6e5a136e", "value": "384:q6Ebxa7AKTeq2pMRIp1VtOOuwHtGo2w4r9Qsl8J:KbNaoMdppL8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652704180, "uuid": "4a3a0a3d-ad55-49c9-b7b7-b27b3b2c67cf", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652704180, "uuid": "1aced72c-b0d8-4737-807c-26937491aeda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652704180, "uuid": "0b479c37-87ee-4fa0-b956-30f27ac2acbd", "value": "wam.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad4eda72-d516-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652705391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705391, "uuid": "86cb082b-79f4-4664-996a-e8a1fa00b5ad", "comment": "Malware payload", "value": "06233dd15d171ae5dbee1e82766faf17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705391, "uuid": "3242f646-c3b8-4ced-a2b5-ca6fbf70839f", "comment": "Malware payload", "value": "e5506029470ae02a111b175e59122bfc9ba622c4924d97d06719054d22e29ac8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705391, "uuid": "80c03465-c790-4ac2-a58a-a7c750a27788", "comment": "Malware payload", "value": "355f7f80e6acaa4b8906f12ea6992895126fe830", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705391, "uuid": "5bf2c222-f568-49f5-bc45-a7190452b3ab", "comment": "Malware payload", "value": "b78e8d01d390adf4d6cac2db2e27eeed08b3083e797fe4287f0b8110a9fab644c66793428b8a11df6b71ceb4630dbcad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705391, "uuid": "1c6ab29a-389e-4430-bbce-aec422442765", "value": "T197647C1233E1C877D5A601334A92C359B2F6BE51AD3686477BD03B0EEE70252CF25B69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705391, "uuid": "04b89387-2112-4cc1-9cc9-c00cb004448d", "value": "4660d4f55970ca074db150bc25297558", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705391, "uuid": "c83274b1-92d3-4ef3-baae-876a068c5803", "value": "6144:ULwpEFWtfJqN4ACGWkDQoYshnGMApM9LXYdEPf:NqN4ACGWCQmGMApM9TMEPf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652705391, "uuid": "f5e5a959-5842-4614-8c08-04bd0c825bbf", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652705391, "uuid": "ebd40612-aba7-4b70-bbce-40376de03ccc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705391, "uuid": "e0acaffe-7c13-444a-836e-a55c83e04321", "value": "jhliu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e5cdad5-d547-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652726250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652726250, "uuid": "00c98dc6-7762-47dd-b95a-ee16b6678e11", "comment": "Malware payload", "value": "b7d2fbc98f53c25bc886cb3879e9b385", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652726250, "uuid": "d02dbf94-d46d-4d58-9800-96cdcb0aba4c", "comment": "Malware payload", "value": "e614baa745a7048e2d5169c8d9e747a2befb33be07a1a27b09c195fdc3b402bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652726250, "uuid": "407a40bb-cea5-412f-b18a-b47c7dca6ec3", "comment": "Malware payload", "value": "29309dc2922200e66a25be53ff98140b43dde694", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652726250, "uuid": "8b924d9c-3cc4-42e9-a8f3-4d1ca16ab6ab", "comment": "Malware payload", "value": "9a98a3ab96a9a10823cc7e25ef8288325076bcea8ea6b9f80d9551dc556540bce7f6b9578d026c76ae3f175d7f1867cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652726250, "uuid": "bbf2c3d3-489d-44c3-886c-d3d9aa2b3b38", "value": "T1D485338B8C141CE0FCBEA43B8155ABF3810EDF1871E9825FA6E3D64B5A64106B2C7D75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652726250, "uuid": "bb1f071e-584f-4e11-a5cc-9804ebec7bd2", "value": "4b8ea275b01195301d047f45b8ba14d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652726250, "uuid": "971f15ef-3036-446d-b8ab-c2a50f2afe7b", "value": "24576:HT0sDVfb4BrMsz0ISvECtAeuSapvTA6XiIgAjZ+XyJ+GpMvEUgaWsk4FfHpBhj:wsDVfIhSvPqeChik4XyEtXIOPThj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652726250, "uuid": "196b3b25-5c62-4ee1-a373-52cc5a01b3d4", "value": 1787452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652726250, "uuid": "899068c9-f24d-4649-9ca0-c2eeb975b974", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652726250, "uuid": "643d35aa-ed0d-4001-baf7-889bbba43c09", "value": "b7d2fbc98f53c25bc886cb3879e9b385", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc32c846-d517-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652705953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705953, "uuid": "87e1a5cf-67bd-4925-ab2b-e2d9a48fde91", "comment": "Malware payload", "value": "10e4443ce2353752f039def6d498551d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705953, "uuid": "7a0955dc-31f9-450c-925b-26ae1359579b", "comment": "Malware payload", "value": "e6519b812c285d6ad48df92a70e235a28ee05d7c87e3b6dd8d4f1a29a9b77856", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705953, "uuid": "02b7656a-ef59-461d-8f07-3d67e283c5a2", "comment": "Malware payload", "value": "299fe4fe32de52b52371c88a9b58fb9493c4b2b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705953, "uuid": "483f4398-00f7-4d51-9dd3-c4ffd34f2b3a", "comment": "Malware payload", "value": "4fe4269db975967c8f6d20b01977f847a07fbc133bfc0969b74ab4f9f06614ded5912b8a325a0674fe4bcb6fd428dc69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705953, "uuid": "2211d675-d292-4505-956a-512f92147260", "value": "T19BE43378C4C7ECF9DD0B5832B8216B93026568B67A5E272AD0DFC71112E18726FD11AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705953, "uuid": "216b91be-be76-4b6b-b7f3-389faa4cfd70", "value": "09d0478591d4f788cb3e5ea416c25237", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705953, "uuid": "858e2799-fa2c-4807-a675-3be7fac29727", "value": "12288:IhLXUHKeKnCe60jGhik7Pm75Kwu/qDekJMhVe5OoOnMhMg8nzakeeQhX:SjUHpSjGhiaPm04iCGVeo5MhMgIakeeA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652705953, "uuid": "55b9ec1e-6862-4468-9b9f-2292e43d8d12", "value": 684544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652705953, "uuid": "6fd04099-7f15-4be2-878d-2a89a7d726ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705953, "uuid": "9f55e2de-186a-43be-b0c9-cfc50a5d3f0b", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52157f2f-d504-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1652697507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652697507, "uuid": "de2f61d5-2478-48fe-aae9-e4ca2657522e", "comment": "Malware payload (Quakbot)", "value": "460f08fa70dc8782b3e0ba4150cfbccf", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652697507, "uuid": "6ef5865d-1892-40cf-abb1-8482fe0d2536", "comment": "Malware payload (Quakbot)", "value": "e6a753969df7b0a5bd50a82f45e29dfbf7663fffc74da729ee8316d56619e3da", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652697507, "uuid": "f9c62c52-575c-47e9-a83f-1619c7887973", "comment": "Malware payload (Quakbot)", "value": "cb0786f37818495fd8223455ec02488af479d537", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652697507, "uuid": "db8824ab-1e28-4cf1-8904-ab34eda488c3", "comment": "Malware payload (Quakbot)", "value": "059bad3fa66866ad775a282672129f8bce7a660521c30f1ab2a30d02a978e4fe36f2091a5c510bb338e3700471f9a7bc", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652697507, "uuid": "f9a84eea-b4fa-4651-bb64-86085bba3cab", "value": "T1480146A36AC54591E72FB670C79902990F5DE8F13716E38F4EA33D400511BADAC7C511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652697507, "uuid": "ce9e6acc-5e28-42a2-b143-7f67b2997b69", "value": "24:9zPg8NOUhdhBjr1guBeFlv2DTC0urtQOssn:9l1dhB31FBezv2q0en", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652697507, "uuid": "c165e1b0-c519-4046-8248-3792ba9452cf", "value": 845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652697507, "uuid": "41ca1b4f-40ee-4da1-8e05-b12ca95202c6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652697507, "uuid": "8b2e2bc3-9bfa-4789-b9de-06ae2e39a14f", "value": "U3224546706.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d4869f-d4f3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1652690271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690271, "uuid": "263305b5-5959-4f89-977d-0a2190255a4a", "comment": "Malware payload (Smoke Loader)", "value": "53183a57ea4036c4480c7b93ceda3981", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690271, "uuid": "00842376-6f80-4560-b39e-fd7d5ddd192d", "comment": "Malware payload (Smoke Loader)", "value": "e78a7422032ae60dd8f4e84755f9508258a55ff571381446268966861165107a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690271, "uuid": "fa6dadf3-73c8-4138-ab49-e5e96dbd36ee", "comment": "Malware payload (Smoke Loader)", "value": "ec966c95f47e1d9e14e5735450bc8ed28902e667", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690271, "uuid": "97d35478-e66d-47b0-94f3-ea8dbba2d8ae", "comment": "Malware payload (Smoke Loader)", "value": "bc32d03a98455322199083d198c5781e8128dc006f45f2c573ad31fe05b7054492d9122f1e44c884a2ce4657b1e6d7a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690271, "uuid": "12462336-a425-4cf6-a9c1-ae59bc576764", "value": "T17B24BE2173A1C035D1A2153C45749B7E5FBB78320634998B33A0276E1EB07D3AEBA767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690271, "uuid": "955f139e-c2b0-4de0-9fe3-67ce785e92c9", "value": "7571adbe544c88b5f4f231486e74f9e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690271, "uuid": "e72841e5-d886-423d-9186-759de1c7854d", "value": "1536:1+b+L4D43HdGbfDcxqtc68QoqDJ4YYmvvJcSebXOnInhISTMWEm2iZ+kxX+otypy:0b44Ud/ocQJ4H5xf4Wei+otyx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652690271, "uuid": "8938bd30-fb74-4573-8f98-4ae3080f9f30", "value": 219648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652690271, "uuid": "6f3c128c-763f-4204-98c8-2dd34d5d0277", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690271, "uuid": "dd8ae985-c7f1-4c79-8a8f-54ecee93d38d", "value": "53183a57ea4036c4480c7b93ceda3981", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ddbf10-d4ef-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652688543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688543, "uuid": "31391e73-3427-4331-a5ae-2a0d9102212a", "comment": "Malware payload (RedLineStealer)", "value": "b97b72cb4de8b52d91976de624ce5eda", "object_relation": "md5", "Tag": [ { "name": "176-10-119-117", "colour": "#051CED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688543, "uuid": "8b29449c-8084-411b-9888-5e748b2bd8b4", "comment": "Malware payload (RedLineStealer)", "value": "e7a5fb08fffa977861bf002a59b9078bb33ae5d9b7b4e5654ee18de8cd6b7894", "object_relation": "sha256", "Tag": [ { "name": "176-10-119-117", "colour": "#051CED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688543, "uuid": "ac918c51-2034-4d16-ae75-f4698862f084", "comment": "Malware payload (RedLineStealer)", "value": "b1ceac8e60880b297f39f5c8df5f7532c6ffc539", "object_relation": "sha1", "Tag": [ { "name": "176-10-119-117", "colour": "#051CED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688543, "uuid": "6f331186-4182-4ec1-a759-b072b06a0b30", "comment": "Malware payload (RedLineStealer)", "value": "27c78ca87838e34d0399e5a8e8baf2d68936cbaffeefd468276edad23483477520216442bb039c80ab23ca961c0cc11b", "object_relation": "sha3-384", "Tag": [ { "name": "176-10-119-117", "colour": "#051CED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688543, "uuid": "2ca4562f-f9b9-4efa-8fc2-9080b7ef239b", "value": "T1A9942AC4A528D081CAFC71F2B8A6E61120F92DAC9DC3554EB6F976361873A97DD0B40F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688543, "uuid": "452ad984-6b99-46d3-967a-e066dfd62767", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688543, "uuid": "722c7e94-89ec-4fa0-9a85-3616b769a821", "value": "3072:KbvfQp4HDmyETcRCSX6kReoRNyHXIQenAKo7MMye9zurKCy5bl0EBUUffNtWEivJ:MY+fAb7nC0WEG05iT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652688543, "uuid": "fa3b7946-8fc2-4aa9-b0ea-99a4a0242c4c", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652688543, "uuid": "a3f32c2d-0ec8-429e-86f4-c75d3f948ba6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688543, "uuid": "42112299-e585-4824-9452-67f56688449d", "value": "e7a5fb08fffa977861bf002a59b9078bb33ae5d9b7b4e5654ee18de8cd6b7894", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee48f14-d53b-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652721097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652721097, "uuid": "a958f3dd-5942-4d46-829c-202238692ca5", "comment": "Malware