{ "Event": { "published": true, "date": "2022-03-21", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-03-21", "timestamp": 1647907382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "6edbc118-2a66-4f1f-bfea-114c13d42a88", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "490f578a-a904-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1647859641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647859641, "uuid": "459639df-0af8-4772-9e7a-2034b6e941e0", "comment": "Malware payload (NanoCore)", "value": "d7c820847f232aabc1943d1155ce1932", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647859641, "uuid": "10d53184-8144-4250-b000-78a3963aaa0b", "comment": "Malware payload (NanoCore)", "value": "001db04adeb3b46806179452b694c543b01b00f2b16996bb7b44b38c9c89307b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647859641, "uuid": "c1d64487-d592-458f-a84e-2df184cb7e4f", "comment": "Malware payload (NanoCore)", "value": "679d1b275a6acd0a662427da587b718ca6cad22a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647859641, "uuid": "01f214a8-160f-42db-8377-8c0a3f5db8e8", "comment": "Malware payload (NanoCore)", "value": "e9d61c54ec9c0ad2f486eb55f7a4bdd4c48b020f6d9d5711ea55bffdfc7cecd581eb3fa62ea8146ac9987d7ac445421f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647859641, "uuid": "18dc3796-116c-4aff-bd87-d36258a068e4", "value": "T16035233A7BAF8423C4F97232C0E1D6110772DACA6423E748F4D663587E037564B56ABE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647859641, "uuid": "ce6f14d2-0fb6-4550-b86b-aec31ae843f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647859641, "uuid": "543aafac-544a-4518-ad30-4e64cd3742cc", "value": "24576:fwh9ZxIAhmdbSf21hoOcmeOLp8l0rJjT77e41rUILccVh4Vzar0pe0vGG:YTvzw1hoOcELp8UJ77/dY6kGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647859641, "uuid": "3eba425e-48a0-4e32-811c-ae8bc258079b", "value": 1111552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647859641, "uuid": "6ab3ab3b-4292-4ec3-bc3a-86bb14f26ec0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647859641, "uuid": "2baf6f3a-cdf7-4b90-903f-a900a93d18de", "value": "d7c820847f232aabc1943d1155ce1932.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd7ed546-a909-11ec-9275-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1647862010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647862010, "uuid": "68a9569d-fbe5-4b33-b113-340625f3d98d", "comment": "Malware payload (AZORult)", "value": "12dae099918e641a4d8811dbc00f2546", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647862010, "uuid": "3b2751c0-1aca-4713-a76b-156ceff5a034", "comment": "Malware payload (AZORult)", "value": "002e2c8051a571267579e5dccbb2ec7765991525a038063e636be65207c56519", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647862010, "uuid": "707f5774-6992-4005-af29-f9a269fd42bf", "comment": "Malware payload (AZORult)", "value": "e780b933ccd97cfd6b8660674b677fa9669b2e7e", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647862010, "uuid": "06fd2b9a-9f9f-4cee-9850-03cbe756c1dc", "comment": "Malware payload (AZORult)", "value": "aed5b65972a43b05004636e27b0e42a1e0e3e126f09673ffd91752458d5d269a2c0a7270ce9b11cb10bfcd1c7a79d069", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647862010, "uuid": "f5575c34-8c53-4bc0-8365-18661ef08814", "value": "T1A751005974AF783463326F76D86B011DD732D383B1B902903A0E96EACE358ACD78585E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647862010, "uuid": "943d23b9-8efd-48ea-8c0d-6864beca95a8", "value": "48:kEcV865X9P8uqfWXS+ndbkhJnkV1rSJM0wbFluzkpITIEm3O0Bd8Dl:kjbXfqfMdohJkV1rSJMvFEzXS3OJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647862010, "uuid": "8bd31241-948f-4c60-93fd-6539b7de2ce4", "value": 2584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647862010, "uuid": "6650c461-e61f-4073-9dc6-9cda56fb9dc8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647862010, "uuid": "2b388d43-3cf1-4691-805e-4936efa89dd5", "value": "630925832pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b912e1-a8e3-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647845618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845618, "uuid": "f8e878b8-b66c-41f6-88fc-89678e2620db", "comment": "Malware payload (SnakeKeylogger)", "value": "796d76d4af8c7cade94050846b8f7c4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845618, "uuid": "a8ed5d89-a921-4021-ac57-a8756ddfb07c", "comment": "Malware payload (SnakeKeylogger)", "value": "00e498436303354fadacf825a7f880c24aaaa14e04ce3a1de78c85f5a5ef44e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845618, "uuid": "c3738463-95c3-4cfd-bb9a-958cb50ddc46", "comment": "Malware payload (SnakeKeylogger)", "value": "acac18a4305f085ec665a153e023dad07ecab6a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845618, "uuid": "5932df29-6a81-4ac7-8d0b-a0e2cfd94020", "comment": "Malware payload (SnakeKeylogger)", "value": "76953eceb9b1cc89c08ef68f8a225af8f49d0f2dd5900dee9d41e2b7146dac5f11a1727e348308175d531802153096c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845618, "uuid": "8e4ae5fa-d238-4b88-b8da-6c42ff57c446", "value": "T11225232977F8432AC2BDAB72E4F5A3880FB2149626C3DF647ED621440F1B74946319E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845618, "uuid": "2e3539ca-a924-40e0-8fdd-4d2de14bd7d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845618, "uuid": "381a7b9b-8ec9-48d6-918c-b968e85c41b9", "value": "24576:9nIKl9e5zjXzfDndEtsErZPyF9FE2leexBLL6:9nIse5zjX/dEKEr+I2lfxt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647845618, "uuid": "e3af45c1-f95f-4d9d-8508-2f51a7b1166d", "value": 982528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647845618, "uuid": "42f7b395-1af7-4957-9328-5d1cd21f287c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845618, "uuid": "8b7cb5c3-beef-41b7-a200-6bd54d948093", "value": "Halkbank_Ekstre_20222501_ 073653_270424.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e296ce0-a8bb-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1647828350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647828350, "uuid": "a84c773c-3ba1-4e7c-bd74-189b4e002fa6", "comment": "Malware payload (njrat)", "value": "a842ac36bf5a3e34ac4168490a7bd93a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647828350, "uuid": "a5205058-43fe-4ba6-a6ff-477663885f7c", "comment": "Malware payload (njrat)", "value": "01b9cf80bf4c2568c67d2acb8a0c739d7c2a8bbcb053210ebcc30f868a12e7ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647828350, "uuid": "87b1b6ee-3f09-483e-b96c-217cb34b4bd3", "comment": "Malware payload (njrat)", "value": "c0ce0cdfbb492c2caef909be88be6d49f700be9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647828350, "uuid": "7a92baef-a636-4d1d-944b-006ae11802f6", "comment": "Malware payload (njrat)", "value": "d2cb6b32814efabc52f26fd3861f097447baa9d43308db5278eb8378473f8459c0812bb79888fbd09e95ec690376289d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647828350, "uuid": "bcd724c3-7516-43d6-8230-0e0d48aab7b0", "value": "T151052A0A97D149A5C07BAA32D375C1F413F85EEB5550E36B1FD22AE7FB312052B0229B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647828350, "uuid": "2dfbb885-0752-4686-98a7-100319dddb22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647828350, "uuid": "61eaf175-21b5-4ecd-ada4-0c605d5a5e7e", "value": "12288:2fZyQ7amc95O4eLSCtSezFeWSQMadwNpmh9sQZ6s+0j84cEIF:09FeWSQ8NcvHZg0j84cE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647828350, "uuid": "4fd0fde9-175c-482d-ad02-6de68a771242", "value": 804864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647828350, "uuid": "a74d92d5-7efa-4905-9828-c6d567466906", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647828350, "uuid": "f331e728-5268-4b54-8c82-f6dcd109021d", "value": "a842ac36bf5a3e34ac4168490a7bd93a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a26cf8c-a8f1-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647851402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851402, "uuid": "8e6685dc-5a49-455b-9632-4c633e5b5b84", "comment": "Malware payload (Formbook)", "value": "cdcfc667690b086dc70e5b8f1905cc4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851402, "uuid": "22a6cdbb-d564-4452-b16d-5099f0085e7e", "comment": "Malware payload (Formbook)", "value": "01c73f71338af78f906544a2f2b1a685870d5ebc23903934af46e28c7886089e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851402, "uuid": "d5aae92a-5552-42c3-8ecb-110c319f622b", "comment": "Malware payload (Formbook)", "value": "827738e74dd6d0a93b82595a706686fc0b2b65d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851402, "uuid": "65e874f4-0ffe-4483-8c3b-0c1e10e8addc", "comment": "Malware payload (Formbook)", "value": "716b8a97a448b8cb0b678f3dcdb65476bac95c428cc42fb6e6283687d736eddb6f6821c5a3ce0b56444c9fb9a1bd0c00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851402, "uuid": "a95a4962-718e-4c2c-800d-f116da110bd8", "value": "T1032523AE22642776D8ACC732D0F3B94003F2895A66D2EB04EDD179B54A473194F42FE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851402, "uuid": "2ee036f9-0f4e-4f11-886c-9af8574eb717", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851402, "uuid": "6d5dde0c-4f28-44cf-87f7-0d81115ee6d2", "value": "24576:zG1l9nS4YbQBVPXLX0LatEGdzTNepCAd9w3pUWBq:zGJnS4uEVPXL0La2Gdz8kAvCw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851402, "uuid": "d7c63549-b923-4bff-9aa3-e3d770ff8218", "value": 1024512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851402, "uuid": "105a8c4a-ef24-433e-a79a-1f5632907273", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851402, "uuid": "afc9921c-8dee-4a59-8823-e44be0b29e51", "value": "FedEx Shipping document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d41788-a8f1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647851428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851428, "uuid": "571c02ee-b85c-485a-9f53-1bf06e0e2cad", "comment": "Malware payload", "value": "c0639fc28663bb3ea08d34769480bf5b", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE ISO", "colour": "#AF335F", "exportable": true, "hide_tag": false }, { "name": "EXOTICLILY", "colour": "#D74DC5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851428, "uuid": "ee4539ee-567b-4694-b85e-29217aac10f0", "comment": "Malware payload", "value": "01cc151149b5bf974449b00de08ce7dbf5eca77f55edd00982a959e48d017225", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE ISO", "colour": "#AF335F", "exportable": true, "hide_tag": false }, { "name": "EXOTICLILY", "colour": "#D74DC5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851428, "uuid": "f1f76af4-9b24-4429-9b34-12477b0adc5a", "comment": "Malware payload", "value": "33e9fc0e236babf59664a11a149c85c1696f944f", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE ISO", "colour": "#AF335F", "exportable": true, "hide_tag": false }, { "name": "EXOTICLILY", "colour": "#D74DC5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851428, "uuid": "c35fc160-a34c-43b8-bbe6-182b2380cbaf", "comment": "Malware payload", "value": "a0bf8bbf3d85717bafa4e6925a231de735f96d43fd9e104d3b5c3094090bcabfdb27f10b6b4a384411c02aa9b1b75fbb", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE ISO", "colour": "#AF335F", "exportable": true, "hide_tag": false }, { "name": "EXOTICLILY", "colour": "#D74DC5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851428, "uuid": "3e82493d-98f6-4529-a5ae-cc9a27c6c0af", "value": "T1DFB58D42A3A804E5D9B6C13CC9569617E7F2B8150370DBDF0AA846FA0F237D11EBEB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851428, "uuid": "1f44ad1a-3696-4a93-9631-c76231dd8a6a", "value": "49152:73GD6aFj0Mb8VxOs7t7NgRpvIxDwSAEsqPGRgYmlF4Qn:n5MKzxyDCwSAz1RmF4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851428, "uuid": "a598987a-2b74-460a-a403-0215ad532306", "value": 