payload", "value": "a707f4d4b977073b1091bfca16a715cb", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652721097, "uuid": "880f6aaf-dfba-4e1a-99f5-7c5489ab3b81", "comment": "Malware payload", "value": "e7d6c43601ee3543d0479e397b92ff1251b87560825f80b37c1a9198a9172985", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652721097, "uuid": "cf73679b-cf2e-499f-af8d-957fffac692c", "comment": "Malware payload", "value": "60cba9a56abf4995b94ab0a902b4f65308de3355", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652721097, "uuid": "12b878d3-2ee0-41cd-9a2e-910f064addff", "comment": "Malware payload", "value": "e2383a49ed434b8199524b74bd745d0721e50d4ef2672aaefeeb75785d2778df625b016fdf601dd856f2b005e0b79f18", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652721097, "uuid": "bc463672-faf5-4caa-8457-291d52f4fd07", "value": "T13B552A2A48AE4B4DD401CE7458343D73DAF6EF935F649298F575A883CE3E7A900B9780", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652721097, "uuid": "d856fc2a-5715-4534-a901-ae1fc2c25461", "value": "24576://Cnpo704jLANvIZyltwL9L9pAtIDeFCv4o0k:LjLANvIZyrwL9RmtIDivHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652721097, "uuid": "458adab9-a6c3-4060-b79b-aedf64072c9e", "value": 1361920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652721097, "uuid": "8bc56e24-3d9b-446e-9d9d-dfdd644157b6", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652721097, "uuid": "8e2cfadf-82de-4bf4-a379-97597bc0b56a", "value": "simplexi.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d878cf16-d511-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652703316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703316, "uuid": "a04112da-1e47-4722-8973-de60a5914c1b", "comment": "Malware payload", "value": "596b4cacfe3f7c2e9d569dcd390d926b", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703316, "uuid": "39598067-4479-4df1-942a-98fdd036c432", "comment": "Malware payload", "value": "e8177732f0c2adf91a555e7ec2c3cc7c8320983a188f4581f4c94e711b50c1df", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703316, "uuid": "ccd807d0-0534-4557-b830-b2779674b3be", "comment": "Malware payload", "value": "8dffd1a24f02f9d2a3e9ca81f8645a9745dc0ebf", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703316, "uuid": "a33d5dbb-7ffe-4e68-be03-148fd509c8cc", "comment": "Malware payload", "value": "6d429b9899741db0204a5a9b30ed3693135c07581fc42e52fefc5591213d390374af9ce1e8234d625ff90d51bc37638b", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703316, "uuid": "604b02e0-c599-4993-9991-630cd806afe7", "value": "T1BF24120A3B5C6788E12B9B313BEE09516E7CFC68C1EE7A5F14457908983E1C39F97A10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703316, "uuid": "cfd9ec0c-ed32-472b-a612-72eac7cd084a", "value": "3072:UbDMggQULh+FyXHbH/3t++lxXKU3KFrk2tNiNXx3ivFu/FEXiIk75aTeWP7Z6aV1:K9gQD6drxX734t0Np/F8k1WR6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703316, "uuid": "e5900b1c-b1b2-4ee3-8779-0b9c7885b013", "value": 229032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703316, "uuid": "4c02a079-f173-415d-9e9e-d4f2dc789462", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703316, "uuid": "9096ed84-2bcf-4795-9eeb-3e0f6f4cf9fe", "value": "GRAFINGER002090501622-INV.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d4fa2e-d4d1-11ec-8e58-42010a9c0032", "comment": "Malware payload (NetWire)", "timestamp": 1652675604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652675604, "uuid": "a7099f5c-218e-4613-b267-9d8c67ade9f5", "comment": "Malware payload (NetWire)", "value": "86a650b1e63cbc641cf37644ad3e2d1d", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652675604, "uuid": "daabce24-5c7a-4bdd-a9e5-2be40afcae66", "comment": "Malware payload (NetWire)", "value": "e82eb173325ee7fa787d4a3553ac250f0784a36bba695278889091ce84a2f38a", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652675604, "uuid": "2387807d-ed96-43ed-9329-65f31fd06f74", "comment": "Malware payload (NetWire)", "value": "7e1d2c4b1567b82f9c258c368c6197cc5a1d71b0", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652675604, "uuid": "8263d5b9-29e9-4414-bb39-30c452c09790", "comment": "Malware payload (NetWire)", "value": "26ae322cc8f31bfcc2128c41575708171e286a22675bf3da2fe80765728562efe1e171ffafe4d954f2b046760c2a2647", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652675604, "uuid": "ffd15bae-2ecf-4a8b-8a46-103d58d39cdc", "value": "T1424612C2EFD696F1DA8209FD4092D626D9217A1D3333C5E393C025D1A4E2AD19E3D29F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652675604, "uuid": "821229b1-47fc-420f-9118-a7eb9cd3df3a", "value": "ad9d11227a86b863e31ddf6019cc7ab5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652675604, "uuid": "322cad61-c596-4339-a420-000fd8c44ea5", "value": "98304:uT/R9xWrfWpnyW9afDWHcsuL/+bmVtkn3t8w+KRtxFdkGxzKLdD:6R9xzpny6abeLuK6vrw+K9cx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652675604, "uuid": "be7cd563-1b52-48b3-82a8-980ef6c73958", "value": 5807488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652675604, "uuid": "151f8aed-e80c-4859-8b78-c7761625ab0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652675604, "uuid": "265ea0ac-e0ea-444b-a5bc-2cbf8b069b66", "value": "Shadowsocks-4.4.0.185(6).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "527381fe-d518-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652706098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706098, "uuid": "e4f0b6b7-5664-42c4-867f-40fa0b4c562b", "comment": "Malware payload (Mirai)", "value": "4d4ac1a7c80ffb8d16655f3d2639f52b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706098, "uuid": "ffe6f3e9-764c-40be-a948-66ea4605c050", "comment": "Malware payload (Mirai)", "value": "e84499932ed9f87b83d7000b2dcf41224ff2464539c5af1f298bba61fea33e55", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706098, "uuid": "d14292ac-48cc-46b6-b98c-b335f6ae628f", "comment": "Malware payload (Mirai)", "value": "acd043a763427ecf3d7159f8bb0c14ea95ccf50a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706098, "uuid": "94f6bf23-239c-42d2-9388-05e5cc2f8cf1", "comment": "Malware payload (Mirai)", "value": "98d77403b7639dcb45b4938327fe3c988d7a2769ab5f92b672f2fe3580b944e83b7c99a8919648cd6c2df1cff2603b91", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706098, "uuid": "be57d8cb-780a-400c-928d-c7a936b79ca6", "value": "T188A3820ABF604EF3ECAFDC7749AA2B45248D541A21897B78BD70D414F64E24F19E39B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706098, "uuid": "50cbf7bb-bce8-4f63-813e-3440253ae6f7", "value": "1536:277/BCaYLJcHPh+DJrj+jPYYsSbuLWjZg5hnMy:0LAaYeH8J3hWjny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652706098, "uuid": "8453e348-be46-4917-8dcc-bd680850abd0", "value": 100468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652706098, "uuid": "e5dc19a6-4d9f-4a52-8095-9b193cea7cbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706098, "uuid": "2fb65310-f630-4607-9dbd-3e275b2b18e0", "value": "4d4ac1a7c80ffb8d16655f3d2639f52b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c924da-d519-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652706502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706502, "uuid": "19cc1fa6-ea43-4ff4-8d53-f8e5f4c51e20", "comment": "Malware payload (Mirai)", "value": "8793af5e096739eda992a5a5bb721ff4", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706502, "uuid": "614242c7-7085-4e7c-8f18-a90164ad86bb", "comment": "Malware payload (Mirai)", "value": "e99d0e7242f374c81c91c2ccb08662771314f4ce1f4f4acb0bd9056ba2d94b62", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706502, "uuid": "1a60e536-85b9-41e7-a55e-9c3059952d0e", "comment": "Malware payload (Mirai)", "value": "c27fd7f3e43e0e6abaa77a37c8b3a9a1d3fd8245", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706502, "uuid": "e9f894f3-d0ab-4e7d-bda9-7e6c6125c938", "comment": "Malware payload (Mirai)", "value": "ed4127aaf8638ece8070a4c7731f8b91e755bcd8af193bf72d4d59aa920353c8d3078638486b1847dec423d0497a04c3", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706502, "uuid": "6b6b6629-f17a-49dd-ab99-971fd7333be3", "value": "T1E9732A43A98595FDC088F43886BF7275E456B07D2339B19B3BC8BF2B2905E901F1D46A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706502, "uuid": "ee55e6df-e9f2-4009-a37e-3d6858529c9d", "value": "1536:P/02MqI0XquWi6yjW73SqZ5H+2UOA39FBuTFQE7ghrfLORZgAc:PMqdauW5yjW7j+dOA34TFDCXORZgAc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652706502, "uuid": "6c308fdd-989f-4c5b-9763-6a7b78329aa3", "value": 73504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652706502, "uuid": "7cc64e16-fcc9-40c6-9a64-fbe2d17e41c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706502, "uuid": "a7cbae65-6752-4e6a-ab6d-1a10668d32b6", "value": "8793af5e096739eda992a5a5bb721ff4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bdb20dd-d561-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652737467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652737467, "uuid": "15def376-7863-49e9-9388-b4ca7eafaaff", "comment": "Malware payload", "value": "a4270d1ca84fab358d3e1ed8208f1c28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652737467, "uuid": "918cd694-0c73-45fc-8068-177f11119795", "comment": "Malware payload", "value": "e9a8f54ebcaae861cbab6da5f462101f0334c69184b80aa56ee3cf4b17f10896", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652737467, "uuid": "8d8adbd6-8eeb-4807-943a-565e7156ac80", "comment": "Malware payload", "value": "4b5717efd1a2ba91456028ffccc3aea18fde1ca4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652737467, "uuid": "c67ef968-c694-46e1-a91e-592b800f0cf2", "comment": "Malware payload", "value": "af91522a46ccf31a9101ee7633c58d9b58417c298658df4bf51bd755f9557d46ec672981705ee2ec3f1a666d40ddd0c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652737467, "uuid": "992f689c-7c2d-4d22-89eb-07e75b06f0ce", "value": "T16E84C04573A48079EDB79338CC574A47E376B86907B0678F1364436A9F3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652737467, "uuid": "8fd5dc43-cd69-493d-a6a4-ddea07e55342", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652737467, "uuid": "e9dad81f-ee66-4e20-880d-c2238d1a56cf", "value": "6144:EbmRW/X22TR72tKbxGeBkesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/BpRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652737467, "uuid": "805b6cd1-b5d8-4dda-8abd-61d8081b72aa", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652737467, "uuid": "c449b822-4363-4a95-8fde-4e52b254c709", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652737467, "uuid": "cfbe10b4-130b-4a8b-a7c2-7f1d4c4e0911", "value": "a4270d1ca84fab358d3e1ed8208f1c28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "775e02de-d512-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1652703583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703583, "uuid": "ad0ef38d-8a4c-491c-b7ef-3a72b72f2ebc", "comment": "Malware payload (GuLoader)", "value": "f0f17c4048d3802ba95d2a9c988d0712", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703583, "uuid": "206b6161-088a-4632-a41e-de0b802d8fa3", "comment": "Malware payload (GuLoader)", "value": "e9f376cbaf591eaf755ccb4b60cc03b90138a128f0d2fd2ce2e1c059b5349838", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703583, "uuid": "8bbfaf22-cb07-42fd-abe0-6f9ca4355de4", "comment": "Malware payload (GuLoader)", "value": "7c9207e722e4ae650c8d88f374cf4c48822dcef2", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703583, "uuid": "6f905e6b-c24b-4a7d-b610-0b053ea0eead", "comment": "Malware payload (GuLoader)", "value": "e39e879328a2d40a9fa1c6e2f80a091a262788b063dffd6b01bbba7303b0d79b8488912a30304223c56add560666542f", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703583, "uuid": "ced2fc0f-b08f-48ac-ae53-b459055cd0f1", "value": "T1D834589041B19FC8D1F8399FCF0E4621F2009E59E2D7F59C6AA121BE7FC72DA4316698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703583, "uuid": "d4861a6b-3c33-46a1-a8ff-2f1cab9f9510", "value": "3072:8nXMbxL7uG9XRNQEo3aVMQ7y3Z7l7ke3HpiPd:oXMbx/uGpRNpo3aV97yP7W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703583, "uuid": "bcdec685-bfc3-44f1-8e3c-432dd74d52bb", "value": 249708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703583, "uuid": "a4801456-d61d-46d5-89cd-79314995d8bd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703583, "uuid": "b037af9a-fa02-4dde-a87d-eef36092e6d9", "value": "Your_Transport_Plan_Changed-Maersk.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad18d5c2-d517-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652705820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705820, "uuid": "bc4fab2b-14a5-463e-b7d9-3cde0488569d", "comment": "Malware payload", "value": "7e5811cfc0543bbfe2108d74065491d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705820, "uuid": "9bfd022f-4840-4877-b948-257dd217b213", "comment": "Malware payload", "value": "ea878e2db26639cd0d31682a214964235f358e060b33e7ba0b7b27939d09f750", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705820, "uuid": "d98fdaf3-4c29-42f0-b2f9-d707746728d1", "comment": "Malware payload", "value": "06edc8ecdac642b61e595f45ebb24ffca97c76be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705820, "uuid": "a98ba4a8-ab7c-494e-94f0-5b163485e305", "comment": "Malware payload", "value": "708fa2f16e1c0f9f53aeaee0a965f4d0d3cb5563e0e1c55e7a514dcbeefc1f7a692014bc8669fc610feeacfe620058be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705820, "uuid": "daa37ea5-196f-4710-a8a4-c3ce8163a46a", "value": "T120F533BB42C8CC4DC914C63A42917479F14CE826E4876E737AEDBD46D47C2A5EC20F9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705820, "uuid": "dd7af852-3bb7-4005-a87c-46e268069b9c", "value": "543d4f6a845219d1b0ec2b31e57cf3a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705820, "uuid": "633ee414-4d45-4718-b8b6-f300b2ee30a4", "value": "98304:yguUB6YhyVtXrmbdvAGDTuXlhj7oUV97wAlei0:ydSXSRrmrQUUT7Jl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652705820, "uuid": "9770dfc6-0f0c-4588-b04d-0cc48810afab", "value": 3466752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652705820, "uuid": "a5ee9b32-b9cc-457a-b9ba-e0c3521852a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705820, "uuid": "97484729-6081-4d26-94a9-b19e064c5582", "value": "XCC08\u70b9\u51fb\u5b89\u88c5\u7eb8\u98de\u673a- \u7b80\u4f53\u4e2d\u6587\u8bed\u8a00\u5305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae831e63-d4f9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652692938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692938, "uuid": "4e53b3a2-797a-4b01-825b-059a4646a0e9", "comment": "Malware payload (Heodo)", "value": "7a8f2ce187f8675ca0782d52f03367a4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692938, "uuid": "e74d85e1-e9a4-41bd-935c-4251d08290e9", "comment": "Malware payload (Heodo)", "value": "ea8b12cfe3370dbca1c73abd60befe2620a5a3180510891b18e4f583cf068b02", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692938, "uuid": "47179d8e-add8-449d-9971-0eaac855054c", "comment": "Malware payload (Heodo)", "value": "84af84505b611c8a21c40b7b7afc7656b1fe4648", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652692938, "uuid": "5394d69e-04e5-4263-9899-caa622c5e49f", "comment": "Malware payload (Heodo)", "value": "fd0f7b3843bf0616c8d7c2c7da461b8e829d010968ea3c0244d05d0fa912d7360de6384ba6ed50a90ee0cb29be66a6ec", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692938, "uuid": "24c295b0-f034-47fb-a26c-ffb90a3bba65", "value": "T121055A35FB6C8492C6A3953D88A34B06EE6AFE840B6183CB1290733E9E777D45C35671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692938, "uuid": "c81104fd-27ed-4cbb-9dd9-d903b0d887d8", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692938, "uuid": "a47843eb-7128-4e4a-8288-0bf031e250ff", "value": "12288:Q9983xuoz0/7aG8GkZHFT1YicDAXmvQaZsbNg:A9UsozAWGxGx16AWvVZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652692938, "uuid": "ea494bb9-6e5d-4f9c-80df-d8f8e974768e", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652692938, "uuid": "8016d15e-8076-4ccb-8040-ff6127567487", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652692938, "uuid": "e11513f2-3157-42c4-9586-a9d728358769", "value": "7a8f2ce187f8675ca0782d52f03367a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c040e019-d52f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652716160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716160, "uuid": "5c4f615b-f2bb-4d85-a15f-19b71eee19b1", "comment": "Malware payload", "value": "3317d6ae6e7359171306d70aa09e328d", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716160, "uuid": "bd298d3f-420e-4b2f-a6df-18615f60721c", "comment": "Malware payload", "value": "ea9c52634709cabe08276c63755ab9ea101cff0aee82543b4233eb5bed134342", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716160, "uuid": "4151054f-e706-440a-8627-83a7765d443f", "comment": "Malware payload", "value": "67fb7dbb19e0fdf2ea0126d207aebd2c190078ca", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716160, "uuid": "fa43b792-f8da-4342-ab24-fe1d9fbb92fe", "comment": "Malware payload", "value": "87a9e2337fc710af574c13bd9280f97bd1956718259702a7fc01199768c8fd6177525fd9b81be2f5d3dc23053dccfe68", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716160, "uuid": "8b961ce8-25fe-497e-99af-6f0e2e987ff8", "value": "T19AD423C29D364BE1AC8C5A677AD54EC2114BFD4E171D1348EF20C8ADAF7ABB4790460B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716160, "uuid": "420f3685-aeaf-4379-920d-447bd7b62ed2", "value": "12288:JCgMyzX7utSDEOcwwxrm9oxKQWFwSVa9St+ukCwrKZdCbAlNUmdAHf:JCgMynoJ3x69oxZxCwuwUHdA/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652716160, "uuid": "7513c2b6-0246-40c1-a20c-e31b5671325f", "value": 632707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652716160, "uuid": "2be3497e-cce7-4f0a-b6bb-4c5bd6461b65", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716160, "uuid": "3aebea4c-bc8e-454e-a939-24f69011e007", "value": "2022-05-16 23720.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d61f605d-d4e4-11ec-8e58-42010a9c0032", "comment": "Malware payload (EternityStealer)", "timestamp": 1652683985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652683985, "uuid": "5e0a4302-8fe2-4e45-99af-f76bcc063d4f", "comment": "Malware payload (EternityStealer)", "value": "8d52a66459df0ea387d5aab3fc7a2bc9", "object_relation": "md5", "Tag": [ { "name": "Eternity", "colour": "#271FB4", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652683985, "uuid": "5b231407-6cda-4f31-80d1-d33af517bc5a", "comment": "Malware payload (EternityStealer)", "value": "eb812b35acaeb8abcb1f895c24ddba8bb32f175308541d8db856f95d02ddcfe2", "object_relation": "sha256", "Tag": [ { "name": "Eternity", "colour": "#271FB4", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652683985, "uuid": "98f919bc-fb2c-4395-9aa6-aea06e51b04e", "comment": "Malware payload (EternityStealer)", "value": "1707b034483eb9f279dfaa3a8862592bddb2ac4e", "object_relation": "sha1", "Tag": [ { "name": "Eternity", "colour": "#271FB4", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652683985, "uuid": "a92a7130-13b1-4aae-9223-05c78c2d4649", "comment": "Malware payload (EternityStealer)", "value": "24d2e3694cff40a7fa84ab388609cfd377f2669f476bcd115ce2d347c5ef6f4df37cea2a436d2a2dca12eba07021e6af", "object_relation": "sha3-384", "Tag": [ { "name": "Eternity", "colour": "#271FB4", "exportable": true, "hide_tag": false }, { "name": "EternityStealer", "colour": "#9DE6D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652683985, "uuid": "fc12fa89-1cca-4e12-82dc-9b5a122c78bf", "value": "T13605DF1477D8CD26C2A6133484B897F15A39FC052752F7EB93A83B79EE2E2C15E21217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652683985, "uuid": "74278282-89eb-4858-84dc-4312920017b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652683985, "uuid": "a460d24c-6731-4c34-a8c8-21767fd99c43", "value": "12288:qTEYAsROAsrt/uxduo1jB0Y96qJ8kz+KwazQDkxWUlrStbSO+GFt3:qwT7rC6qJ8S5waz+TWOWc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652683985, "uuid": "7ca24f9e-a461-4a50-ba81-ce64e668e264", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652683985, "uuid": "1e7954d8-4c57-4425-abbd-b1ccbfce3048", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652683985, "uuid": "29714b4c-aa78-4215-ba27-72479e65c524", "value": "eb812b35acaeb8abcb1f895c24ddba8bb32f175308541d8db856f95d02ddcfe2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad05b1a-d4f4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652690864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690864, "uuid": "5a345acd-5982-4899-8e3a-fb5302109721", "comment": "Malware payload (Heodo)", "value": "7dc1bb609d1fda59711566b90960c66c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690864, "uuid": "d0558823-3079-4f60-94dc-f3d529523f51", "comment": "Malware payload (Heodo)", "value": "eba48123626019068e1ebf5b18142c1803ae3619f5b0809684fa69717e92f4a7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690864, "uuid": "6f57b3b6-47ce-4559-915d-72f343478130", "comment": "Malware payload (Heodo)", "value": "ab802abe29487317cd76e467f90203f8f8f35de8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690864, "uuid": "74cfb880-6d1e-4f6e-aea8-687891100163", "comment": "Malware payload (Heodo)", "value": "601514e0e6d8d6f9c167091953934a680644460b5e8857378c973cee075ce5326c19cf629b92ac69de5713172e976c2b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690864, "uuid": "fba0b404-72fd-49c4-b4ab-76cb5ab677c3", "value": "T1FD055A35FB6C8492C6A3953D88A34B06EE6AFE840B6183CB1290733E9E777D45C35671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690864, "uuid": "e3726b5f-7292-4c29-a7f0-c25a03fe16b2", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690864, "uuid": "0ba70d2f-74c5-4c8a-a2c4-230510f3bf13", "value": "12288:Q9983xkoz0/7aG8GkZHFT1YicDAXmvQaZsbNg:A9UWozAWGxGx16AWvVZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652690864, "uuid": "3895e4e3-6afa-4474-9cda-65ada56d1dae", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652690864, "uuid": "306d9b63-28ce-41c8-8731-526808a12fdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690864, "uuid": "73b3af33-2e33-4b79-8f98-e348ad001034", "value": "7dc1bb609d1fda59711566b90960c66c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "782b4aa7-d51d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652708308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708308, "uuid": "c47a64d2-1dd6-45d8-9f92-ad22d5eb9f38", "comment": "Malware payload (AgentTesla)", "value": "70379bfb27856107eb7ceed012bc41de", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708308, "uuid": "a4e915d0-bcda-4bcb-b3de-fff4a47f92e3", "comment": "Malware payload (AgentTesla)", "value": "ebcdba14c6812f5301baed0a44f17c6967cfbf8f5a1e491d02b61ba9b44bc026", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708308, "uuid": "4b465a83-735a-4bdb-be73-7bcb6531ba93", "comment": "Malware payload (AgentTesla)", "value": "4973d0b7acc3f703d6000a476a92256179f6d22c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652708308, "uuid": "102b2aac-b4a6-4fd5-b7fa-8eafd99a90af", "comment": "Malware payload (AgentTesla)", "value": "44ebc3019f0f9531b61266e14630fb66e1e627c72472a97e017c31199bc3e268a9499724d39fa7cff50b38e403f46846", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708308, "uuid": "6bc343ff-ba93-41c1-b703-3e303a201020", "value": "T18A94E0103BBC7A12D9AFDBB94050C5044271919FBD63F21A5FA74CEE6C06B48D6A1B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708308, "uuid": "9c1076ab-1bf5-43ac-baf1-f5028366659c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708308, "uuid": "fbda25ad-9abf-4042-a657-c281eb6670bd", "value": "6144:ThQ4f2W7otmR5SyHVVz3ZFXHJdHMxev0jG4LpRo847F5YiIbfJN5bBPzMp/udExf:zwtqjVtFXHDwRHW84TSf/5tp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652708308, "uuid": "fd8c3090-85c3-4d54-a299-88c992e9a353", "value": 423936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652708308, "uuid": "9d1fbc69-d7d6-4478-969e-943f104df727", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652708308, "uuid": "be5e865b-3bed-4d43-91be-8645e15750ed", "value": "bank report.