2306048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851428, "uuid": "37da0ef5-52a1-46d7-b04a-56bf452f0df2", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851428, "uuid": "079b0b1d-0af9-45e7-9095-0bf4572e4f3c", "value": "BUMBLEBEE ISO (4).iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a2bbb27-a938-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1647882111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882111, "uuid": "6ee844b7-3df1-4cb4-8b29-2fecb87a1f8e", "comment": "Malware payload (AsyncRAT)", "value": "cfaa4b50ffa1d91b2e7ca835a3ce3889", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882111, "uuid": "7b7ccced-d0df-446b-bd45-02c9ff17eaca", "comment": "Malware payload (AsyncRAT)", "value": "01d83cfe30b45953671a25d375bea90b5472fd36b082d7d327485e9a777a166c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882111, "uuid": "5b12ed69-cd97-44ab-8d99-936746f6b470", "comment": "Malware payload (AsyncRAT)", "value": "95af5e9f794bfee4d651a60d98636cee3ef1722e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882111, "uuid": "075757bc-04e4-4565-925c-68e75d0ba155", "comment": "Malware payload (AsyncRAT)", "value": "752995972246f72f6620f33c14f60cdc12b2a2c86c7ef0d992d4d9203aa4efcdb7ed1afadb615c5fc1338de1e7f798ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882111, "uuid": "efcae5c9-305c-43a5-b9be-7db7f86be2a5", "value": "T15C152325775B9637D2E8A731A5E286150FF15F89B623EA4B78C413481A037CBAD1323F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882111, "uuid": "43650ca0-6b4d-473d-a302-5d83a9ecfa85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882111, "uuid": "c147507c-f3a7-4b65-82bb-8c672d48ce2f", "value": "24576:ZdN91jq8+mQGRu2tUCiSrG7CC+SIbnwWGG:T/88kGRu2yyoZ+SIjwWGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647882111, "uuid": "2ba36c0a-a049-44a0-9754-bcb4739f3cce", "value": 904192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647882111, "uuid": "6c595d75-d873-40ff-b92b-e0c5485ecaea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882111, "uuid": "926c83e0-5295-4d3a-9182-15eacaf350cb", "value": "cfaa4b50ffa1d91b2e7ca835a3ce3889", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea8ba99b-a934-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647880528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647880528, "uuid": "c37cc738-103b-4e8e-8668-3c08ade77ce9", "comment": "Malware payload (Formbook)", "value": "7870a24d1ac5b1d45ea9828f7d998d87", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647880528, "uuid": "2f63b983-a78a-4bc8-a48f-fc1484a866a1", "comment": "Malware payload (Formbook)", "value": "028d3f99370f1dc0c6941c34c3fa506b1a3605616df16151a6018b31c57641d8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647880528, "uuid": "0ca842a8-eedf-47bc-a5fa-4dc3a44b6381", "comment": "Malware payload (Formbook)", "value": "85c75e9782662f72b4b45d618066fa2498d8a85a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647880528, "uuid": "f6eda6f0-5253-4dbd-972b-c1bfcdb859ec", "comment": "Malware payload (Formbook)", "value": "05a53b6170f2cbe5080e663265e92e696d2ead21dd41616f1122ccda7c523482b25ce4b99de6e8211bc289956dbb4b4c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647880528, "uuid": "ac79f507-01e7-4e42-9321-db8d487513df", "value": "T1AE9423488F32B845F921E9809B960B85BF9FEE1F870F4DF105E389C448D7E6719689E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647880528, "uuid": "40f075a0-9714-4714-82cb-a16f0e7a772a", "value": "12288:lq/RLzAf+dsJUODZ8VbKIcZbHzn+RbcSY:l0RAfKsWODZGiHr+lu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647880528, "uuid": "14e04835-1f7c-40dc-baca-12317824696e", "value": 429464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647880528, "uuid": "79f484fd-0269-41a7-9583-c0cceed2e38e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647880528, "uuid": "736f2407-3d6d-483e-81b1-3f2d74ddbe90", "value": "New Order 3346585857.GZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15073067-a8aa-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647820899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647820899, "uuid": "2e589d66-61e7-452d-a228-2e60fb90fef5", "comment": "Malware payload (Heodo)", "value": "0f8ccdde568a8c2c9be72400f8a95ae2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647820899, "uuid": "6e1b6e40-2a28-40d9-aedd-81c2fbf53b92", "comment": "Malware payload (Heodo)", "value": "02ca72ee38f4d3221e2db333b91205b7d0e6b1505e75699f583fa791f64d6801", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647820899, "uuid": "607154ed-284e-470d-9053-2b7607f2fb65", "comment": "Malware payload (Heodo)", "value": "c8096cbefe39e4d88d31e484548f3962f83529cf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647820899, "uuid": "c0b98766-866a-4573-9b85-6bee1db771c8", "comment": "Malware payload (Heodo)", "value": "9aa8d09ddee94b36feddf5144e97ff028a86809523244e1f1509955f90dbc49cc7a0a7199285f85951a959dd0b083e1a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647820899, "uuid": "a8eeba5c-9205-42e7-8b4c-27b8413ef82d", "value": "T138A428123CE2B072C89BD0348FC56164855FF5F5AFA6727E62FD629C4B24DA18E17B02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647820899, "uuid": "3948784f-321a-4b73-95b6-0d16fa892157", "value": "3881d76bffe56c7cefb6ec7d56cb4aac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647820899, "uuid": "63a5fca9-074c-42f5-9857-14d3f65937e7", "value": "6144:2zP28Xoxy3TAaZOO+kVEWKdguBw423quMsLh+tEgrtenN6YlXmcwT:2zxTlZP+I2x/23q7sEbEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647820899, "uuid": "e68d1cd7-045a-4be1-82bd-930adcea3016", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647820899, "uuid": "9c03655d-3ef6-4186-a89b-a5e6650a7144", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647820899, "uuid": "0247e073-5581-4529-ab8c-78fb1f0b7a3a", "value": "emotet_exe_e5_02ca72ee38f4d3221e2db333b91205b7d0e6b1505e75699f583fa791f64d6801_2022-03-21__000134.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e04a8266-a8ee-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1647850446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850446, "uuid": "0d3bf9b8-ddbc-4daa-a4e9-aafe923cf72d", "comment": "Malware payload (Gozi)", "value": "5c95bd06ac65f87d5ca02af3135dcb43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850446, "uuid": "c3f661e2-cbad-4bf7-ba08-be9b6cdf1e7a", "comment": "Malware payload (Gozi)", "value": "02f23031b04660ce5d0a3dbd6862640895e37c649963c02d0b367a17d8422ffe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850446, "uuid": "d9f4c655-8264-4fed-9efe-99ad64cd36cc", "comment": "Malware payload (Gozi)", "value": "bee7ce4c588899fc70042adf7a7c632f2468fe90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850446, "uuid": "98231ab1-1cf0-432a-bee7-598029841a89", "comment": "Malware payload (Gozi)", "value": "29d79019908cb4f0c7b52d82bd598c3fec4e67ca474bc392152922d5de087f711f768a7e59022dcc1338ac6760d86513", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850446, "uuid": "b141e717-1446-4433-9a0b-36bde742b0ee", "value": "T18854AF313650C835D09661308416CFE15A7EB8313DA0D617779E1B6EEF323C2A66AB9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850446, "uuid": "99ec1479-0f73-4b24-b575-7bd47265ad4f", "value": "5fb8a90699385dd79bbcc37048719eae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850446, "uuid": "2b6be6b2-8c75-4ff2-bc35-f3eb72813d98", "value": "1536:d/XLCsSoAxIOtRPjdL+jZ46r/KBOEkaiS27OzH2o3LvtnEoKVmNQ5QIjNT6Z/HBm:VbzmDJLxVBOOg7gp9ESQ5QuM/h3hUdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647850446, "uuid": "a31e5416-c5a5-4880-88fb-275b605928c2", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647850446, "uuid": "96e3ac8d-5316-4a7d-bd40-a27deabbdcd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850446, "uuid": "1eb40d9b-7c0b-47f1-94e7-445554d45f10", "value": "02f23031b04660ce5d0a3dbd6862640895e37c649963c02d0b367a17d8422ffe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef927f00-a95a-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1647896857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896857, "uuid": "5a8b137a-ff9b-48a9-a0a8-7a4cb45b3700", "comment": "Malware payload (RaccoonStealer)", "value": "d5f5ddb0dc6c5b34a4107ea2a6436075", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896857, "uuid": "2402e9fd-dafe-4c2a-9ddf-0013261ccfc3", "comment": "Malware payload (RaccoonStealer)", "value": "0319db273d453c4834d2002cfb3844e8bb4c2039576091ba5656d54778df12cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896857, "uuid": "5c469534-4fa8-4aab-9fe4-e803a30b7d07", "comment": "Malware payload (RaccoonStealer)", "value": "803d9cd3309156edaa4136e49d7e5aee49d22ddc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896857, "uuid": "51a0f840-b9f0-48d5-9ba2-213ec6d31328", "comment": "Malware payload (RaccoonStealer)", "value": "7477727e50f4b09c767b52391a185637c0b5b2d2de0b31353f8e5427c426cae01a815cb9151675fb80a23d1cad745f5a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896857, "uuid": "eb38f922-80b1-4239-bd32-6108668d5bab", "value": "T1FB269C31AB45CC39AFE74132D53B715E28919874E2DF708737D90CC08A9BCBECA99895", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896857, "uuid": "5e09dc66-e5d5-499e-af3a-983ae27da027", "value": "99c2cae0b7316add27de679470515124", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896857, "uuid": "7a052a8d-35b4-43d3-938b-62db4ed904ed", "value": "98304:4OMxzl2uDJV5rDA01CqIFfE2OKnV14365716rpJ4GF3Qi9sz3h1ovzP8Dahagdvn:yCqINjOKnV1ap3V9szR28Yagd7GT3dSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647896857, "uuid": "dd7611e0-537d-4e1e-812f-8038643f29b8", "value": 4465152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647896857, "uuid": "a026d739-86e9-4e60-8ff0-933e3de4850a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896857, "uuid": "a9a7cc22-46c3-43f8-b0b5-d204c818e3e1", "value": "d5f5ddb0dc6c5b34a4107ea2a6436075", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b07aa71f-a8ed-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647849936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849936, "uuid": "b9b17efe-7b38-4382-beac-f42f9d81ee09", "comment": "Malware payload (RedLineStealer)", "value": "1ada1ffb34d826c04ca797374c579213", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849936, "uuid": "330afc39-5492-4f07-ab9c-5fe6a4dd0d26", "comment": "Malware payload (RedLineStealer)", "value": "0394bb280071a8aeb241e7b780b4dbc01cf158ec9946ed54f8619b0dc4dc24c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849936, "uuid": "2f515e65-876f-4284-860c-0116558a3a9c", "comment": "Malware payload (RedLineStealer)", "value": "c39ddf4c639a3ec93e4cc039eaaeb7082bafdf2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849936, "uuid": "e5d8f54b-c78f-4104-ad99-40dcaacfb388", "comment": "Malware payload (RedLineStealer)", "value": "27b5fa9b8302a7524246f785683a7acf7868755e2ba15eb446123d6f91f619f7401dd97a1fc0b53276bbe6900a283a40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849936, "uuid": "facfec38-788d-4140-8f13-cd50207fe305", "value": "T1EE35230313895934C6A14739EAE34EF7C4B2EE0170687EB6527976BC94732763C9FA24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849936, "uuid": "efd117f3-96ca-43fe-8c61-703928ef3efc", "value": "343cdad582115e253d71c2bdb8071069", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849936, "uuid": "43a56e3b-6405-42a8-a78d-fe00a76763a2", "value": "24576:NqDRL1xVJ6NM3FkvD4qLvAuVPoJH+Qd9/N3wTPwJk8cgNP5qZX/QMI6k/Hg8:NCx/6N+FkvD4huU+QDZwTPKdVOYMIN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647849936, "uuid": "4d3f0a53-644e-409f-a281-9954a011b759", "value": 1126720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647849936, "uuid": "db8b17b9-a2a5-40aa-85f8-09e8889e3742", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849936, "uuid": "0247aa66-ece6-4038-91e5-aeb39176ea6d", "value": "1ada1ffb34d826c04ca797374c579213.