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0007aed2-d4f7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652691786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652691786, "uuid": "3845a98a-5379-47d7-90ba-7f623cfa2d09", "comment": "Malware payload (Loki)", "value": "7114e3392caa366620d69dfabb599b09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652691786, "uuid": "0304d6d8-217c-49ba-96c9-09a24d5290f2", "comment": "Malware payload (Loki)", "value": "ec5e0c6a6bc453e2d479f678accc82eaebd62fa1c97a1663eb55c7670e4ee2db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652691786, "uuid": "ffb028eb-8354-463f-9efb-23ea549fac02", "comment": "Malware payload (Loki)", "value": "db4bac814aed7d920932860baa2747c30ca6bf88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652691786, "uuid": "5f7c8988-b676-4d28-8283-e31a2a0ba87c", "comment": "Malware payload (Loki)", "value": "6ece95a6eb730241362a61e789fd234da013f01ebc2b97661241fb23b21ddde446f35b80ccc939d66848f420f51af7cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652691786, "uuid": "bb1a250b-de44-47ab-9318-f44c699104db", "value": "T167C4E0BDF2E7CE22E3191271C4DA5D000375562AE773E7DB1A8450D64E02BDB9A81BCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652691786, "uuid": "22ffb84d-38dd-472f-8229-932e41f9d9f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652691786, "uuid": "c5126a90-c4f9-4775-88bc-5056d7e6a57f", "value": "12288:djdiEsn0OjTjJkOSBdfUnPR5uoC1s2a8joi3bPJ0:Xc0OTJzSBZSLufG2aUl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652691786, "uuid": "840c05f1-f1dd-47f4-b7ca-58b656440f1e", "value": 553472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652691786, "uuid": "b6e6c7f1-5b1d-4492-bbaa-40385ee4b75a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652691786, "uuid": "bf53d55a-8fe3-4548-b303-ea1ae844a29f", "value": "File 0083364.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96a96c70-d511-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652703206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703206, "uuid": "28536ed9-6215-4755-8274-e965fe8399de", "comment": "Malware payload (Loki)", "value": "a61946e47f21aaf3d6c1cb1982aa76df", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703206, "uuid": "9c2e813b-b71d-4a7e-80ba-4e71a6c18bea", "comment": "Malware payload (Loki)", "value": "ecc2f9144d6d6a85de624de35f002391555f340cdb42677cf52983fd640d5bc1", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703206, "uuid": "48667774-fee5-4c0f-9ec1-31e7136fcc55", "comment": "Malware payload (Loki)", "value": "8f177f4282c8e2edd347232bf54d8998404917f3", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703206, "uuid": "576b2914-d6ad-4c77-a70e-d2a3d31f729d", "comment": "Malware payload (Loki)", "value": "9e8c27ff0ae0acb01847a1cbb5a562db764f395c7142828bdf73999116836d0d61ab79b0d802315ccfcb4e2fbe3598c0", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703206, "uuid": "1d90ffec-e14c-4c00-88bd-b3ebcf6d63f2", "value": "T19C24125B3A488728C4A47378CD6FCCCCF0A8EDD1A455DA9D0520B12D2CFA9857E736E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703206, "uuid": "442a6bb5-3d9d-4192-9c6b-d4dec292db6b", "value": "6144:e7K8KVoOOlERqK19HViOwooH99BNoHF5+ZC:GBpXlWNhI99rQjN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703206, "uuid": "9007002f-7dbd-4c03-b79a-13fa83a22e1a", "value": 228872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703206, "uuid": "993fa9e7-2ba0-41fe-a751-da1d367f7c3e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703206, "uuid": "39e49cfd-7e1b-4a91-9664-045bff36a602", "value": "hFE 22002__BANK SLIP.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e95e265d-d503-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652697331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652697331, "uuid": "a22fa871-a6ba-4342-9ea6-afa8609963db", "comment": "Malware payload", "value": "18de33d43d623f29f2e27dce2bed42a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652697331, "uuid": "d0b4bb1c-7592-4000-986c-56558d1cc7e6", "comment": "Malware payload", "value": "ed2db170d37fa153bae184f873ccb6312a28c37b369e6b72054d33cda1ed98d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652697331, "uuid": "0aaaf31c-bae2-4e68-bf15-2d6fd840ec9d", "comment": "Malware payload", "value": "ee7e50faa5f3a70cc870071818ced15a9f393e4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652697331, "uuid": "fde5110f-9ec6-44a7-85cc-183713ddf796", "comment": "Malware payload", "value": "deabacdfccfcfb7827e3e554cdcbbf9d039ce8d2f6e2f95d7eb89093bf21df1f9954aec8f2ed892a44bf8759cbd83a49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652697331, "uuid": "7f1f6bba-93f1-4219-9f7c-05a77ef7dfe0", "value": "T135A41825FB9C84A2C433593D49E38705E776BC840BA197CB13A4832D2E777E45D3AAB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652697331, "uuid": "e645bf70-0601-4674-acd7-1d0224a53c5a", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652697331, "uuid": "bf3e8708-09a5-4333-b6b0-20df7841aa31", "value": "6144:QeC96WTgknfghx0GL+Z9d/OzzQpV7aGqg3DSGnkZ9Ds2FO+pvpr:Q9983xKoz0/7aG8GkZHFT1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652697331, "uuid": "4c22712d-df0e-411a-818d-b85e3bf44795", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652697331, "uuid": "661d98bd-93a0-49bd-8224-5c59105c99db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652697331, "uuid": "283ec8e7-b853-4dd6-b913-8c3729b530f3", "value": "SecuriteInfo.com.Trojan.GenericKDZ.87662.328.19621", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d6c8da-d4fb-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652693591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693591, "uuid": "6b87816e-4524-4a85-8fec-cd92fa3ae9e1", "comment": "Malware payload", "value": "032d75b1e579ec37ab3f38aa987ae978", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693591, "uuid": "db50c6d3-8e0c-4599-abfb-92d1ec3d6791", "comment": "Malware payload", "value": "ed6d794532b1f4f9925b78592e023965f34e8becb0f1eea0e78d630bfa1c9ce0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693591, "uuid": "254c1e4c-4792-4507-a46f-35dfcca71ccd", "comment": "Malware payload", "value": "a97f733b33bdcb3eb2455a67adf9e8246798e533", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693591, "uuid": "7e498f2b-a47e-49bc-b5ae-7ab9e08113e0", "comment": "Malware payload", "value": "5acd4ada5484cad2996fdf4509b9a4c0e790ebd8117fe429b67388647807da3abd4fdb6c667dfd2a084513cfb428c79f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693591, "uuid": "043b7ee8-b014-40f1-b358-53ed1b225d45", "value": "T1FE82F33EF28A8F9CCB47C2D4050A3F822668F90C93D994D6A7FCF734694595BD722924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693591, "uuid": "32b43b4f-d566-423e-a065-3bb2e07c3598", "value": "384:HmGwxo16ZB4FjephynDBYGoNRjF98PPrd:GXO1hpeyn1YGAhUPrd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652693591, "uuid": "2898c3d9-ce3e-4772-af2e-00aadb65dfb8", "value": 18939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652693591, "uuid": "162c6d7a-56e0-4b6a-a02a-f640329bf22a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693591, "uuid": "64f5d8a1-b99e-4bf2-bc63-15a5e25b124d", "value": "profoma inv.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf5a8698-d4f0-11ec-8e58-42010a9c0032", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1652689100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689100, "uuid": "c930d01b-3a65-4908-8b9b-710819df8d49", "comment": "Malware payload (ArkeiStealer)", "value": "90e7aeedbff0bf1594bbccbdac9379b3", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689100, "uuid": "71668a1d-8e82-4bd4-a192-918c7422baf6", "comment": "Malware payload (ArkeiStealer)", "value": "edfbc84d096e286fb93b5a310b7b855a6e78da75e940ea6039d853142f7c2204", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689100, "uuid": "e842c28c-0e11-48a7-b110-2446d5b108fc", "comment": "Malware payload (ArkeiStealer)", "value": "dc2ea39a37a47850854472c725c0dd81e34b8446", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652689100, "uuid": "bda983dc-314b-459f-9f39-09a4e988a198", "comment": "Malware payload (ArkeiStealer)", "value": "ff3d40f084bd3bb85b9ba47e61ce484471bbaa343b7cef6dfea21a8c251f75c8e998e0a64d88a41d21106451b79a76e6", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "climatejustice-social", "colour": "#C97716", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689100, "uuid": "55f00f57-e3e6-430d-833e-e06a1fc05fdb", "value": "T16164AE227350E032C133193A9A56A7758ABD74316C265507FBE01E3DAEB42D2EF35B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689100, "uuid": "83362fd0-73ad-48dc-8497-b97e67f35e46", "value": "770fcc67a12ef333c7b5eaafd3dad77b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689100, "uuid": "8187b6ff-829d-49c5-a199-16864a5c78e5", "value": "6144:LseUzT5PMpFZNDvx6VXpGAD6QIMk+zFp6AJ0mU6ONmlWMlowD:LseAOFZNDvx6VnD4MkUFp6AtSNmlWM6i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652689100, "uuid": "1142f0cd-8043-47e0-a289-8dd852c2e570", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652689100, "uuid": "fc020ddf-a377-40dc-b668-ced7a07eae4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652689100, "uuid": "94d1257e-27be-4b52-9445-cce19fe62c9f", "value": "edfbc84d096e286fb93b5a310b7b855a6e78da75e940ea6039d853142f7c2204", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac096b9d-d506-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652698517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698517, "uuid": "ff5c0575-1684-449e-b263-f37ba6aaec8a", "comment": "Malware payload (Heodo)", "value": "26487343944875e08e13ffe94d1c9feb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698517, "uuid": "3365f76d-749a-4a85-9c78-2b536dbcb1e5", "comment": "Malware payload (Heodo)", "value": "ee9ae999b0aefbdc3d480b55f9ccc62d89e0b3d2eaa8cce009b0d3ec65463ba3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698517, "uuid": "8b32e890-5bee-43c2-a7ff-0684a263572a", "comment": "Malware payload (Heodo)", "value": "62ab16ea1d18c9228a46ea26f69e65edca76938f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698517, "uuid": "8db4554a-640c-4b01-89da-24c1c8de53b6", "comment": "Malware payload (Heodo)", "value": "573ad2645db43040623e5608cb9d50bfb843939d3377f87525cc12372d26725480bca21638189dc53e5fb6cbd87b82af", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698517, "uuid": "abee390b-dc89-434b-b60b-ff89d400aa02", "value": "T1E7055A31EB6C8492C6A3553D88A34B06EE7AFE940B6183CB12A0733E9E777D45C35671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698517, "uuid": "c08a91d2-f421-4085-83b3-923f981a1f8d", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698517, "uuid": "32e83a71-897c-4a2c-a0b8-d950a97228e6", "value": "12288:BeI3xQoz0/7aG8GkZHFT1Yi5a8kL37eGfv37:cYOozAWGxGx1Na8kLqGff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652698517, "uuid": "c7016ac3-704b-4462-a98e-e13b8fa8eed9", "value": 800256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652698517, "uuid": "9cb8b3c6-4c59-4930-a0c1-29554544e58a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698517, "uuid": "90d3139f-2ff9-4834-9d4e-90533766bc4b", "value": "26487343944875e08e13ffe94d1c9feb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07028f1f-d53c-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652721433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652721433, "uuid": "b9afda5d-446f-4ec5-a7c1-31072a36eff5", "comment": "Malware payload (RedLineStealer)", "value": "8412786f948fec65d8609320f134b170", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652721433, "uuid": "e6087caf-22fe-431a-a5e1-2285e38580dc", "comment": "Malware payload (RedLineStealer)", "value": "eefaccfd459fdbbe9c5c8fe36b7dc58be69f178eab2011487c67dbf7fc7edda6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652721433, "uuid": "17cd71d7-74c4-44f7-bc57-e38337ae0c33", "comment": "Malware payload (RedLineStealer)", "value": "6dcc86c75c3ea7f450cf38d982e1614ede4a6c4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652721433, "uuid": "3d14d3cc-3481-483c-a7da-fbe5aa3a24d8", "comment": "Malware payload (RedLineStealer)", "value": "42c37480f0e7bcd67e1c5e2eb6ead73326374037b15186ae0641270d886e3b5302413bd96b958a4adfe6d7c08de7d897", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652721433, "uuid": "988a5f63-2222-4829-9788-a4bf840b2a29", "value": "T1AC556AA38341931FE383743580DCAE35720656302A3F7C976B141AAADB2B3D15979F9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652721433, "uuid": "07cba02d-f422-45cd-af87-5ea1d106e0e1", "value": "9de116a58a6964e888a644a836e6e83f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652721433, "uuid": "63bdbbcd-f5a9-438d-a7a7-714365be52c3", "value": "24576:P/REYNb0FSffdVgC4MLtNcZoXc0jQxmBzGXHnBESNH82QNi6IysmzJZltl4/m54W:3RZXdVsIDcZoDjQymHnXh82gi6JPzJnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652721433, "uuid": "70eb65d7-d236-452b-8d31-33dccc2a556c", "value": 1404896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652721433, "uuid": "95f14a5a-522e-4d2a-a546-26547a83da45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652721433, "uuid": "567b943d-8103-40ff-ba74-63bc5582d8d9", "value": "8412786f948fec65d8609320f134b170.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42903e0f-d518-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652706071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706071, "uuid": "d0e9635e-244b-4cfe-9639-76ffef789731", "comment": "Malware payload", "value": "90045c5682d7a17db7b258cf01409229", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706071, "uuid": "8b6f1999-00ed-4b91-b56b-102a703cd1f9", "comment": "Malware payload", "value": "efde679a1d5995c36ed8728725213e3c3fac055ee2e4522e04589aa36aa7accb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706071, "uuid": "77316edd-8bd2-4ce1-8f90-cedf439f9edc", "comment": "Malware payload", "value": "8b9466e6bcb42e6fef0ee15b2a9743d2f250807c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652706071, "uuid": "38ee54c0-1345-4df7-901a-c49e086f20f1", "comment": "Malware payload", "value": "af68fc1b1091308629339ab8b92bf91e24330063715634fd3f41d0d69eb6c7043aa37aad8ceac33e074862c1eb18d18d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706071, "uuid": "71de9824-c321-4406-9ba0-200d3f4bdbca", "value": "T16D16D0BDA284775CC01BC4748433AD56F7B1291E0AE9D5AF73E676C07B7B0229A06F06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706071, "uuid": "6c4722a4-4cd0-4cf7-95a6-94529b46b68d", "value": "b56a90921dd65d42c0ccade10216ed1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706071, "uuid": "18b80fa1-8879-49b4-b2a0-b785677af9f7", "value": "98304:7HbzvrbpEYU8XE1sf6fv1HhH4tNO0c8J4yKR:7HbzU8XE7Np4T0C4y6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652706071, "uuid": "bf0f8667-fa53-4f4c-9474-61258023173e", "value": 4021992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652706071, "uuid": "2ff00686-44a1-48b2-afac-4205b206bf5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652706071, "uuid": "4dc6af40-b748-4067-84bd-208b3c7f3459", "value": "\u70b9\u51fb\u5b89\u88c5\u98de\u673a\u7b80\u4f53\u4e2d\u6587\u8bed\u8a00\u5305_z34.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbef8acd-d511-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652703375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703375, "uuid": "bfc21314-7971-4974-8d08-8bcc76943442", "comment": "Malware payload (Loki)", "value": "adf9334ae4a487cebcbb65a491b4810d", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703375, "uuid": "c9d74d94-b947-4ad8-a0ce-dd6022ee833c", "comment": "Malware payload (Loki)", "value": "eff39e42791b54a82b1bba266b453ff91eb8d7429ab84456c7a62505913f508f", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703375, "uuid": "2f16edf3-cea4-4ee4-8f82-e488d51c7420", "comment": "Malware payload (Loki)", "value": "f216a38ff045cbef84d5255b83bbccece43dc690", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652703375, "uuid": "680cfdf3-7f5b-4710-b38e-2aa6b060a657", "comment": "Malware payload (Loki)", "value": "c28ab2525ea83de537b3859c6e670cc1ff5510f6f31bd0b039b3b18f442c33f3da5753c9a3c99ffe124c01f4b72bda05", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703375, "uuid": "8793a38e-43db-42fb-9e02-8da4b1d3c01c", "value": "T18524122A3BED6F30EDC37F3BC92D853A29E9DC89574255256483739988349726EC0BD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703375, "uuid": "72930983-d676-4840-a536-b7085ddd0f2a", "value": "6144:Rpmv8+SMPQok8Qk53o7pZYgxCzk4L11g9ly+L5h8:bmL3V6ZYgxCzkwg9lyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652703375, "uuid": "cc65ac27-70bb-4485-8f06-c2266977588f", "value": 229688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652703375, "uuid": "fb6e5e39-4a6e-4040-b6e2-3ea49ee369cd", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652703375, "uuid": "ee302454-3bf0-4f3a-912f-bba97860e2f9", "value": "RHENUS LOGISTICS LIMITED.pdf.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "745f8381-d4e2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652682962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682962, "uuid": "16b1be78-ab01-431e-b399-0f998038b2d6", "comment": "Malware payload (Loki)", "value": "b7f39befad278950c881a0f5ff5dcd83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682962, "uuid": "159ce228-47a2-49a7-a9b7-1d9e37d4b677", "comment": "Malware payload (Loki)", "value": "f000361a38df0b0599f682e97126ca3120f0261a8555e7bb03595152fdb7d4e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682962, "uuid": "8db3fa82-6618-4a32-943f-e423d303b184", "comment": "Malware payload (Loki)", "value": "f2c19aec00e78202230c4761f9d13cf4fed96188", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652682962, "uuid": "f147ab5f-a41c-4db1-9501-a8aedf9649e5", "comment": "Malware payload (Loki)", "value": "7a7e9da80931dd43182f9f085aa7388ed52e23c95cfe371b97ba5f83eb64cf6c907d74f1eb8c9eff8feeb7c48b0bd833", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682962, "uuid": "5c70791f-da92-4de2-9882-1d9c66a9969f", "value": "T12F941380E3ECD366E2BAABB5957248540375F4099962E73C1C87E0F53C33F498E58E26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682962, "uuid": "d5a9d82a-da17-45c1-a885-d661fe9c2ba9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682962, "uuid": "d2aa88f7-3d96-422f-a52f-aa1f03af8f3e", "value": "6144:6QIGJDyJTy7JyVupBAQkcl0JDbzuXUCqQkvjP6vTXVMBcjVSRYTCWdOzueRH3cdp:DUTy7CYBdn+pn4RTllRT6KeRHsZ3H9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652682962, "uuid": "4ae576da-e648-4081-a823-75b658b13dd8", "value": 444928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652682962, "uuid": "d482b6aa-9025-431d-b69f-268ae53708e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652682962, "uuid": "f1c77cac-6b2f-4f72-ac08-3112604ebb32", "value": "Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cef1b948-d506-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652698576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698576, "uuid": "e3d2f563-c629-4c12-9a9f-3640d6f5fcd8", "comment": "Malware payload (Loki)", "value": "3124c4d4ac0a968f85d07bafc4107c3e", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698576, "uuid": "b09eaf53-c8c3-4bc8-81e1-e34194f58bb1", "comment": "Malware payload (Loki)", "value": "f139f5909498aaf87c2702af2975eb7359a244c8f6d88071f5f7ec614cdfe55b", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698576, "uuid": "fd802e45-960a-40ad-8862-e88044768141", "comment": "Malware payload (Loki)", "value": "d29f42b8c9a35248901abd08984072b9fc78fdd9", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698576, "uuid": "270266c7-115c-4e09-860b-cb40d0cb26e4", "comment": "Malware payload (Loki)", "value": "fc0f801638720b9ada6dcfa03059e2652a169cd320637e7ffbde2186325ba53f7f4932b57ff8776b02ac930dcddc7904", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698576, "uuid": "d3a616fe-32bc-43f2-86ae-16dfcb5019dd", "value": "T1052412EBBF5F4040DE7229B5ED3123E8993BED78C249BCD461C87525063AB90B1C166E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698576, "uuid": "87c20a11-801a-4c74-a9bc-a812800502c2", "value": "6144:MwkhkAmMGfWL1RB5VF/+DFyqcmphqPpjMa8E:5ckABGfIL5P+Dnzvs1M7E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652698576, "uuid": "25e64ef3-e077-4fb7-b666-255197cc0a8e", "value": 228968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652698576, "uuid": "05fa9abe-cc4d-4d16-9f5e-b303c76bb67c", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698576, "uuid": "33f8648c-17f7-4f21-9979-b2d6d8dc01f9", "value": "Swift copy.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74fd9905-d50d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652701431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701431, "uuid": "60412f34-8fb7-47e9-b8b5-02438c85a52e", "comment": "Malware payload (AgentTesla)", "value": "9d64e007c93567fbfd00977086cbff38", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701431, "uuid": "a4c32562-aba2-422d-bddd-a6dff91e3c9e", "comment": "Malware payload (AgentTesla)", "value": "f1984bf5370dca828dc0c7fd05e54b394487caa40f4c608e0b2f321e0f9d66bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701431, "uuid": "50f8b398-5386-4a51-8201-94a57b3eb9b9", "comment": "Malware payload (AgentTesla)", "value": "b12242c3b78838ae58cc847e358fb65f810d0356", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652701431, "uuid": "63d3af50-bb46-4b39-8666-6e6540309e72", "comment": "Malware payload (AgentTesla)", "value": "eff8b0b24dceea9711af601ead604d480800290b15e91c8d20ab85ddcc6f64daeff79d7e49dde0662bc594285a72993c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652701431, "uuid": "f843067d-61ea-4323-aebe-2a368ce65286", "value": "T1DED4F1AC721072EFC857C97ACAA91C78BA607477470BA203945755EEAE1D987CF240F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652701431, "uuid": "9fb14022-7244-4f7b-aa2f-a5a9169339ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652701431, "uuid": "8ba5daf4-bead-4cda-881d-b973217ff8b8", "value": "12288:EPP0iKJIiSnEGxOrlAqE9ml/YK6yVHdfXyNOosxu8h90wo0Xqfs436Q:EPPX4IimEKOBB4o5hHdKNOW8z0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652701431, "uuid": "62577aa3-e7f4-4695-9b76-d3b344a4d9ac", "value": 628736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652701431, "uuid": "c005092f-0900-469e-81cb-77c66b72dc23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652701431, "uuid": "7c2b1899-fb00-49ba-ae70-6aac59db1762", "value": "9d64e007c93567fbfd00977086cbff38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ffa358-d506-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652698510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698510, "uuid": "2067133a-10f2-46b6-a63e-d24ac6987adc", "comment": "Malware payload (Heodo)", "value": "6ca44b15681d935bf37ca7496e515d8f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698510, "uuid": "3c3109d4-3fa2-4852-8251-fcd04d57bd68", "comment": "Malware