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "facc2b98-a92f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647878407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878407, "uuid": "69d8cfc0-4489-4ed7-bff6-64f7d0faf396", "comment": "Malware payload", "value": "3c3203816b9851ce6bbd94eb7831860b", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878407, "uuid": "5144cc05-8356-436a-ab99-273191dd2577", "comment": "Malware payload", "value": "03b8ce2457924171ccc05e7d5bc3e4e494720bdeb5a14a25688cd94130f8f3c5", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878407, "uuid": "63d66f25-273f-4f1c-aa83-9b8a8af57885", "comment": "Malware payload", "value": "ee9c348e546a2d03edda1131c21eff5e7442318e", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878407, "uuid": "14bf8d65-5945-43b9-a559-adacd39bd752", "comment": "Malware payload", "value": "bd1cf71bad48ef0a1b64cae60dab98fbde84b0bedf8ebe9e40c10b8a3be39e56542bb2117d4bd188acefd3640da43b30", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878407, "uuid": "76b22a49-36e7-4506-8e6b-522090315c92", "value": "T16B747DB1F4E33CBB62DACD932178E674AEE02C5B474FA944C171BFE049819641BE4D4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878407, "uuid": "23bb5ff0-2268-4440-8795-2aa7708d81ac", "value": "6144:mc7u/Xh+joAD5piY0MnWPgBFVSkO1IpUq9x8sLWZAc4EZYTtAgFQwc2sS7xUMjNf:u85p5FVSktpB92sLG544AFRc2sM6MjNf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647878407, "uuid": "8d930eae-aa51-44dc-ada1-7b5838016b3e", "value": 364371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647878407, "uuid": "a0c23f98-d306-4b58-a469-514e27291ecd", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878407, "uuid": "7167d3b3-c45f-4c7d-a9cb-c19f8aa82b6c", "value": "css.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b025c654-a914-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647866686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866686, "uuid": "1bd15237-3221-48ab-b708-8613e8161d30", "comment": "Malware payload (Formbook)", "value": "6a9e61b5e3ad9cd6cbe67dadfd312422", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866686, "uuid": "2adcefad-d66c-4059-9557-a1b2fd8e0e8c", "comment": "Malware payload (Formbook)", "value": "03d4b246e3b88a839063be2dc08c4e903ed42db0f65457ed6c36915e67d0c251", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866686, "uuid": "54625ee4-a2ac-4e86-bc8e-e4b9a71a1af4", "comment": "Malware payload (Formbook)", "value": "c62718a24a6e5ae2b3ea9a48d0934904857ab17e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866686, "uuid": "b88e6aee-17f9-47f9-b633-4e3d5a86e57a", "comment": "Malware payload (Formbook)", "value": "c390892c34d8272ebd9a976a3accf16c0b7ed883834f823b4f3ef89820134859ff0e73bfd215c5bc539776c16ec91767", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866686, "uuid": "be86dddc-7e6a-464c-8c4b-49e325f3c4ad", "value": "T16C3412829DD28F73E35204390536FB65E775D1A004050F47A7A96F3ABF873CA5A17386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866686, "uuid": "3bc4483c-25e1-4aa4-8077-849936f59d85", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866686, "uuid": "ae7a5518-ac9e-4769-800a-958c7f3f0220", "value": "6144:rGiIjVp5uSwD/KRhDk3E6duGoNH3DbTjGwD:ECD/KLw1s3Dau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647866686, "uuid": "ab55d5ba-47ae-40e6-b054-e707a7d770e6", "value": 247833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647866686, "uuid": "689eee53-22c2-46eb-8131-f448ab4e022d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866686, "uuid": "11d8125f-836b-4910-9e5c-e5a7313731b8", "value": "Factura_855.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de1aadb2-a951-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1647892962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647892962, "uuid": "b5cde712-cd23-4761-8e05-e9c3de3d489a", "comment": "Malware payload (Gafgyt)", "value": "64765250f6254dcd71abc853d0ebda99", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647892962, "uuid": "d8e89d4d-34c0-424e-b174-d3689e7310c4", "comment": "Malware payload (Gafgyt)", "value": "03fff1912cf5449e2faddd4b80d403654e584c0e883b357a6ea9265646ab2c3e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647892962, "uuid": "b52c7491-d812-4e08-b615-11ccac1aba67", "comment": "Malware payload (Gafgyt)", "value": "c02b16bf59f45a88faf9fe3927ba330b962e9f07", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647892962, "uuid": "994deb33-a762-4e30-adc9-c672ac346dfc", "comment": "Malware payload (Gafgyt)", "value": "8f5095dbecd86a96a63083e1e65328d051fe6263d5b634a92126e2946f898f41e25a335bdbccfeaf528aa87f705fa119", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647892962, "uuid": "e2ba1eaf-f5dd-4bde-8bea-9e18b15b88f1", "value": "T167C308B2B804DF66F40AE67604D74B257E31BFE70E931962721739A6AD362D03827F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647892962, "uuid": "519a3e8a-6ac6-433c-afaa-d4c86c2b0d8c", "value": "3072:5S3S44I0OQldXhaB8qZYFyNsLzTzEmm/mcvLG1avnNb:50D48QldRaeyNi/Qmm/mcvLG1avnNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647892962, "uuid": "73e60699-a744-4190-8ed9-2b6232df94e8", "value": 122977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647892962, "uuid": "5894fff9-dc9c-405e-8bed-9dc2aec3a75d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647892962, "uuid": "177beb78-577a-45f1-9118-fc033d7d89c7", "value": "64765250f6254dcd71abc853d0ebda99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f48ffc5d-a8e3-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647845755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845755, "uuid": "62b51349-aa0c-497f-b866-a43f8db0c224", "comment": "Malware payload (Formbook)", "value": "1db8295a9685843a251775aa5764a1d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845755, "uuid": "c05fdfce-e521-43b7-8cce-835a56e362f0", "comment": "Malware payload (Formbook)", "value": "04464b5872e342d59c8f4c85443fb3198a35544a9844d9a20618b7808f649464", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845755, "uuid": "8c91585f-9372-40d1-bf24-9abc4abfab2b", "comment": "Malware payload (Formbook)", "value": "2f8657ca210546a4d6ee1adc3730e47f90ccfed3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845755, "uuid": "f28e69a5-ff23-4180-a823-89ecafa6d70a", "comment": "Malware payload (Formbook)", "value": "1c6b318b50cf60fe362d5f37db49d63aec09e345444d1c7b4d031b2e9924684bc6cb08dc65f15c734944336bef9be1f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845755, "uuid": "fdae2fd1-0afe-476c-b515-01ab49ab392c", "value": "T1B3840297C68169E5EEB1C6302037E6B9566B9CBD8694A2C713C8BC2735E306B0537833", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845755, "uuid": "0facb2e6-37ab-49b1-b0fd-3540e13e65a8", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845755, "uuid": "cf8ee3ac-c686-43af-bfb1-d49c2842b0cc", "value": "6144:TGieCYX4L/2stbADQYfiMpdDX9ilu0oo8KGhRMfAUFS0zLBsFXCubZCT2z/IkBsR:wvDXMc0ojKGjMYUFSgUbZk2TIkBswQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647845755, "uuid": "7fc5f888-af59-449a-ae72-c8d787093078", "value": 376520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647845755, "uuid": "406137b4-bde6-4840-b2c2-cebfab86c59a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845755, "uuid": "4acc1912-389b-457f-96c7-7c8c500193d3", "value": "Offer 220204-TF1--00.LE.473.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb1793ae-a942-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647886488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886488, "uuid": "b4a31ae1-bed4-4696-865f-1862f49e859f", "comment": "Malware payload", "value": "0e3571948aa17da9587de81c188a477f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886488, "uuid": "b56de920-ae51-417b-8d47-43e8729cce01", "comment": "Malware payload", "value": "04a77fbe29b8d06054403646f15e1f4bee6864e9da7ac83dbbf8a29bfdc281d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886488, "uuid": "ac9203bb-0a11-4879-9ebe-eb5cdd4deaa7", "comment": "Malware payload", "value": "b587559de7af32f7e1d3487c770e6b5431cae1e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886488, "uuid": "568e9e74-5c55-4374-a7dc-87ba6edcaaab", "comment": "Malware payload", "value": "e98b31707743c127fdeecec7306a16a65a113d96610fa5aec97e1f683da94443c84103d26a260aa2c6790a65561925a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886488, "uuid": "b45b2113-4854-4f14-a451-b0fc513826ae", "value": "T162A423D02F82AB2DE09542BEE9BDB4115823EDF5C6681BC70094BD9DBA7FB5DC422053", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886488, "uuid": "8882b6cd-3deb-4c1c-912b-4e039d9dd9bd", "value": "712f4a29c405ecb576101d367b2180fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886488, "uuid": "7a27b077-cc5b-45db-8c92-caceebd09030", "value": "12288:rYV6MorX7qzuC3QHO9FQgd5sCCw5pItJDkdUb6n:IBXu9HGa2pWje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647886488, "uuid": "590efccd-3231-4402-b661-ed0f557cf6dd", "value": 465408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647886488, "uuid": "0e42b99d-4419-40b3-93d4-da0769bc85f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886488, "uuid": "aea20910-8833-400c-9b65-3d2e400beb2e", "value": "SecuriteInfo.com.Trojan.GenericKD.39268328.30681.20364", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5bb3986-a8ed-11ec-9275-42010a9c0029", "comment": "Malware payload (vkeylogger)", "timestamp": 1647849971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849971, "uuid": "6457a2d1-a2f4-4941-9b0f-b2d4cc455f9a", "comment": "Malware payload (vkeylogger)", "value": "f876084f0a4c4921043f0c5d9a300a10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VKeylogger", "colour": "#FE96F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849971, "uuid": "b25de265-15f9-4306-b327-511e05c0b64b", "comment": "Malware payload (vkeylogger)", "value": "04b8f38bffca4122470e8af1b123630809bc7a6fb4e66a3e0a99f82133c9bdf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VKeylogger", "colour": "#FE96F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849971, "uuid": "b6b6aedc-2ff7-45ef-9e91-1cacafc0e12a", "comment": "Malware payload (vkeylogger)", "value": "26750325c38616947a66fcf4132afd30bdccbbe6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VKeylogger", "colour": "#FE96F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849971, "uuid": "9d26de4c-5f18-45bd-adb8-bf4ec60f5e88", "comment": "Malware payload (vkeylogger)", "value": "a85ac33b6575e14601d23e686946e59a1068c0d6b61086f1f4c03e5cde118bf9800cee7e220ba983ed40a616562c2c60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VKeylogger", "colour": "#FE96F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849971, "uuid": "e0d0f750-6656-4d9a-8de7-7bcb737de8e8", "value": "T1B054AE40B760D03DF0B312F8787AD3A9653E7DA15B6591CB22D26AEE16342D0EDB530B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849971, "uuid": "c8bf64a7-dd7b-4042-a88f-4f06d6719412", "value": "6dc76534a71225c5adf2ef004034f9e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849971, "uuid": "0c6d80a3-9128-46fd-a893-2cd32ea0cf0c", "value": "6144:g9hIfvBAr4rxbUZNIYvI7AFE5hi+0CrSqhQGJZPqCSVqKboY8eWYe:qhIxAr4rxbmNXvh+DilsSqhh+UKEj/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647849971, "uuid": "3020613f-3f5f-4b55-bc29-da8645b55ed7", "value": 