payload (Heodo)", "value": "f1a59f89fed75effbcc67aa55ec514426ef399764ed385ffa995f0de193c9544", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698510, "uuid": "ce84e610-5840-4466-bfbb-abad26d9fa60", "comment": "Malware payload (Heodo)", "value": "4bd44bb770bcb093eca7abff63ff2afc39327d49", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698510, "uuid": "52daeabd-a619-4625-b9fa-9d424ad453bf", "comment": "Malware payload (Heodo)", "value": "7c8702887773196c8aae8e1b651139c22a8df5351abf31cb9b9cfd975dc5e0ba075d0858e088d98b4d840a8bb14bd2ba", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698510, "uuid": "43c004ba-d0f5-41cb-9a95-091179219d96", "value": "T12D055A31EB6C8492C6A3553D88A34B06EE7AFE940B6183CB12A0733E9E777D45C35671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698510, "uuid": "00500596-65a3-4ea1-9d2b-d3482c168e4a", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698510, "uuid": "ba1cbdb4-6068-496e-ba53-e358e8052e03", "value": "12288:BeI3xxoz0/7aG8GkZHFT1Yi5a8kL37eGfv37:cYzozAWGxGx1Na8kLqGff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652698510, "uuid": "bd0d54ed-89f0-41e8-9e43-419d88cc6dac", "value": 800256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652698510, "uuid": "f701fa26-2929-4fd2-8029-df121e4dbe23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698510, "uuid": "d2ce721f-c149-4342-911a-5b0404054cbe", "value": "6ca44b15681d935bf37ca7496e515d8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8654407-d4fa-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652693437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693437, "uuid": "1a085aeb-567f-42b4-b9df-1ec189badd9b", "comment": "Malware payload (Heodo)", "value": "8e0e7560b7056bf47b0d30dc466cb1db", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693437, "uuid": "f1b33954-f50c-4f14-91d9-506598eeb264", "comment": "Malware payload (Heodo)", "value": "f1b1c073079288d6be77154c5575df12928c41f406cf2cc779c366e43f9390e9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693437, "uuid": "a2655469-f077-4d90-9178-4604b881add1", "comment": "Malware payload (Heodo)", "value": "fc17df3f95b2e4d8edc13b017df066da17c006d7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693437, "uuid": "38f91660-c5c9-4c8b-bfc0-6e784cec5978", "comment": "Malware payload (Heodo)", "value": "69ee20f1985a3709968297303631bdde27f7a5a0bd6f100775330781a4c03887dc6b32cf4b78a4b3b05cf4c42c5939c4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693437, "uuid": "4490a948-54a3-4005-87e9-fd87851da327", "value": "T1EA055A35FB6C8492C6A3953D88A34B06EE6AFE840B6183CB1290733E9E777D45C35671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693437, "uuid": "7e243616-a2da-41ab-955f-ac72f4115dcf", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693437, "uuid": "453abba9-2502-494e-8f94-2108283f8d1c", "value": "12288:Q9983xaoz0/7aG8GkZHFT1YicDAXmvQaZsbNg:A9UUozAWGxGx16AWvVZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652693437, "uuid": "866b38ab-fdf8-423f-866e-38d7a9266356", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652693437, "uuid": "3340521f-80db-46bd-b3e0-dadd609b86c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693437, "uuid": "155f73be-234e-4591-9193-28eaf26d8ab1", "value": "8e0e7560b7056bf47b0d30dc466cb1db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a0afd6e-d4dc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652680287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680287, "uuid": "db7824f1-551d-4129-b8dc-033d1e223986", "comment": "Malware payload", "value": "3940bcad7beb9e31f88872d5e834c864", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680287, "uuid": "ad56e461-4d90-4d86-b3e7-0a91739666fe", "comment": "Malware payload", "value": "f1c61aa948a4c4c5700fc20c0050ef5960c8a5c08b7168bc555fa13e9809ade6", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680287, "uuid": "71ee6062-581a-4f99-81a4-c6b2b6030285", "comment": "Malware payload", "value": "a85c7bf410c2b2213a79a3865a14531451945eaf", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680287, "uuid": "db7f0ead-3101-49c8-a968-302bf0abbae8", "comment": "Malware payload", "value": "9a4de04082571d9e77189bdb54b0de547897dd34c9a0c505b45a93d92cd57b480c575d3694b7d2ebd4b3bf4c8143661f", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680287, "uuid": "3d724386-6e76-4dd5-8166-cbacaf1de548", "value": "T1F193F19B67685388D1A17A7E23684FAC31971C583A32CAFB093FB28E1471C791D617D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680287, "uuid": "cc71d014-f35c-4f18-bfc1-b706f9e14e72", "value": "1536:XcyT+qxKSfMnoCNYqD5JumykHevWvnnX9KmZ47AB1e3sj2dsyUI1sm7mUagj:XbtDMjZ2BkH7vnkmZ4m1rSdOI1sCmq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652680287, "uuid": "0084bda5-cf2f-4adc-8326-e8d57e30e7b4", "value": 95744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652680287, "uuid": "fa4719d5-b4c4-4367-9748-464e6b3a77d2", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680287, "uuid": "f0d351b8-3c6d-46b6-b0bf-8ffa7f7b5a46", "value": "MTS_Tradings Order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebcbd47d-d56c-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652742433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652742433, "uuid": "c8021b34-cec4-4759-a07d-27643428311a", "comment": "Malware payload", "value": "bb51f08ae784788046ad1216d4e7ec98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652742433, "uuid": "58a52ae7-9aab-42f7-bb09-e6cb3c5d6508", "comment": "Malware payload", "value": "f29af82e03ef39291f1b183cab1fa06d12d17e8bd1f06a0de775e8dd4aac99da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652742433, "uuid": "7ec0bbbc-bd45-4b40-9eac-4d2795ff2827", "comment": "Malware payload", "value": "f76b796a7700d63637a07ef9a61ce6e1b2af652d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652742433, "uuid": "ccacf345-7cd9-440c-9edf-98526ccf0bd1", "comment": "Malware payload", "value": "adc67843ec4dff550f52e503e1558afb32cb3fcdb90e1ceec95e8c2f78b88902c2fcfd06637a7e39c3c0d9e1dcc52c91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652742433, "uuid": "70a3ad4b-534b-4a5b-9c7f-0edda28465c1", "value": "T1FDC5DF8270EE6459F823B6F4AFFDC379D726B9E5472B891F249A32274AD0D011E011F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652742433, "uuid": "0b0fdcb5-8d46-479f-bb60-81b1a5c6e6f5", "value": "3905245de09d9e993faa8b831fa6d168", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652742433, "uuid": "d1d6be37-2021-48fc-b955-886939572be9", "value": "49152:bLUJZ28GlWX9JUaq5TBfmsXWz92JyZ4leULetdr6MfQykYtod:bIO8iWMayTsKfzMIykGod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652742433, "uuid": "bcf7c8ee-c130-400c-986a-1fa01ac85842", "value": 2500032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652742433, "uuid": "de95a1b5-73bc-4145-a9f9-bdc433317cc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652742433, "uuid": "9466b61f-bdcb-48ac-a99b-af37b4a76503", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ef2a083-d4fb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652693583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693583, "uuid": "1e29db8b-7045-4746-80a7-d4c41bd13426", "comment": "Malware payload (Formbook)", "value": "7924895d69c4de7b650589aa75aae4d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693583, "uuid": "bd56898d-bc13-4357-95ff-841c0d32461f", "comment": "Malware payload (Formbook)", "value": "f3b24e8727cb2cbd2261e7f426a6b393abb7e25fc3bd2e4fa2a249004f351305", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693583, "uuid": "ce725471-9f60-47ee-bccd-14190ee3b47e", "comment": "Malware payload (Formbook)", "value": "bf8f2cdd2f3008f72e8f25cae8f19dc09684f928", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652693583, "uuid": "e22e37cf-6c95-4428-b58b-b99a0d883535", "comment": "Malware payload (Formbook)", "value": "6136f7e044c1ff379715d3fd36d0e774e0d44b58ff61dc1b2f4932d0820effe368f6b6dac104ed7f7a17195b349da9d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693583, "uuid": "55c6471b-db73-480f-a8b7-5b4644c51dca", "value": "T17EA40296734491E7FD380332986F469A27B7BC375A940C5F3B88F76928E1252841FE1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693583, "uuid": "63144ed3-1a53-41d2-9c52-e331a33bdb72", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693583, "uuid": "1929f281-a27c-4f7f-abcb-f2957434f71e", "value": "12288:4Y4skpPmHK7Giv2ccIe+lNiPALEqo76w+wx:4Y4skpPmHKL2BEiPANo7px", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652693583, "uuid": "5796122a-0d39-41b5-9fbc-26ccde97295a", "value": 482362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652693583, "uuid": "656529f2-036c-47b4-bc14-62c39d0cc78a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652693583, "uuid": "7e7f34c0-3197-4c12-a9ee-6d3243536e36", "value": "COMMERCIAL INVOICE_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c0a1a5c-d4dc-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652680263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680263, "uuid": "b3daadba-349d-4ed5-8e80-eb1bc649c869", "comment": "Malware payload (AgentTesla)", "value": "1ad7728aadfb20a10871639ab021f41d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680263, "uuid": "c96d849e-fd3d-4617-89b4-3806839731df", "comment": "Malware payload (AgentTesla)", "value": "f3b55a3b048bd5b467d95a04bb1f9dd4c96e4659b9eb51f0f73c0cd682fe7bb5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680263, "uuid": "3085f746-a49f-45a2-b5ed-081972a3c782", "comment": "Malware payload (AgentTesla)", "value": "966b11b3109042cd88cfe0abb1b85be17e25e3c4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652680263, "uuid": "423725d9-c976-443e-8163-441db026a1c9", "comment": "Malware payload (AgentTesla)", "value": "f1f1871a80089d1102583bf94d98496d659193726b1f1253d6f9f764f32cea4dc11579933181f1e49833137976fcdd53", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680263, "uuid": "dfc74112-4c97-4cd2-a38f-c7e77c90c5ea", "value": "T14FB42317611D6EFE5D43D957FE05F78EE3DC09EE6AAC631C5803341A07A20EEAE60249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680263, "uuid": "fa250307-ddaa-4847-8a47-3744735ddd94", "value": "12288:BlArGR60bcEpxtxwsfLLo/WqAKpNRYWK+s/NpLs7X:BlIGzLxXHkOMNRbz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652680263, "uuid": "c0bf199e-9fd9-4247-ac39-7efc5e41e668", "value": 515153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652680263, "uuid": "f613ad33-623d-4422-83a4-9f878dc4eab7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652680263, "uuid": "0331e731-f740-415f-86fe-6a54e0c034f5", "value": "EXPX22-12-05.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7285329-d4fe-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652695100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652695100, "uuid": "084ae443-2d6c-461a-8fc3-4d6163b187b7", "comment": "Malware payload (Heodo)", "value": "cf1937ebe1cc7a1b02717f4a70482dcd", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw cm2FrCxH", "colour": "#3ED7F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652695100, "uuid": "f7ad2ae9-1828-4013-ab4e-455be8488d7b", "comment": "Malware payload (Heodo)", "value": "f3c7d445d1414d88cf2eef211a3c663d8fb3ca098cd38ad12dc0e976fbcb1293", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw cm2FrCxH", "colour": "#3ED7F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652695100, "uuid": "c5e6fb09-4bba-438e-9ecf-98914ec90a77", "comment": "Malware payload (Heodo)", "value": "717c455284f740434b1f979ad62424eeb844e10c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw cm2FrCxH", "colour": "#3ED7F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652695100, "uuid": "c2ede8ce-934b-4319-881e-63cba6a78bcb", "comment": "Malware payload (Heodo)", "value": "d08676738d70eca6af705abb8a41990de6db7d4a263baf15999d6ece5e7b6cd817ee29823bb4c59636310322b8dd3cce", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "pw cm2FrCxH", "colour": "#3ED7F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652695100, "uuid": "f5eba8a6-8d32-4ced-b84d-fa0231a82a52", "value": "T16F055A31EB6C8492C6A3553D88A34B06EE7AFE940B6183CB12A0733E9E777D45C35671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652695100, "uuid": "f110b413-ac67-46dd-ba18-72376878dd0f", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652695100, "uuid": "c8f53672-3b37-46ac-a9b4-ac28bb20dcea", "value": "12288:BeI3xJoz0/7aG8GkZHFT1Yi5a8kL37eGfv37:cYbozAWGxGx1Na8kLqGff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652695100, "uuid": "944d1f86-bac2-4257-a2bd-c204ba570823", "value": 800256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652695100, "uuid": "08f3748c-87da-49f9-a28a-c8638d896e09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652695100, "uuid": "d5a19314-c2e7-4b99-9379-15081bb546ca", "value": "xA9r2IRewcmAie2b.