302256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647849971, "uuid": "76da232c-9256-48d8-82d9-6d863394cc6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849971, "uuid": "ca3cafe2-669c-4dae-ae68-72f014b82099", "value": "f876084f0a4c4921043f0c5d9a300a10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2608832c-a96d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647904679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647904679, "uuid": "65c78bbc-5893-4fe8-a3c6-8aae87a9629a", "comment": "Malware payload (AgentTesla)", "value": "438947d341f1556869ceda83cf707bb8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647904679, "uuid": "78a630af-71bb-440a-a17e-921dd017d20b", "comment": "Malware payload (AgentTesla)", "value": "0561681f483700d0e0af0c50604d334f34f4714bae15ba92565ac1b04a49c857", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647904679, "uuid": "802da80d-9117-4801-8afc-efff41cbf4b3", "comment": "Malware payload (AgentTesla)", "value": "9ff06ea164fe6cfe9ab0e57cb0b5edc3901da9b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647904679, "uuid": "0bda07fe-48f5-47f1-910c-8405fb7e7a59", "comment": "Malware payload (AgentTesla)", "value": "1aa15b827a73b3f36119a92bdc969f5c2216809de5220336bcab86c1b2cf00b5720c801ba24b3ab7c29a1dcd8624c4be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647904679, "uuid": "c1223e33-6094-4bf9-b2b7-d659beb23f24", "value": "T19655DFA191FB4EB1CC3B57F0F462BEB60EA27F18E630D1AD496674D1A6F3752243050A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647904679, "uuid": "2f5e3020-e173-4c69-b5b7-521366169c8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647904679, "uuid": "a02bef6e-2e94-487d-b225-1428935aa9cc", "value": "24576:P999nNo8F43zgiYfSO4F4VeYmMjUBIU+x7M7I:F/T43zgdYMQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647904679, "uuid": "21d2a255-e570-4519-a1f4-a2ba9c27bba4", "value": 1314304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647904679, "uuid": "b9bec86b-4418-4afe-9adb-f52291577deb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647904679, "uuid": "c3179e4a-eb4e-459e-958a-c131a00d9c23", "value": "MEDICAL RFQ 432ED.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b32eee56-a914-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647866691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866691, "uuid": "e1cf6c71-9071-4b8e-b56d-6cb33bc56825", "comment": "Malware payload (AgentTesla)", "value": "cecf3b431ad16b6a3e92487783b121e7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866691, "uuid": "05ee8614-f5b6-44c3-950b-1c0275dd59d1", "comment": "Malware payload (AgentTesla)", "value": "05a5b9bf4ac12df7b5b619a9c463f173503c61ab3e845131775b6d44fb90da9d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866691, "uuid": "d268bc02-70ab-40ed-8487-b44996896312", "comment": "Malware payload (AgentTesla)", "value": "43408dc04d7158501d8da3b821484100425cef47", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866691, "uuid": "0d076abf-1303-40ae-bb92-709f81f3cd24", "comment": "Malware payload (AgentTesla)", "value": "c9dcea3ac4c5409590aa6aadadb903b16ebc4b21b1814aa128327ed10b8f093371b13640760e1ba544977b6798a653c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866691, "uuid": "085e3a0b-811a-4795-8a4c-a3d1ac983daa", "value": "T1F1042D809D0CC61CEE6AFAB10833D671CE2AFF8ABA4C2995E440FBD6397517156CD934", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866691, "uuid": "53c9cabf-9334-4986-b8f2-744c4ee5e6d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866691, "uuid": "d58dfa16-1d45-4007-9cc0-97ea303229aa", "value": "384:+iu03LxP03qQG+QR5kn6dMafm7omN59s:+iaqeyknZafmLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647866691, "uuid": "d9455c59-a9ff-4482-8ffc-93c18a96fd2d", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647866691, "uuid": "57d43077-b44a-4906-8756-0158b4b27aff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866691, "uuid": "1d573db3-204c-4558-9f0e-eaebdbcaf664", "value": "IR2200918_150320220PPT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8360911-a924-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1647873678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647873678, "uuid": "eec85699-d9eb-49d5-8952-1ef8cf7100e4", "comment": "Malware payload (RaccoonStealer)", "value": "2bbe07d724e5263fa6cb6ce69b1c7ad5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647873678, "uuid": "5df3a0c6-8bab-46d9-9aa1-d9e7d0d827ce", "comment": "Malware payload (RaccoonStealer)", "value": "05de97c5d5e02a32892efef426acba7e50728651617656cda3c36d5a1f780b55", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647873678, "uuid": "a576e519-f2bb-491f-ada8-f820a9afb813", "comment": "Malware payload (RaccoonStealer)", "value": "e9b12add506efd6e6f6319d238d2d94c1d6b818a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647873678, "uuid": "53f906ad-ef66-401c-847f-5021e71eb795", "comment": "Malware payload (RaccoonStealer)", "value": "c906a42b187e47e56ea72337ce5cc9db18a43bf26f515059867cc6f0cb398680608efa82e0731708dcb100097c07a279", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647873678, "uuid": "6cf6387a-b82d-4901-8490-e00f0fe22d9a", "value": "T1ABC4F140BBA0C03AF1B702F4397993AD782E79A15F2491CF62D66ADE16346D0ECB5347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647873678, "uuid": "f2233ca3-eba2-4224-a837-22ac25b0a18f", "value": "d626a2a864a52e91dc5f85b5e98029ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647873678, "uuid": "6e6bb178-4f7a-4b76-bf18-87a0dda08cb1", "value": "12288:1CR4t3IEWdkTJhak7dIvalD9i/Lqz80TeFfvmGxgpGd2vx19x:1tOdqJI7/+z80TYZgH19x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647873678, "uuid": "1473f131-4437-4cf6-9e9f-e7220a267f58", "value": 564224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647873678, "uuid": "5365ae0e-ec91-4b2e-ba7b-b125de879b13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647873678, "uuid": "1cbaf63e-a12e-404b-8abf-4c3ae951c83b", "value": "2bbe07d724e5263fa6cb6ce69b1c7ad5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d5ef63c-a90f-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647864453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864453, "uuid": "97605399-5c4c-4e75-8e66-b4f7446c2ecd", "comment": "Malware payload (Formbook)", "value": "c25936a608275a0a3243deb985160e1d", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864453, "uuid": "64be359d-18c3-4d1a-8028-a531c81a8c3c", "comment": "Malware payload (Formbook)", "value": "05f6779510066abe01358548333beba78195864f07301916ed2ac355610db740", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864453, "uuid": "a2c9a964-b282-4e52-95e7-a0262c9818eb", "comment": "Malware payload (Formbook)", "value": "10e76d3995b3be464cef6365129e6c7f23089e36", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864453, "uuid": "9cbf6c78-a082-4287-a10e-07d2a17b92d2", "comment": "Malware payload (Formbook)", "value": "d0efba3364b895a3a126b2b284e9adc5f8341a0ccc8056f99d6b21330074d39303e7f526eb3e3541ece32d3b20be414d", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864453, "uuid": "a61b92e4-6fba-4719-94a7-4f981886a29d", "value": "T1F62533CC73E06D07FD2B34B520A198570FCBD772343391199A7328679D8DE6A86AB84D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864453, "uuid": "86f25673-cfe2-459a-87fb-eb04a5d05594", "value": "24576:feNK9ofR1/bMRKYu7swmjUmYa1NDCdHw29cUOAP:24ofnAcYu7sXjUmYaOdrcc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647864453, "uuid": "30bd0320-ba09-43dc-9ae1-c1edb9418569", "value": 977123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647864453, "uuid": "7c31b1d3-6dad-4f6a-81c3-a4a481c9bbb8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864453, "uuid": "c965322c-d3be-4ad5-a699-e4006f292261", "value": "DHL SHIPMENT NOTIFICATION 284748395PD.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5767fe73-a8f4-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1647852793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852793, "uuid": "3c774758-cf14-4a02-b3fe-106024f44cc3", "comment": "Malware payload (NanoCore)", "value": "1915614356e42ac9e230f090cf50bffd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852793, "uuid": "1268d2e8-36ab-4ed6-b051-5e4038061c7b", "comment": "Malware payload (NanoCore)", "value": "0610cb3a060ef7b21f8346e3aaba432daa7dd55553832c53aca23f76af695333", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852793, "uuid": "f6873fa5-30d7-4d96-a9bf-32ffd6d44e4c", "comment": "Malware payload (NanoCore)", "value": "562f39e34a6adc6b4ae7e5dfebec298747f50b3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852793, "uuid": "5845ae55-2ab8-4648-a29f-acc93e1581a6", "comment": "Malware payload (NanoCore)", "value": "f1b2154e41f9becf8183219271dc37b2bc5d186fc68c9d9df3dd5e16ad825c92a8be7132d2ada8976bef8e15ad4ea237", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852793, "uuid": "9ce6ab00-3e2a-4606-a048-152df916c947", "value": "T1702523A937A80331DD5CCB76E0E276941B32084D29D2DF60FE86C0E9445376D8D5BABA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852793, "uuid": "4bc5fd76-fc4b-46dc-9796-4772961637cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852793, "uuid": "1190bb88-536e-452b-9a9b-c73f569db0ae", "value": "24576:gh3bl9FSEbCMVsMFVrmDtmsC+mP3tkNuBhXh0bXF7:gh3TFSEbFVsMXrmDtmZ+43uuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647852793, "uuid": "2bd29513-2231-41a1-9796-545c0d3a050d", "value": 1048064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647852793, "uuid": "19f6d641-64e2-40f0-9233-ccb16219ef64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852793, "uuid": "fad6c01b-b50f-4c41-a134-fb4074b3f417", "value": "Simon's CV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "505a75f8-a8f7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647854070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854070, "uuid": "1e85ee3e-aa5e-470f-a119-2613b0cf8917", "comment": "Malware payload (Heodo)", "value": "db0ca367bc8b67ce29adac3e0f68c86c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854070, "uuid": "fc6bbaee-00c1-409c-ba4e-809326cbc170", "comment": "Malware payload (Heodo)", "value": "063552c499e68dea0a9f374bd03387430d60e8020b9cab6203f508ac03a8f4d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854070, "uuid": "70a2e25f-0df4-4e68-92ea-db00247b9571", "comment": "Malware payload (Heodo)", "value": "d54c42e04e3cbabd9b55ae5ada2a508b6eecc916", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854070, "uuid": "b529ad4c-5a17-4f66-a521-c7606dc28207", "comment": "Malware payload (Heodo)", "value": "49a70acdc93906e3fdc6d7604972866ed433df2bd7c1afaae7f80c84e5de149ffba4368f3358a1362a6cfec968d5fb72", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854070, "uuid": "7d97f275-6be3-4641-9076-34b141e1c3f9", "value": "T18C056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854070, "uuid": "b845918b-88b8-4b5c-9c0c-1df40856085c", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854070, "uuid": "793f8426-bba7-4e6e-b63f-d8a6f787d0d0", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rl5CGNHrH2tZ+d+:gMV/rl5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647854070, "uuid": "cb796a8b-f909-4966-b105-73959c014640", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647854070, "uuid": "6bea9e6d-599b-4fd5-8dcf-05745dc352cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854070, "uuid": "86b9760f-7558-4338-ba0a-f6c5b5ccb3e2", "value": "db0ca367bc8b67ce29adac3e0f68c86c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c86131a6-a942-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1647886483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886483, "uuid": "a33bb06a-5df4-40ed-99de-95a9e85c9303", "comment": "Malware payload (CoinMiner)", "value": "175fcbedad2da7260c0a1509cf70294e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886483, "uuid": "7d873dea-26b2-45f7-8393-9ea9663a6d70", "comment": "Malware payload (CoinMiner)", "value": "06dbbdd3df2de3fba52f72cbac4c5d1e06f794de90a29fa7ea2f449e3a4fc37d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886483, "uuid": "f88408df-819c-47bd-85f4-6cee43b7e7fc", "comment": "Malware payload (CoinMiner)", "value": "aeca2f0f340b7c25fc7ec7c89a0c1869e8623a91", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886483, "uuid": "841ee2cf-277d-4adb-8b75-ff0ea360acb2", "comment": "Malware payload (CoinMiner)", "value": "cee422e9e97e7ac2ca1ea6b3d249c6381af79036fd925bb0ac2e587246e3326ec3c95de2978c22f42d10ecfd6e093bbb", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886483, "uuid": "f338e005-5313-41f4-9667-6a4d7aaab1e2", "value": "T1DEE501FA2280379CC01AC5385533FD49F2F6551E1BD9E9EEB6CB76C03B6A815D902B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886483, "uuid": "00c6f768-6145-41bc-9b2c-e5d2bc0cacde", "value": "4e4095a0d90406c8428c5d9a9c6b05b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886483, "uuid": "8882dec6-5c4a-4d9e-bd08-c2e8cd1e5c65", "value": "98304:Fb1qzKYAGyOxA9tlY/sDNa6zA9vGyYKC5pTC:FpkRo2oMEhyYnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647886483, "uuid": "a4af4166-7870-4485-aa94-b309ddbef102", "value": 3293128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647886483, "uuid": "7d4ac742-de6b-45b4-bd7d-ecbcfe026c4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886483, "uuid": "496a0084-1fa6-4e49-926e-8cbb8e54ec82", "value": "SecuriteInfo.com.Artemis175FCBEDAD2D.30670.10021", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "962ccf96-a8f3-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1647852469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852469, "uuid": "7f62665a-dddb-4bb4-93f1-5332188d5a8b", "comment": "Malware payload (NanoCore)", "value": "ca1494e922b3e4aaff4bedfae789f6db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852469, "uuid": "e7cf5466-bcb9-4c5d-bb06-d15daabff0fe", "comment": "Malware payload (NanoCore)", "value": "06e2bd278cbcabd6198150860fa658f783a75bc1484f2a32e0d0bd8ed427b3da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852469, "uuid": "bc29809e-0ad2-41af-85e0-34602382f814", "comment": "Malware payload (NanoCore)", "value": "1bbd5e84439c1af17eb82b4fdf04279b4b76954a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852469, "uuid": "35c17afc-de66-4fb1-8cea-e25a2f7c565a", "comment": "Malware payload (NanoCore)", "value": "ca6b310c1edff849a7415fe17036936941d88fd0f038ab4129505bf0059bc650387d685dd9fb93afde03f7068612c520", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852469, "uuid": "763d6fb3-7b56-4f80-80ea-93d9c081ebff", "value": "T1A635235F33A06376D1A56B36D0E8B2611BB380D97153EF45CE0851426F13BA81D1EFBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852469, "uuid": "65a4b75d-8ee7-44a6-8dc6-5477a332371d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852469, "uuid": "dd5073c7-6646-4230-a1d0-ca54654b1cfb", "value": "24576:9OHl99V7XFfj8FwPIAN+L5PiSx8/+F8ldCYEN1dV8O29GG:9OXL7Vfj8qAAN+ZNu6l1dS59GG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647852469, "uuid": "3dc6d720-641a-49d3-b85c-f2baa5ef0b2d", "value": 1063424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647852469, "uuid": "9ea730c6-1d37-4e3f-b0d5-83ce00b30f69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852469, "uuid": "a0653a3a-9f56-4026-890b-6f786c70d935", "value": "ca1494e922b3e4aaff4bedfae789f6db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb0450c-a8f7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647854142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854142, "uuid": "2b9ca3bc-d2ad-406e-8463-a393755b10de", "comment": "Malware payload (Heodo)", "value": "76066163bdbb0dd53170bb4f26c0fa21", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854142, "uuid": "974e0b21-cbd7-452f-a817-13199f4db511", "comment": "Malware payload (Heodo)", "value": "06ec216e47bc5d79ef83a09785dac2264ad9ec0151f148ae3e443f1c9663a63c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854142, "uuid": "5c8286c1-2265-4ddd-9233-8dcc174b88d7", "comment": "Malware payload (Heodo)", "value": "ec8a900b1802e9517789c091c688f1fac3e9fc0f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854142, "uuid": "f727ba29-a114-47ab-ba86-e65b4e42f476", "comment": "Malware payload (Heodo)", "value": "cfb1a32074437e1ad3919b0107eab30514ec3fed3cac2b40e1312933836f70a9ef57f7760e6256618c23e117d3bad211", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854142, "uuid": "64016f04-81a9-4845-a247-147e6a657bc1", "value": "T17F056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854142, "uuid": "75018acc-48de-40a4-9399-96dd3a7d679c", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854142, "uuid": "5a416175-d1d9-42bf-8832-2d22ca61b4d7", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/ra5CGNHrH2tZ+d+:gMV/ra5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647854142, "uuid": "0dad1817-00f5-456a-a8f2-5f8a4f3c1cf8", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647854142, "uuid": "90d0e958-ceaf-44c4-bcd5-9fd1ca7e4fc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854142, "uuid": "8077dcf1-41db-4b8b-8105-ad809b9e14ac", "value": "76066163bdbb0dd53170bb4f26c0fa21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7b146b4-a951-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647892951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647892951, "uuid": "cdb984aa-9b40-41ea-a1dd-7d4cfd13c57b", "comment": "Malware payload (RedLineStealer)", "value": "121c71757cd4ea0381f37c2dc262e869", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647892951, "uuid": "20d35dbb-5c3d-41bf-976d-789564a4ebf5", "comment": "Malware payload (RedLineStealer)", "value": "07381ec579c129412dd2dbe860b81d636d9bbf5acea409c3ed17d981ca31940c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647892951, "uuid": "15b09e94-daf5-449c-93d2-d29da2484b4c", "comment": "Malware payload (RedLineStealer)", "value": "c691de043911fca86028e7526f698b65830642d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647892951, "uuid": "7efd8ada-1339-4df8-9e19-9011841d008a", "comment": "Malware payload (RedLineStealer)", "value": "671d70d6f044907bfb9e73a07189dd4a9ab91950911fb9ac881d141e39527a1995ed99ebcf63f15346895eba9ea5b925", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647892951, "uuid": "468039d2-183d-4f6b-b88b-6c6c71b3cab2", "value": "T12984C000BBA1C035F5B752F848BA93A8B52E7DA05B2190CF62D52BEB56347D0EC3135B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647892951, "uuid": "7fcb8328-d404-4749-ada9-93b4e5b2f392", "value": "7288d715a9ee18d7dad5b71be8ad934b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647892951, "uuid": "3f7c66fa-053e-4344-a8d8-9cf343c22756", "value": "6144:4++NbSwEF2G2KnqXtpNoI/Tx6/swOYCdKCGASm7G5s1puo:4hbSwEF2GFEtpNoCT81OhdKXg7P/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647892951, "uuid": "bef594e5-b5a6-4f7d-b9cc-f55be3099011", "value": 379392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647892951, "uuid": "14ac93d1-b4f6-4692-9ebd-de8aa3615c1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647892951, "uuid": "08088314-655f-492a-83ff-5798d9556a9b", "value": "121c71757cd4ea0381f37c2dc262e869.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0629f4b6-a8f1-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647851368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851368, "uuid": "65e73a32-ac95-4b57-acd8-64a6d948c262", "comment": "Malware payload (AgentTesla)", "value": "bf1707c721d1a474bc5890e815202674", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851368, "uuid": "c400fc62-ad64-4e33-8d24-1dca9b8633d1", "comment": "Malware payload (AgentTesla)", "value": "0739aaeb8efd6fbd43ad94cc327b5672ec45fea394c6949fdbcdbc4fabc9c5aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851368, "uuid": "39beec84-b77c-411f-a129-560449a50ba1", "comment": "Malware payload (AgentTesla)", "value": "b09d4ea69e811a876f782ea7db07eb655168169d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851368, "uuid": "6536819c-bd4f-4b30-aefb-1894c138c897", "comment": "Malware payload (AgentTesla)", "value": "c668e3e588004fdc697818bffb8c76a2cf24dd299df014c15fe54e1be79a20c5f9b748ad5bfb4fe4550ca20b01dfe492", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851368, "uuid": "5345c419-9799-46c5-bc94-dafbd4c4231f", "value": "T17F54126A28E1A7B5D9950D3017F2F7B4E7B3D1C80A5482570FF92F8B5C82163C12E96B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851368, "uuid": "30363de2-aa89-416a-a28b-c636ea095819", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851368, "uuid": "b9e3e6bc-d16f-4c1c-8923-b14c443612c1", "value": "6144:rGi5vA6GK/Dkm4KZWulDIF3zv7l31e+foO1yB8xScgBHNCN4/:H/QmPZWulDIRv73wJQTkHNSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851368, "uuid": "0c08b7e8-da43-4274-b279-0eeba299a190", "value": 291828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851368, "uuid": "c6413185-fe49-432b-bc33-6c7604cd9eca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851368, "uuid": "77685751-eba1-4c7c-9a88-01be1d30ef2a", "value": "Halkbank_Ekstre_20200520_115007_302191.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc27a89b-a8ba-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647828078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647828078, "uuid": "9e603d2f-18aa-4b31-bcaf-85d84da6804a", "comment": "Malware payload (Loki)", "value": "b12b04decc1812929236df220e2089ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647828078, "uuid": "4477a11a-565f-4fe8-8bd4-d1a58cbeffe5", "comment": "Malware payload (Loki)", "value": "084a4f35a98c5a296639d91e597da23cfaba7816ea5a73cfbe92828c937c30a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647828078, "uuid": "3ecc93b6-ea38-41a9-b8eb-71ea9d13216d", "comment": "Malware payload (Loki)", "value": "f035f67350e36629ae8d41b4c3902dfb01dc3539", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647828078, "uuid": "cf930e25-fbe0-4753-b6b2-66a41e44f12c", "comment": "Malware payload (Loki)", "value": "3465a0eb27d6ad57e381a6a4da1d266153e267c3e466ff4c5578a96155fe665432307bad10e2242b5cf64c0e10a9fbe0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647828078, "uuid": "9b41d842-d0f1-444a-89db-8f5b444a9f28", "value": "T1ABA4DFC2F84005E1E83E493164794D56835A3D769CB5A21E2F8D7AAA3BF32E3413794F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647828078, "uuid": "2e5ae525-b8ba-4c86-9cfe-26e0addef762", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647828078, "uuid": "20532fa9-b5c6-41b4-8e6a-d0896c9f1a75", "value": "6144:7GiAqdG5QmdGKUTNpI5AO3N/hYsuEPaThbsDoMk1COeb+wFktaKYa2wMzsxxaHKZ:jG5QmdRU5S5FN/hVD+okbefU6agI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647828078, "uuid": "c786fc79-6410-4158-82cb-ba0ae019f996", "value": 469616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647828078, "uuid": "f9be3ec4-7a2a-4968-8e19-30769725f94a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647828078, "uuid": "51e901e4-c51b-4d64-9435-11f7ad3fb28b", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b526f591-a8f0-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647851232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851232, "uuid": "977410c0-baad-42bd-92ba-3f1f40b33f06", "comment": "Malware payload (Loki)", "value": "c2a05210e59b0959313f0dbb2dc59ee2", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851232, "uuid": "87c5f9e5-769a-4163-91af-d6d569bc6a08", "comment": "Malware payload (Loki)", "value": "08787bae1fd0330260930f2d08c3830ecce86198cbb2e87557fa71d2ae1db430", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851232, "uuid": "371cde4c-2b24-409e-b2c3-88e3c8f5fd4a", "comment": "Malware payload (Loki)", "value": "dc147fbb3098e5b1f5fdd40bc6ebe7e2468b7fbb", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851232, "uuid": "f748723b-239c-4e68-a937-5c88c093b2bb", "comment": "Malware payload (Loki)", "value": "f70211ffdf4aa687e53d5c0d5ac4e2153f77b719fc350e04d52623240535344bd91140cd41608b09bcfbc5292ddeda0d", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851232, "uuid": "49390c11-6e7e-485d-845a-78913036322a", "value": "T18314129E3F917457DEB448305DB31F02F0205D7B6587670B56A2B36BB0B0E601B9F62A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851232, "uuid": "9679fc46-b296-495e-92c6-53e4af7de057", "value": "3072:wUS58Lz6Tv7KHzKHFEv92IM9j5NmtIYaOSCO2OWRo/jOJwDlVhPUE3:a+svGHWHFEvoI6j5N67KixQKJwDlV1UC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851232, "uuid": "3f28bb8a-0fdb-45ac-8122-0fd8abfe7f64", "value": 190488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851232, "uuid": "7eb074ab-1fc3-43ce-9d6f-b2469242f8f4", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851232, "uuid": "a45ef193-b0ee-4d57-8212-650f944151ba", "value": "4421.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c297d9dd-a8f4-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647852973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852973, "uuid": "def3a6de-1605-41fb-bc3e-57fd7b6b2a89", "comment": "Malware payload (Formbook)", "value": "c9ebfc3cfe3d380505cce06d0f022963", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852973, "uuid": "008ddb10-bfe9-4ea4-9b23-80ebfc2dda60", "comment": "Malware payload (Formbook)", "value": "08c5245921db274916485dcb04652e21c08f39fcabb67b37ddd472dc1aac894a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852973, "uuid": "af1a4a02-aa50-4fe8-b51d-93765a5599c5", "comment": "Malware payload (Formbook)", "value": "d18348b4ac0079847d3c762c63ca51381a00ee6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852973, "uuid": "f60e2d34-59d7-4498-b56d-777c2d96369b", "comment": "Malware payload (Formbook)", "value": "9c15929d0b5b3c54629398f4928b0a39e4f57892a9ee2072be423eeb0517a2d0d3514282c3c7ea8167af51c3a4b7f244", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852973, "uuid": "5781c34c-9934-44f3-baca-5f0ad2c150ce", "value": "T124440907B94485D8CE7845FEB2478150B7C99CBFD248F609EBC833A74EE16A21D26B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852973, "uuid": "7ae5e69e-9221-4790-bce8-3128fcf70bee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852973, "uuid": "f9cdce60-2b21-458b-8769-15cd68b4f3b5", "value": "3072:fI6gbDSKXOg87OvfL1Qqth5qGzBivpf01dlLCP8UEKhQ6qKnoVEfx:fJ0SKegt1QqtkV0hmqKoVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647852973, "uuid": "11c5b2fa-f799-4ffd-9241-8b813fc3d67a", "value": 257024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647852973, "uuid": "0ed288e8-7595-4ee3-9510-49d91eeeec33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852973, "uuid": "e20282f7-399a-4a82-85f9-bff562b40bb1", "value": "PO#15032016-A001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d918ca77-a967-11ec-9275-42010a9c0029", "comment": "Malware payload (CobaltStrike)", "timestamp": 1647902403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647902403, "uuid": "0acd2f67-1cdf-424b-a99a-7fd200bbfd94", "comment": "Malware payload (CobaltStrike)", "value": "fce75d9b68fcf4a13e76e0fd6f92e1ae", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647902403, "uuid": "f38aa100-cb8e-4b0e-a54e-0d1efd5743c5", "comment": "Malware payload (CobaltStrike)", "value": "09d8fb54a22c3bb753fce7dc5192221122cf5dc26b42504ffca254e2521dbf8e", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647902403, "uuid": "c3206ed5-23a2-4d27-b2ac-ebd436895937", "comment": "Malware payload (CobaltStrike)", "value": "be6c19e160240c844b8f07b04c2080412fc4bd50", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647902403, "uuid": "a752b1ee-9e89-49cd-a21b-67cbc932f1cd", "comment": "Malware payload (CobaltStrike)", "value": "64084a32cd02efabc1db9e74ad63aea42689b1e5b3a0e947b64c51aca4f4231040ba3f77055793dd5ef294eacf75d57a", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647902403, "uuid": "df0166ff-671c-4015-b149-8e8a3a59459b", "value": "T13DA48B8FA164C4BAE91D6131C19007C6C332F647A62459DA1758CE29FDE7246FFBBB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647902403, "uuid": "81887fad-9a5d-435a-942b-3a6e5faae1fd", "value": "24da2cdd90bb4855a4a5f456b4a45738", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647902403, "uuid": "f7555900-d84b-416a-b937-e8b9aec7d934", "value": "6144:0Y7YvpE6kgzAU+ne0no02f7k0utAH6e3VwvoI8lAPXjylgAgqk7irNa7s6no:n78G6KeGo02jC2zFwAoOgDqkyD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647902403, "uuid": "47254127-bb93-4ecf-acb9-771a4d441816", "value": 474624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647902403, "uuid": "6fcc2602-ebf7-4623-85b2-307e3b8af690", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647902403, "uuid": "f4ce405b-f423-4393-b65b-dccf3695e00b", "value": "Ifof.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb9ea967-a8f0-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647851243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851243, "uuid": "40525ef1-18e8-4966-8f33-2661f5685af6", "comment": "Malware payload (Loki)", "value": "714d22ae28ce39ba938b49c693dc0f8c", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851243, "uuid": "fe00f9ae-6a30-43a7-bb60-05b1dd0f5071", "comment": "Malware payload (Loki)", "value": "09ea9e859267f2dba89257f4ad09a8485563779e36303f6db416531a4c3d3a18", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851243, "uuid": "3c0048b8-59e6-41fe-9b15-51bf25591968", "comment": "Malware payload (Loki)", "value": "f3efcd59dbd5f8d71f0a51892e9aa947df7970a8", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851243, "uuid": "faee7693-0cfa-4c25-820a-7928cd9d4789", "comment": "Malware payload (Loki)", "value": "0278b76b6cd5ae946dd300ed338184f03a776d90db06545d3a157ac2c83e6ef172c6aac133dc1c70366d7ff5ad54e7b1", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851243, "uuid": "8cd0b82a-723b-456f-8541-f6f30cef2f9f", "value": "T1531412087BAB7A14F89C4870AC227A2EE660FC0CDBD744CBBB9532965136D10D579F36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851243, "uuid": "15fccbe4-1282-44af-b060-84b37186f1d0", "value": "3072:sQ//MVZbP3G+4i7yfBS3bS6WgGpuhhVbY5/iuOwyMChaDlwsFu18/7ij2RHanZ:D/IZbvGKgBS3e6opupb6Chab+jI6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851243, "uuid": "1ac36b17-d9c9-4bd6-85b2-b092dba8baa0", "value": 190360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851243, "uuid": "d0431d4d-f0ed-483d-a867-3cee7f95fbad", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851243, "uuid": "d6cadd32-064d-4464-b07a-2ef86c579058", "value": "New Order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "003c7f6f-a8ef-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647850499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850499, "uuid": "d0f0bd64-362a-4bbc-8bd7-dc5aec107738", "comment": "Malware payload (AgentTesla)", "value": "3714e514ef3ceeca0226cd36cc7854c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850499, "uuid": "24cd8b0a-dcff-427d-9784-cfeaaaab6405", "comment": "Malware payload (AgentTesla)", "value": "0a0a9ac2b7399c96c3951044f93e964f3c01512128ea256141a10c66e4469d48", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850499, "uuid": "afe5363e-279c-4d88-8b83-741021c093f4", "comment": "Malware payload (AgentTesla)", "value": "354c71e667f4b05786bcb396533a1e7297e198c8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850499, "uuid": "0e03d780-e8ba-4591-a07a-e265c575da0b", "comment": "Malware payload (AgentTesla)", "value": "175bf933b3763269745c8c4ef330208b734a679f804dae402cd669762bebf29f939dddf7161e0bca44308d4764c40192", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850499, "uuid": "19fef35d-3e2a-4f8c-91bc-f69fccd0b20e", "value": "T1809568F0AD01D4C1F57E5B6AF2FD3A48A1343217EBC94A4A00E7E5651EF6A11B90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850499, "uuid": "292316bb-ade3-42d2-a6f9-22dd4f68e1d3", "value": "6144:5z4Y4yuUxWWVWotg+HkqAgW99EQNKU0J33DTLMKMNORrvdfG1kZABMBtSabitqNz:5b4yeJCEqAjFenolYxy6tSa6Htqg2e2R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647850499, "uuid": "f839b27d-2d93-4b71-815b-006d008e8939", "value": 1938697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647850499, "uuid": "c4e5e815-3389-466d-ba91-8ea89e80f0b3", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850499, "uuid": "d72b5a63-dbe6-43a4-8e59-571b33c65a76", "value": "P.O STT-2021-0337.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed3364db-a902-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647859057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647859057, "uuid": "28d299e6-7952-4cc9-b25b-bc9e92c0abcb", "comment": "Malware payload (AgentTesla)", "value": "4e4070c01ca3ee8b41a1b66fe4fcc85b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647859057, "uuid": "f6638f4d-4ce4-400c-9fc8-d5f3e534c23c", "comment": "Malware payload (AgentTesla)", "value": "0a26073dc1b719d6c2f2ceb4c2a43f44d031c59c9a1082cace4b0358080c3cea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647859057, "uuid": "6f0a47a5-96e7-4b4f-b658-f8c85d380a89", "comment": "Malware payload (AgentTesla)", "value": "b570d785761f9615845f9b2672ee55325cd898ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647859057, "uuid": "73dcf47c-3398-4cc6-b16a-81ea0eb844cf", "comment": "Malware payload (AgentTesla)", "value": "e8c32f16bf188f5158447593c4ba9c335179c5a6e77adca590834403144ba883771abe49827a0884fc4987afca648799", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647859057, "uuid": "a70fd22f-d4d6-4a30-897b-2f00d459ac29", "value": "T1FF14923A2D7BA000FEFCC139BDD07380426879BFADCA9F86E94475C935A72D45270966", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647859057, "uuid": "99bfab72-7ce2-4535-a770-16c5d74f76b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647859057, "uuid": "34b90416-7e3a-44fb-a890-72a50baad425", "value": "768:nBCc2l7qsU6iqGnjGPGQ4JTvVKmXUu8CkYdIiuQMCnLhL7r6+9vYrZjY56666668:8c2FsaGnqPGQKT1T3MYLN64vMmgH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647859057, "uuid": "8d18bc5d-1e50-44a5-927f-d787d4bb06b8", "value": 203776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647859057, "uuid": "41060670-0782-4508-800a-7b285f8238bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647859057, "uuid": "02b2d24d-c948-43b4-a1e6-03f7602cf4be", "value": "SOA 21-03-2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "686b4eed-a915-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647866995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866995, "uuid": "2bd79afb-c033-4597-913d-3b3027910c22", "comment": "Malware payload (Formbook)", "value": "cb52953354ed7d1d03799de6dfe690af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866995, "uuid": "570ddf1f-3d08-4e8e-9934-8116d83895a4", "comment": "Malware payload (Formbook)", "value": "0a274394227749921c5e4297299005d9501301100329c2eaf0deb78d753290ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866995, "uuid": "2a62fee0-77b0-4fb5-ba9e-ffcec386df67", "comment": "Malware payload (Formbook)", "value": "f2392f5f877f37527e714227cfb4f3e4690c6f8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866995, "uuid": "4b8f0d3a-6313-4796-ba71-c98bdbd60fae", "comment": "Malware payload (Formbook)", "value": "20a99f29a48a44fce04cbd037d78e8deb6567558ce37d55e9e5a2dff06f5ee3ff9bee4fab461f98a90a572fbcb209344", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866995, "uuid": "eb311252-ecf7-4ee8-9b88-ddd2d9af3b7d", "value": "T19325230573FA5713C96B077058FF74148F708A47AD43EB8978C1620D8A13B67AF469AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866995, "uuid": "3bb4e5d5-9589-4bdd-8b08-86fcae1d7445", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866995, "uuid": "824f7e03-31d7-44eb-91e4-3fa22eaeb673", "value": "24576:Boy925mt+wbrBYI128ZkC4k8bQINlLNlENWH:6u2wtni59llLE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647866995, "uuid": "7ca3ac03-5cd5-4d8a-877a-ef0366665ebe", "value": 1020416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647866995, "uuid": "bc9b3b88-b4b7-4ef6-8604-93021d0cf618", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866995, "uuid": "0cdc66d8-01dd-4312-95be-3f96dab357d7", "value": "Payment_Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e84cb1-a942-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647886476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886476, "uuid": "7203401a-160b-4224-9a35-1287182a794a", "comment": "Malware payload (RedLineStealer)", "value": "1d021b944eee9ff3409697c40d7e62fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886476, "uuid": "238718e8-c0e0-4e4c-80c7-5b0d0af4e018", "comment": "Malware payload (RedLineStealer)", "value": "0a58cbc8337a5ccc96032ae8289e77c4bdc4303e2dd2685f9b118c49c4aee859", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886476, "uuid": "e3f5ad44-a5f3-4e9c-9d46-b201599cfe8a", "comment": "Malware payload (RedLineStealer)", "value": "22705cdcf682d3de53cf66dc385760d4d6840463", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886476, "uuid": "80dd40e1-eaf4-412d-a39b-abee345cf40e", "comment": "Malware payload (RedLineStealer)", "value": "e0d467f27869ae7df96c6b5743c674fe1990c11c039f3a2cc556a926f6e39b99d5e998b99a7c72bebc0be7eb6579c5d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886476, "uuid": "21569af7-6338-4eeb-8959-45f9f4be3276", "value": "T13AA4AE2A72968FC4C5892E37E4A6C8541BC2A75713B3D70EEAB705D71F433A44CE52E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886476, "uuid": "83021642-93d0-4e04-917c-3d4c22171437", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886476, "uuid": "a8b418d0-9f96-4819-a24c-477d3d25656c", "value": "6144:iNM1VysG861IScod1y3Kbq5k/gBhp0Q86d/x96tK/k12X1bP96nJ1nA:p15GZ1Iu2igGL6d/x9eK/k12X9PA1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647886476, "uuid": "1666b71c-f31d-4694-84bf-c4e77f6b9907", "value": 481536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647886476, "uuid": "ee7818dd-e0af-478f-b77d-a9d8ada3354c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886476, "uuid": "ec69ba3c-8e97-4d1c-ac57-d4c6f8ac24f0", "value": "SecuriteInfo.com.Variant.Lazy.77001.12266.24485", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d997369c-a947-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647888659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888659, "uuid": "45183e82-f435-415a-aac4-07dba62535fa", "comment": "Malware payload (Mirai)", "value": "6093efb94c715094a9f0335f743e490a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888659, "uuid": "298239e5-e8a2-48c5-9d41-4b8d6cd56569", "comment": "Malware payload (Mirai)", "value": "0a6e03577e2ec18f272f04ae5c5e84e144ab98fd20dd5a1d7dbcdc15005bc294", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888659, "uuid": "7f2f1d56-7279-4190-a7f2-4ac084fe8009", "comment": "Malware payload (Mirai)", "value": "7aea3e983f287b61d174a23718dbb154a41eb1f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888659, "uuid": "0679b09e-39af-40a5-84e2-36606e8e27be", "comment": "Malware payload (Mirai)", "value": "6fa13e5438c267d3c2f3117e27d3c95e60e58162ba811ad77601e23f9a723c4539ae245fe39740b7153b88bbc78daaad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888659, "uuid": "9adcc607-61b2-44ee-9943-8be5ed67226f", "value": "T184245B9ADA504D43C0C567717A7E81093363A3B4C3CBB21B8D286BB437DFA5D2D7A815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888659, "uuid": "2b8a8176-7419-498d-99bd-32fbc0c8e63f", "value": "6144:vwFgLv7QPHGZ3J1tLL9/wAwIjyWkOjjPgQTx54kj/mzBphM/9eXlUY:vwFev7aGZ3ztCAwCypEPgQTx54tw/cXl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647888659, "uuid": "13fa61ae-ac89-416f-9760-8d91c48973a9", "value": 226793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647888659, "uuid": "44ea5c17-0066-40c9-b898-4406e6988750", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888659, "uuid": "31a58e08-3814-42d3-8e91-f5afa244c739", "value": "6093efb94c715094a9f0335f743e490a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb7547b4-a91d-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1647870570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647870570, "uuid": "9efcbf33-2d06-4c75-a6f6-6ee987d3d841", "comment": "Malware payload (RaccoonStealer)", "value": "c058c45e4fb6def83ea503a2a6ce7c43", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647870570, "uuid": "7dea1615-18e3-4a5f-82b0-d40cff0ee99e", "comment": "Malware payload (RaccoonStealer)", "value": "0a7dcaf9e64345aeb5abd12728983253beacd114e4dbe2b3f5addfb7f198d854", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647870570, "uuid": "aa2c16cc-7b12-4f8a-b780-bd7f9dec8aa6", "comment": "Malware payload (RaccoonStealer)", "value": "a5f4e1cc7e2682105ee092d4166de179e254dc30", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647870570, "uuid": "07538142-0617-4443-a908-d54eb69e8251", "comment": "Malware payload (RaccoonStealer)", "value": "0ede393594eb2718e6b08d196afa770682a625fd65e308e639dd3c5e96ae57fd7c5d709fe423bea5259a434d7e32d3a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647870570, "uuid": "20d32ee1-a0bc-4ae8-b674-42f28ddbe4a2", "value": "T109C4E040B7A0C03DF1B701F4797AD3A9682E7EA05B2554CF62D62ADB66342E0DCB534B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647870570, "uuid": "266c402c-e1f2-4e6d-86fa-34ef9f37f67c", "value": "5761b9d43ffb6d646c886cb4b6f3b2d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647870570, "uuid": "566cf174-33cd-4078-81fd-29e66f7872da", "value": "12288:jnf2Sqi5gmmYHxCjOJqqJrzoR9Ft2MLYSpvtKvzJ:bfV5pRbJqYr3KvVKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647870570, "uuid": "1502ed77-9d32-408d-a7d8-5951d6c79b7a", "value": 564224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647870570, "uuid": "2bff1fcb-f599-49bb-a5ef-ccfdc18f0914", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647870570, "uuid": "f3e18049-2087-483c-ad7e-849339e43ece", "value": "c058c45e4fb6def83ea503a2a6ce7c43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb6c657f-a91c-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647870141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647870141, "uuid": "43c80be3-10e2-4b5b-a27f-c421b5b04548", "comment": "Malware payload (Loki)", "value": "20ee6ead403d936706e9d7691a30addb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647870141, "uuid": "62813222-fa6c-4fa4-aa22-daec218367ca", "comment": "Malware payload (Loki)", "value": "0b2a98d26dd59fc20838270f243a63a9abed0b230e3d25c5a2d757b1ddfa84a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647870141, "uuid": "985ead5c-200e-464f-996e-f494cbf26d8b", "comment": "Malware payload (Loki)", "value": "a918cb87d6e85d1c8cb262ed43aa73f4464b645c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647870141, "uuid": "38ad2385-446e-4d6e-818d-992e3679abc4", "comment": "Malware payload (Loki)", "value": "e0c180bf6a479ffce470eddd9898608c22164f5db8814dd6b90d7c805572bd07d16bc8252856fa002e421a7495654a2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647870141, "uuid": "16233c9c-c402-4d53-9a8b-5ecdd6272d24", "value": "T1B334120FA4C11977E5A645B11DB3F658FBF587C502C74D2B2B812EBB3E729C602990B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647870141, "uuid": "4cc9ceff-d997-4041-81ed-a91296485055", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647870141, "uuid": "88626708-f276-4162-9228-c52a2bf94a03", "value": "6144:rGiN6R7Fgs6DPInQwrAKd/TjRugPP2k2roxV:O7GPDPI7dRpn2kDV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647870141, "uuid": "ff7f0123-6be9-42b1-80f4-0b649dea5b22", "value": 244000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647870141, "uuid": "d6aaec9a-8ccc-4219-97f9-217869c9756d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647870141, "uuid": "dcf7353d-a20b-461f-88f1-8249ad3aadac", "value": "20ee6ead403d936706e9d7691a30addb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca966eb-a8ed-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647849876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849876, "uuid": "290988a7-37de-40a7-a4dd-8f0f67256761", "comment": "Malware payload (SnakeKeylogger)", "value": "859f6433c9d45c68bf0dabc9a0bf9815", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849876, "uuid": "f9fed309-4884-448e-8bdb-450bf89a3d51", "comment": "Malware payload (SnakeKeylogger)", "value": "0b685bdefe083164a9c05729917d1dee7f09e751287b48789762db854e60d934", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849876, "uuid": "0f9f0f6d-7614-4c02-a50a-cec119ed05c2", "comment": "Malware payload (SnakeKeylogger)", "value": "915662542393dadefa9cd4fc4a3ac6bef4ae00b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849876, "uuid": "cdcdc8a6-0830-400a-a903-d13d556212d1", "comment": "Malware payload (SnakeKeylogger)", "value": "06e6c55c8d85a00ca199346b5afbfd62daef1b521a1e02892560bf52f098f5699796ea382b07d88c99dfec36dd4f6c37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849876, "uuid": "58d62496-22a0-4aec-934e-9b890cafe7d8", "value": "T151F4F8BD715472BFC877C1318A945C64F650A8FB630B4917A4931B9A9E0F8C7EF840BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849876, "uuid": "c3cb7e4e-afc8-4e1e-a679-16bdc65c9551", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849876, "uuid": "b83991b1-dedd-4cea-be37-d77792e898a3", "value": "12288:wEOt5lXwOeN38mgHTX4sGJbdvjlLzanc4MGJnz4yabO+pSg/dnFKYK2kOs+SacP2:EhQnFKYKzxGDJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647849876, "uuid": "df3dfce1-1ab6-4449-8571-1755f260a3df", "value": 726016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647849876, "uuid": "bc0b1f6c-3943-4f1a-8f2d-17c8fe5cefcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849876, "uuid": "84454a82-c265-4bfe-b0b9-ce1f7c39bfb4", "value": "PO-98766.