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc9bb400-d541-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652723992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723992, "uuid": "ca31e849-a1f5-4fb2-93e5-df27ccf9425b", "comment": "Malware payload", "value": "faee76e2aa8ebe44bad0ce82807d4276", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723992, "uuid": "85852fbd-2a40-4404-b0bb-eb9126a7acc8", "comment": "Malware payload", "value": "f3d1ef74610fbd706d890cab63aa43012ee9183f1f04d0b06f47fe78c946edb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723992, "uuid": "8816f09d-9905-43b6-b037-f6f5f257e04e", "comment": "Malware payload", "value": "e6f0e61430958ead7ae04c7313a11cdcac10afcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652723992, "uuid": "53cc1f56-978e-4923-8867-cab8e73d52c7", "comment": "Malware payload", "value": "b084f8164f1db86818b3388be7fb05d4e23797c7299229aed5489f9058de4ba254ecd609fb8a30605d9d347a032d0819", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723992, "uuid": "3f54c738-c910-47ab-89e5-78366ba3c87a", "value": "T13874C046B3A840BAED678338CC535647E772B45A4B70A78F13244379EF2F3915A3A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723992, "uuid": "28148c62-0ff3-4d79-9cc2-62796380abe3", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723992, "uuid": "6b94a309-22f3-4964-8ed9-5c564c72eb7c", "value": "6144:Es/2WX22TR72tKbxGeGkr2rlsy+vbEFXYvlx6xJkUjnKd:Es//Gi7/GgDvQFXTH9Kd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652723992, "uuid": "c63212dd-cac1-4fab-80e0-b9a5d2392333", "value": 367104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652723992, "uuid": "df764111-d404-455d-ad51-7e9497e9190b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652723992, "uuid": "4cb10a05-ec25-4c2e-a660-13b56aa33997", "value": "gED7oFs6fOuZ1zi5FA3yUwjPex.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8c09d16-d536-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652719261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719261, "uuid": "0d73b880-bfc0-41a2-a5ca-23568c61e347", "comment": "Malware payload (RedLineStealer)", "value": "adea53c9b681a10b450569f7fb632bf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719261, "uuid": "60163ceb-e92c-40f4-b45f-5df33cf60930", "comment": "Malware payload (RedLineStealer)", "value": "f492b2bf8db70068e31654af82901016dbc2190f6d3e3a88618289ffd9026722", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719261, "uuid": "42a0a4fe-aee1-4577-869c-5e04b30a52e4", "comment": "Malware payload (RedLineStealer)", "value": "f8a8a767eb3ff08a82228fcf6b14daeae78b6aa2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719261, "uuid": "ffd6db16-f0d4-4c02-81b8-cd187a58360a", "comment": "Malware payload (RedLineStealer)", "value": "afef207ab19d32ba5a9d54a0622621ec072f04ec73b678ceb2a72bd5189895fed4d915d195c53eba6cc71a298a665875", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719261, "uuid": "b56dc923-214d-4198-8a6b-083fe9863740", "value": "T1B1A4F102F760CC31E0821E704A2587B2977BB8227574847BFBA157AE5EB33909AB5357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719261, "uuid": "5037663c-c160-40c2-bd98-994d5f61a297", "value": "153dc3f428c35b5ce77e7e0eb3b25328", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719261, "uuid": "3051257a-a5dc-44d9-907c-6f3c65ff5b20", "value": "12288:RGvDSdE0HpK/CplVjE1c5bT2QdchBcScNtRtN:RGqE0HpK6plaGtScvRtN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652719261, "uuid": "0d8e7147-b455-41e9-9d5f-366f778343f8", "value": 460800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652719261, "uuid": "e2eba548-774d-430d-917e-399b83669322", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719261, "uuid": "d899345a-85fb-49ef-8982-bfbfb32e7343", "value": "adea53c9b681a10b450569f7fb632bf3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eb8bfa5-d569-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1652740907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652740907, "uuid": "41ab5bc6-0baa-4b4e-bea8-f343488f13a0", "comment": "Malware payload", "value": "ced44e0f6d19643e40d7f40e65d67bec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652740907, "uuid": "67490dd9-89ef-466b-acf0-c6825cb0cc57", "comment": "Malware payload", "value": "f4d18c22d0b1ae99f60b3d5f5deb11896bcbaec1bead2576cf688d20e4f72762", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652740907, "uuid": "43028b3e-38da-4290-a2de-4d9a962e30f0", "comment": "Malware payload", "value": "2399acda8c98bc7fdc68ebbc520fd69523510f4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652740907, "uuid": "78026cb1-13cb-47e5-a4a2-78eeeffe51b5", "comment": "Malware payload", "value": "87f0acdae2f64404ef93fca13d0b5084218931e9160bcb46fe313cb3c36bb887e0b6ed91b9df6ceb39ae8f4aadb2a443", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652740907, "uuid": "58b24028-d73d-4fed-8272-6a85a183681b", "value": "T1EE84C04573A48079EDB79338CC574A47E376B86907B0678F1364436AAF3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652740907, "uuid": "d7018979-eb20-4655-9f1b-de53cbf2b2a7", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652740907, "uuid": "07fe98e6-e82d-4364-8b23-07ed13e9ba72", "value": "6144:EbmRW/X22TR72tKbxGeakesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/apRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652740907, "uuid": "97a05174-e2f7-44cc-abf7-7061c4f40c8d", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652740907, "uuid": "ab90915c-e78e-471a-8b18-6879b61ac020", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652740907, "uuid": "2e3b0e9f-26dc-4d4f-b79c-2badc92e8036", "value": "ced44e0f6d19643e40d7f40e65d67bec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5854e8aa-d507-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652698806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698806, "uuid": "0559c0dc-b671-487d-870b-12a815a2d95f", "comment": "Malware payload (AgentTesla)", "value": "f57505908f0e0bd664a242bd78d26400", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698806, "uuid": "c82b7cf7-e6cf-4c26-8eb8-2f129a1eac19", "comment": "Malware payload (AgentTesla)", "value": "f50b680a74f976d8f7000583ed7baffbed87999273660a67f822211d4dd69aad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698806, "uuid": "56011db3-77b2-43d4-9fbc-e74e399a1fb1", "comment": "Malware payload (AgentTesla)", "value": "823846dfcea444aa7b60f2d9fd41d0fdc3f463d9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652698806, "uuid": "26f8bcbe-6a0c-4463-820b-fa26e5d56e25", "comment": "Malware payload (AgentTesla)", "value": "846e9ea965de72fc5697396a6a4def127ee27c0e53ae663a71456f6f84691e1d20fce5b4cf5edfe06625e67c777365eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698806, "uuid": "ef871528-5a38-409d-8e7b-62084493dab0", "value": "T168C423E450D867CAB81234A99ACA40D65A1370F5EA95BFFD19001973EE37C06BD3FB84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698806, "uuid": "91eece1e-f6cc-4adb-b0fd-94d8907b2256", "value": "12288:tdgmhNJtH1PwQveyYWY1QzjEQlSEQc2J1sWEuwAY:0mgK1zjb61sMwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652698806, "uuid": "2004bd5a-b01b-44fa-8504-ddc741542de7", "value": 578019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652698806, "uuid": "e83c40fe-28ac-4af8-88db-5c65c6c1de01", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652698806, "uuid": "e4905c24-81ad-4e50-89e8-87713a2a5702", "value": "New Order.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ff5330c-d4ef-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1652688538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688538, "uuid": "4b5d1534-ab3b-40e7-8953-1d2a2083516d", "comment": "Malware payload (RedLineStealer)", "value": "cb8cd07d32498986d817939e06ac4abb", "object_relation": "md5", "Tag": [ { "name": "176-10-119-117", "colour": "#051CED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688538, "uuid": "1c4da3ef-76eb-415b-9bb5-28ec0fb5c62e", "comment": "Malware payload (RedLineStealer)", "value": "f751501b33b4d7e35aa20d08f718e5a8ed1c0471b4da1bdd2562a3536d83d58e", "object_relation": "sha256", "Tag": [ { "name": "176-10-119-117", "colour": "#051CED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688538, "uuid": "ca3c2c8c-9513-4a06-a517-95b002a4c0a2", "comment": "Malware payload (RedLineStealer)", "value": "1de2ea093784a9b7ff6d1fa6d6877fdae990bd42", "object_relation": "sha1", "Tag": [ { "name": "176-10-119-117", "colour": "#051CED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652688538, "uuid": "5150274f-a5d6-43d6-a33c-6ce9a62f002d", "comment": "Malware payload (RedLineStealer)", "value": "f30d34920ea401f38652304151bf337571bb64724b1c3db82510393286843a000253afe117f8ff8225752a6dbd02b9c8", "object_relation": "sha3-384", "Tag": [ { "name": "176-10-119-117", "colour": "#051CED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688538, "uuid": "01bc1afb-d899-481c-97b9-c91e739af403", "value": "T1FB45132367A868F6EC4061F84C75FB196636FE9206C68607F7CD40ED1A83BF365981D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688538, "uuid": "64d1cbcf-fe7b-4cb0-b53f-75dc308f4032", "value": "00857ea9cd7854d609a108cdb24f421e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688538, "uuid": "5f0c49f1-0ccb-401c-83a6-56bac9ab6095", "value": "24576:oOdglvqMlluHvR8I2GYQKLfUhhWuVWI+vVineAt1Fqw53pzNyivFkv52:oOdgZqMXuPRL2GTYfmh/AvViXt1As3NB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652688538, "uuid": "a19cd7cf-63e9-42be-98d6-51ad678de089", "value": 1223200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652688538, "uuid": "ab5329a3-48ea-49fe-bd75-c560ba7c40d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652688538, "uuid": "2cc23bc8-ad60-43a9-af49-d41bfc9818ea", "value": "f751501b33b4d7e35aa20d08f718e5a8ed1c0471b4da1bdd2562a3536d83d58e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f66b3348-d501-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652696494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696494, "uuid": "40f839d7-26b2-49b3-bf54-bef896a19eae", "comment": "Malware payload (Heodo)", "value": "42639e23da81517d90fae085b23216a0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696494, "uuid": "2dc8e45f-6ae2-4994-8edc-bfad52bf951e", "comment": "Malware payload (Heodo)", "value": "f762c809e13674d28a3d2fd5822154f9a536a7a2d63addac866d56bb9c5eaa38", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696494, "uuid": "c1a40f47-109e-40c5-95e9-175d871e1c99", "comment": "Malware payload (Heodo)", "value": "7691eba7a11837b44a4b3acb787a0d52bfbe6fcb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652696494, "uuid": "ce535942-e84e-4412-9b8c-98572ae2332d", "comment": "Malware payload (Heodo)", "value": "cf86ec0bacbd66ee574607636da9af1639e4dc0d459c015910a091e7d2bf00197cba9ff1400baf9d14cbac1d96c70926", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696494, "uuid": "d0011427-7d0a-4ee0-8c0e-76b4b1b351e3", "value": "T1BF055A35FB6C8492C6A3953D88A34B06EE6AFE840B6183CB1290733E9E777D45C35671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696494, "uuid": "20b8bfe5-5b1c-42d0-8997-f63c469bdcc4", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696494, "uuid": "4898819c-6bc9-4489-a267-851c96ea90a1", "value": "12288:Q9983x5oz0/7aG8GkZHFT1YicDAXmvQaZsbNg:A9UXozAWGxGx16AWvVZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652696494, "uuid": "9302718c-b8c7-431e-a500-d962d8be6af0", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652696494, "uuid": "f63f5118-f3dd-4a50-9b27-6b3b36039f11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652696494, "uuid": "96176b91-7c29-4ead-b6e8-2e67757b64ed", "value": "42639e23da81517d90fae085b23216a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df537e5-d52d-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1652715136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652715136, "uuid": "1f72c519-c69d-4c52-bb8e-2f7e4de23e20", "comment": "Malware payload (AgentTesla)", "value": "70447892d7eb692ffcc175767782e24a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652715136, "uuid": "72061f24-72c4-4d7f-84d5-2264e27208e3", "comment": "Malware payload (AgentTesla)", "value": "f80bb1eab495b58de26c9fa92c847d19235b090c23d5f85fd3963d87a9051e30", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652715136, "uuid": "38d798c3-ae84-42b1-8d17-9f8dc71a3153", "comment": "Malware payload (AgentTesla)", "value": "37598ecfd470924f740293711c1fb19a1c1ceab2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652715136, "uuid": "8d506fa5-e0c2-4f1a-a4b1-e9cd50d8e473", "comment": "Malware payload (AgentTesla)", "value": "3010efc26c24a81a8da198b05495da52a1ac08d6a16a5e7fb7e38a63ee716ac14b7e416e718eb27159131af816fcd0c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652715136, "uuid": "0214097a-b463-4b45-8bcd-e5d7dc0308b7", "value": "T162D4F0AC726475DFC85BC4B79E992CA4EA61743B830BA217941351EDAE0DA87CF140F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652715136, "uuid": "c16bf632-ea71-44f6-8ddc-a79010379fe2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652715136, "uuid": "0b01c21b-a311-4ff9-867b-1c642367364d", "value": "12288:7+z45O24Y/N6tszLBRY5ob+XeY1A+LrXPecylF07+mIp6Wa8TQ6Q:l16tsnDgoyX56+Lrmcyl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652715136, "uuid": "b9af21af-ee86-4a5b-ae16-9595ce90c8a6", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652715136, "uuid": "ebed631d-d7ae-4b28-a964-b460462e48d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652715136, "uuid": "ec294663-aef7-451a-8c6f-9bb756bba18b", "value": "shipment details - 21.6 MT COUVA 760P \u2013 SO 10169195.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd7227cd-d52f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1652716182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716182, "uuid": "79edda6d-062e-41dc-9401-d922bc125395", "comment": "Malware payload (Formbook)", "value": "5becc4a8b3c1f288ef3f1e4024c2ca95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716182, "uuid": "b8f7a57b-10a8-49c5-aa6d-0f19df0bdd74", "comment": "Malware payload (Formbook)", "value": "f81bb59f9b30e3f46a675269f7555fa98f39c4eec809f2c8f29df56d6264fd20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716182, "uuid": "b8f050ba-ff15-40db-b4ec-7b9ba4aa741c", "comment": "Malware payload (Formbook)", "value": "8d7a45781520399cb25fe570f384ded3246604bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652716182, "uuid": "a043b8c7-6d0e-42f7-a1de-0121262ddac5", "comment": "Malware payload (Formbook)", "value": "2bfe9fe40be57c03e40cdca2d91d774fce668b49370273fdf9d40c27c4cb99aa83817e768b1e4ba546c8d80cd02567c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716182, "uuid": "f5eb34c4-23e4-4a0d-8b72-1a6ff0b31fc7", "value": "T169C4012C3BA8CE01C5A86AB5D2E7C47803F2D58B62B3D7137DCE45D50D523A98EC8B59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716182, "uuid": "2566d3fb-cb97-4aaf-a70d-ff36e5cfb205", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716182, "uuid": "67e498c3-9c52-40eb-93cb-ddb4005281db", "value": "12288:Pc81mlKqFCFdNbG/cF9IvSClFyD+zGB6+3ELCKeQMjesiJGPNF:0Yw/FCFSP5FyKSFELC1QVsiJO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652716182, "uuid": "3fdb8d8a-6eb4-461e-a371-0a9f865b914d", "value": 568320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652716182, "uuid": "268a5883-241d-4b64-b35b-d89a889801da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652716182, "uuid": "9b442aa5-c0ab-4f47-9559-de16cc25287b", "value": "PDF-SCAN-ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b452945c-d516-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1652705403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705403, "uuid": "e132c601-b888-4000-93bd-5a68a5729343", "comment": "Malware payload (Mirai)", "value": "55fdda28d267940db1d3961e0416e98b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705403, "uuid": "1693063f-1c63-4320-a3fa-03e5c4dc3394", "comment": "Malware payload (Mirai)", "value": "f93658967caa28b923d6eae7ba189d092a7f0a41e3658abf1d061515f82dcd06", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705403, "uuid": "47a546b4-97c9-49dd-8df3-b65a76277feb", "comment": "Malware payload (Mirai)", "value": "1c0dff84a74dc50e2e43ecf89143ea08d379e155", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652705403, "uuid": "fc56653f-7aaa-489e-b4e3-7ae200f1b21f", "comment": "Malware payload (Mirai)", "value": "9659bec30c742d0804e4b963f96244145931fb3a610eb1c44ae2046088160a0b2ce818265668de52a1c01cadc718c7be", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705403, "uuid": "0c369651-515e-4d77-91df-72a4f24ad635", "value": "T1732302B1E71DE4C3C193B876ACE90641626B4FE6D1BFB03417A676FC508184B2EAC243", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705403, "uuid": "5c7cbed2-ca4f-4364-8ee7-d0e9bf8bd5ad", "value": "768:w5lpPa7beMGLDtWFuCLImiVKb0rmekqlE2F9q3UELeUcIYSh4e5MgzEazSjY+s:wJPa7bQ8BWr9+2YLXNYwuk3Sjvs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652705403, "uuid": "93971ec5-aac5-4126-a7c9-a31a37c0dcac", "value": 49088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652705403, "uuid": "bdfed5a0-7e0d-44b6-b925-009070db05ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652705403, "uuid": "09539d1c-73d4-40bc-b480-667eea3fd0c7", "value": "sora.arm7-20220516-1250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "274366ec-d52b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1652714186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652714186, "uuid": "64c09d95-e95b-41ca-bc7e-a3133c8f1bc6", "comment": "Malware payload (Loki)", "value": "2d0dd63f3d5f83a74ae05ae622905034", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652714186, "uuid": "ddbac089-98b9-4056-990d-a3d2b73ff6bc", "comment": "Malware payload (Loki)", "value": "fa507820dccc5e1445a137ce231bb77eea9827b5946013ce28122495184def0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652714186, "uuid": "3baa5723-8d0f-40b3-b68f-e165aeeb81fd", "comment": "Malware payload (Loki)", "value": "ac149498cbad3ecb198f3af72aa918b9171ba773", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652714186, "uuid": "d7767511-b252-4921-8091-1bc4425cbda9", "comment": "Malware payload (Loki)", "value": "a7fa45c16f5ceeaf383efb10dcec5d637d5c9dbddb95735de547849722a0316ad6778f23b3587f977f0e0b62f08864db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652714186, "uuid": "fdcd9cce-98a3-4381-bece-6f70353660fc", "value": "T13AA423493AFC9329C5351BF3612E5EC28B36AE43A473F61A1EE561DA07323084DD4B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652714186, "uuid": "225e12ee-cb39-4424-84bc-a99b0016f408", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652714186, "uuid": "b8283a6c-ad8a-4385-87e1-bd335121ff10", "value": "12288:C9gqnI/nv1vBU7lBfy5s2KaUSi60XUQ/Y5:MI/v9EfWKUi6QUQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652714186, "uuid": "2cd021db-51d2-4021-a141-8b726967ce52", "value": 468480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652714186, "uuid": "a6d994a6-bc4e-45c3-9e92-ae7c2196e2f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652714186, "uuid": "d43d8672-bb37-4e74-baae-5d66d2c6175b", "value": "2d0dd63f3d5f83a74ae05ae622905034.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5804cb9-d4f4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652690802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690802, "uuid": "d2e747a9-c11e-463c-a774-f8ee5a5b96a1", "comment": "Malware payload (Heodo)", "value": "cc65fc981ebfe6472107c211fa2b4a13", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690802, "uuid": "10792b16-8bec-41ca-aaf0-e29952e87f42", "comment": "Malware payload (Heodo)", "value": "fa60b80bf2151362f08b991cd2f7f0ba9540df4c7f556dd8347f0b5d5e6c0f10", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690802, "uuid": "50e22a51-9521-4f1f-a17d-43a7b188e6d1", "comment": "Malware payload (Heodo)", "value": "04c4832592377537a5a3d5528224e0c6c2ce04be", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652690802, "uuid": "da7b2051-a319-497c-b44b-2fe8f7e5a52e", "comment": "Malware payload (Heodo)", "value": "4618348af32a6924fa3534ce670ee291ab505546a6b95d568676e9dcb504c09040563a8b6af26ca925d944d8e568cfb8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690802, "uuid": "78327565-cfe5-42f1-8303-b0276cf53db5", "value": "T1EE055A35FB6C8492C6A3953D88A34B06EE6AFE840B6183CB1290733E9E777D45C35671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690802, "uuid": "2711ea36-bac0-4f81-9126-9b32630a7591", "value": "9b06cf0221a4d815665b3dcd365769b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690802, "uuid": "2bc82051-3de0-43d9-85ae-50299655137f", "value": "12288:Q9983xLoz0/7aG8GkZHFT1YicDAXmvQaZsbNg:A9UNozAWGxGx16AWvVZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652690802, "uuid": "45b3c5df-18ec-4958-9243-dcfc589a2611", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652690802, "uuid": "9b153164-4245-442c-b509-c265a998a644", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1652690802, "uuid": "4a86e506-8fbd-4f4c-ab02-8feb7b212b53", "value": "cc65fc981ebfe6472107c211fa2b4a13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e98abd07-d537-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1652719665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719665, "uuid": "02d3de99-f01d-4f58-8f8a-d8519045f944", "comment": "Malware payload (Heodo)", "value": "41c7336c2769961eb6f02fd5c33bab9c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719665, "uuid": "193993b0-8a61-444f-a98e-c004e0222e42", "comment": "Malware payload (Heodo)", "value": "fb7d8cc64f6b92ec058e3c50e879342168193dc843a7baed333894f4dc51467a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719665, "uuid": "12626b7b-2616-4d52-952a-4a80717e3090", "comment": "Malware payload (Heodo)", "value": "7461bca5d921d9b635364d2a27d24a7009847d88", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1652719665, "uuid": "7d70a865-7b0b-4fda-8748-9ad82f798207", "comment": "Malware payload (Heodo)", "value": "95048fc6739cc4b4a1b9573b284756c9e98c863656ee9bad4390660c2cc3fb81af353ab9f0981eb2d7f45c03894f16dd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719665, "uuid": "c219963a-89d3-43e7-8f39-a93295260418", "value": "T1B984C04573A48079EDB79338CC574A47E376B86907B0678F1364436A9F3F3919A3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719665, "uuid": "78376ff7-da5f-4923-bac0-04e7ff665e14", "value": "073e9094df66da2c3d6e17b86c2a33ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1652719665, "uuid": "1bac7d9a-8bd8-4a31-9cdd-f4f3e3ca79da", "value": "6144:EbmRW/X22TR72tKbxGedkesyj1BQr6blJLUDblVpM54WWBKWuSIZ5ib0wj:E42Gi7/dpRBQrgI5M54riZYbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1652719665, "uuid": "c64508b6-3af3-4702-92f6-7a1dc341f9b5", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1652719665, "uuid": "80bce3d3-1fbf-4007-a6c8-c95c14767bb7", "value": "application/x-dos