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7ab9cff-a914-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1647866698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866698, "uuid": "5be24689-89d1-4854-aa13-77da3a612019", "comment": "Malware payload (NanoCore)", "value": "aa830d69d18a4993df4cff0f2dbf3b92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866698, "uuid": "26b98146-420a-425e-bb29-da18328737eb", "comment": "Malware payload (NanoCore)", "value": "0c9172e1657a20e5e5b35d9a6632b5b87c5db320275dd0cd62d4174aa69547ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866698, "uuid": "9d14e36a-77a8-4bc2-aaee-9da27c27b189", "comment": "Malware payload (NanoCore)", "value": "15005e9ac235116d19f1498cf59a2c91cbadf41d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866698, "uuid": "ce267a77-7e9d-40cd-af7c-3c117159860f", "comment": "Malware payload (NanoCore)", "value": "3806f945475713e2403628090a21f82e4c81388592f7454eed2b0e5a2ea868dcefc877a42715026a1f4168b54f6343b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866698, "uuid": "4dae5a61-c90a-49c6-9083-d5903b18bef1", "value": "T16BE25CC2F78AC225FCE70A3184379F40076BFE177892652E6A81B90B3EB324158B7557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866698, "uuid": "00995846-027e-4727-9406-bf1faa8c20cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866698, "uuid": "9748b8a6-8698-4f01-8569-c79fbad35b1d", "value": "384:LnKTXJNj8AmWSUQa6HlHp3/Afi/B02QZpBvgOeHIt4UtPx90LY:yXJNfXQa6HlHpvAfu/QZp92vOp9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647866698, "uuid": "96b8f2bd-6975-440d-a2e6-bf7fdf8d6d5a", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647866698, "uuid": "18a74ccc-54f5-4987-8534-2e7bcc0efa20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866698, "uuid": "395bf4a6-fb80-4b23-8d79-57b176a23f51", "value": "proforma invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "692e0250-a8b0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647823617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647823617, "uuid": "b163f036-dcae-4203-86ac-2c4ce0efc1de", "comment": "Malware payload (Heodo)", "value": "8c21d2fb1774f73d551efb9562cc0453", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647823617, "uuid": "662c4b7d-903b-46df-8857-ae0183606e35", "comment": "Malware payload (Heodo)", "value": "0c93289ec9126b0e1da63e46dd0c7e3faba0b73128b663104377dfbe7f141f3a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647823617, "uuid": "b454d823-33e9-4e14-ba0b-84419315ce36", "comment": "Malware payload (Heodo)", "value": "d1f5a4100a9cb80b021c5cc0738d191e7bdcd1db", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647823617, "uuid": "a49dcd31-fdce-41d4-8b30-6b6bbdc24a3d", "comment": "Malware payload (Heodo)", "value": "9aa775a37ea7238e59885d387e5b72465ac71b3efb397334471557f05c905e600e59b953dc0f6f24a863864b00e94797", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647823617, "uuid": "6f4c5495-84fc-464a-b0e8-bd5aac4c0be8", "value": "T14A54C41233C391F0CA53B564840FD125BCA7B83C6B15897DA247656F87EB8D0DA34AFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647823617, "uuid": "51b9a3fd-ef32-4485-983f-d3ced05972e9", "value": "6144:S5uok8qcKhyMlSXVKfKGS4Tp3wb8iZ7Bp:S54yM33d3q3Z7Bp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647823617, "uuid": "b5ed6690-9ef1-43e1-b01d-093c8deaad45", "value": 283241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647823617, "uuid": "4ee16830-79df-48d0-b187-250d25f6bff8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647823617, "uuid": "f2eede8c-1223-41f8-9f84-8ca3dae50786", "value": "emotet_exe_e5_0c93289ec9126b0e1da63e46dd0c7e3faba0b73128b663104377dfbe7f141f3a_2022-03-21__004652.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15ca5f51-a959-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647896062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896062, "uuid": "56bea06f-e5ea-4982-95c2-c5ff6dc5027a", "comment": "Malware payload (RedLineStealer)", "value": "1f44cb3f7a70d40ff17b22107439f157", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896062, "uuid": "019f2e7e-48a7-493c-b794-d6fe26635601", "comment": "Malware payload (RedLineStealer)", "value": "0ce48e2e63d12ffc1db98c8930379bc87b8b7bffa0fd5cec69d18a1905f4f926", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896062, "uuid": "9ff46eb2-6409-4866-82e1-b2f820f8bb4c", "comment": "Malware payload (RedLineStealer)", "value": "ad773e06476ddb246e586c2b7f92261ae596396c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896062, "uuid": "565b86a9-c855-40d6-8986-9b2f0ce9018b", "comment": "Malware payload (RedLineStealer)", "value": "fa4965c23723ac6d88a182e66bae2ca9049b029982359af8f1a117daa49a8d53a8332a5638b401d79f4b4ff5880fff51", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896062, "uuid": "b2440170-8beb-4b48-8636-d0aa4e756f53", "value": "T1EC0523D22082990BC9698DF1D3E7C5DED626DEC663282B13F6E4F00ED8B5653593AC31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896062, "uuid": "120c14de-e648-4e9c-a076-f418ea2bc91c", "value": "1f179fd74371e106fa3a05466339d6d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896062, "uuid": "95944626-a2ce-4733-9e3d-0d68403938f6", "value": "24576:j3GQEyzpjaVxcZQZ0XnrjuiCztOZde12N:rREyUcAujuMZw1a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647896062, "uuid": "3c3f146c-0ace-4c15-8d93-aa7671518382", "value": 862672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647896062, "uuid": "d637646b-229f-4861-aded-46ff18cee9b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896062, "uuid": "5a2647aa-482d-4df5-a1f0-d960df7fa763", "value": "1f44cb3f7a70d40ff17b22107439f157", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7854676-a8dc-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647842727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647842727, "uuid": "5c8c082c-b668-485e-82a0-a585950561a5", "comment": "Malware payload (AgentTesla)", "value": "d05dbb8e6f11539abed7baed34e26556", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647842727, "uuid": "a18c717b-0ea7-4ecb-8c5e-53a9ba590f5e", "comment": "Malware payload (AgentTesla)", "value": "0d60fd7d4e62968609a91331c8b55445f0829b5a26a598cb1cd2b9f1c647ba8f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647842727, "uuid": "b113d652-7b5d-4941-9f4c-6b2c6619349c", "comment": "Malware payload (AgentTesla)", "value": "7cafe28a5b6071d80b5923090c5cbe0d63448666", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647842727, "uuid": "95e6dbc9-002a-4743-bc4c-e88c47bed037", "comment": "Malware payload (AgentTesla)", "value": "e3e8c87555e30fdd6189ce77aa3d6a4934806565ef77bf7db050f299e4af497b3f8c95b4c3119a9ea445a0c90da4ad0b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647842727, "uuid": "7206c2b7-f9fb-4a90-81fc-07dbeb9d0ef5", "value": "T177F409BD715472BFC837C1328A945C64F650A8EB630B4917E5931B9A9D0F8C7EF840BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647842727, "uuid": "e21805b9-0ed1-4085-89df-104d86245e0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647842727, "uuid": "4144ff75-1111-42a0-ad70-95a772c0e323", "value": "12288:FMbImNhx9Wnv8zWqKSbf5JiFmeTQ+1jyYJAcSdPD+PY9j5/c/J3/b425xEgu:FMbBqccj4IW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647842727, "uuid": "91e85dba-8bf9-4900-87b9-e1d77af191ca", "value": 773120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647842727, "uuid": "24c6fe0f-4054-4290-b5e0-53a05ad56645", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647842727, "uuid": "951af7bd-b09c-4fce-8e8f-13c8319ed68e", "value": "pay me.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea6998c-a94c-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647890467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647890467, "uuid": "2ce62c20-8ed1-471c-b616-462d288ea616", "comment": "Malware payload (RedLineStealer)", "value": "16d5ee146536bd9462511a64cbc93008", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647890467, "uuid": "f5e8abe5-aba3-4c69-8a1e-f51cc0afdbc1", "comment": "Malware payload (RedLineStealer)", "value": "0d8e031c65e57c9924aa28bb61871e136c52cc522e8b247d504808ae93d779a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647890467, "uuid": "cc5aeb6b-a8ac-44de-a9fe-e5eb44b39f97", "comment": "Malware payload (RedLineStealer)", "value": "2a0e2b3b6226cd269e98459ca42dec2bece726e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647890467, "uuid": "a366a469-fade-43b0-979d-de79838a83ef", "comment": "Malware payload (RedLineStealer)", "value": "558ff9d2b71365af1ab20dd3592dc5463ec24078b683fc0f475f85e12654f14ca71a5213cac19bf095efdc876de29bb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647890467, "uuid": "e95a67bd-f104-405c-ad8b-99f915d996e7", "value": "T154549E40B7A0D03DF5B711F87879C7A8653E79A05B21A4CB22D26AEF16342E0EC7535B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647890467, "uuid": "4aec81b1-22e9-4984-948b-00fb4677183f", "value": "6dc76534a71225c5adf2ef004034f9e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647890467, "uuid": "2c9b90eb-d4b2-4ea8-8227-77be1f59a132", "value": "6144:7Mc9iYTrMdxBn8+gC599LFF7AxVAZyxr47BJiteW:gck2rMdxB8+F5zv7EAZyxrUJG/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647890467, "uuid": "e2adb13d-42e2-4518-b0c8-1cc87b07bc2a", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647890467, "uuid": "da08786c-a1b8-4295-bc69-46999e78bc25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647890467, "uuid": "fe39e4b9-ddcd-442a-a55f-c70fcfebaa86", "value": "16d5ee146536bd9462511a64cbc93008.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c003b07-a8bc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647828776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647828776, "uuid": "95452fcc-ec07-452c-be28-fcc5bdae2dd1", "comment": "Malware payload (Heodo)", "value": "7eb4469de4dda6735c8286242d3e5247", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647828776, "uuid": "cb8e2fd0-eb1d-4eb7-80eb-2c76e457f33b", "comment": "Malware payload (Heodo)", "value": "0da2819c05109458f9cabd7057cb2e44439b70d7aec1845c71051cfc175a157b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647828776, "uuid": "0d9e8aa8-2401-42c5-95cb-c11751db8cf2", "comment": "Malware payload (Heodo)", "value": "d79aa058d814678147f74bf50b49ffa9e520162a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647828776, "uuid": "7da81ee3-cb41-4392-bb6e-9beafb5efbd1", "comment": "Malware payload (Heodo)", "value": "4d8d29db0b9ef801eecb7652af5042ae664776b0f9e38d8cb79a2d418a15a3c7616a604c31b52b4677a153205c83a693", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647828776, "uuid": "f058285e-aa35-40ae-aa4b-e55a5a6a691a", "value": "T16CA44B0173C390F0C657A574840FD525ACB7B83C6B19857EA28BA26F4BF78D09A346F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647828776, "uuid": "88767e47-1a23-4993-b31d-82dfe0f1394f", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647828776, "uuid": "0719fdcb-c61c-4fc0-bd42-42897f5b79d5", "value": "6144:S5uok8qcKhyMlSXVKfKGS4Tp3wb8iZ7B1yarh07ArkqBoEimFmzUM090/DHr8cQl:S54yM33d3q3Z7BogFreNmF+U/9Jc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647828776, "uuid": "1de167bf-316f-4ac9-ac1a-15323e284a5b", "value": 474377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647828776, "uuid": "5cfec5fd-2097-4020-b8f2-c559b8d994d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647828776, "uuid": "83f17133-6a81-4eff-8d4d-21733c88ba41", "value": "emotet_exe_e5_0da2819c05109458f9cabd7057cb2e44439b70d7aec1845c71051cfc175a157b_2022-03-21__021250.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "882dbff6-a8ed-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647849868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849868, "uuid": "426b85e0-9f42-419c-86ee-45382e2fdbcc", "comment": "Malware payload (SnakeKeylogger)", "value": "08cf03289dac521b81fc5a1ac6259f63", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849868, "uuid": "a7763e12-9282-436f-b2df-293a3bf2316a", "comment": "Malware payload (SnakeKeylogger)", "value": "0dd5f1afe77cfe6400a607906b98691fcf144b89808eef024be6e7318b62584f", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849868, "uuid": "0f4e4191-bb02-4a98-9571-cfa31964c8fe", "comment": "Malware payload (SnakeKeylogger)", "value": "5b97be05ee321cdc753208cff1c9773c3e50bac3", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849868, "uuid": "bf447c4e-fa25-4c8b-9498-6379547349ec", "comment": "Malware payload (SnakeKeylogger)", "value": "af562f8df69b41f2869416e93f6ac61dcbd0b067f27070ddbc441d8fe07be734ec28b693b55e5132c4bb4d2d3bb64232", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849868, "uuid": "65022649-3b19-465d-8b50-15eb011835b1", "value": "T1C535121576362307C87A87F1096421901BF6359A7F06D70DBD9625CE8E22F634B22BBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849868, "uuid": "bd4aa38d-8be4-4515-a001-b79c9bd3bd0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849868, "uuid": "631f77fa-e062-47cf-b19f-2e511a820bf0", "value": "24576:/90UnsWuMCuVcR3FItiDRXHEfdXe5XU8Z8T0wdn03I5ARsNDL:1FXC9j3RXHElXeiVdn03aDL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647849868, "uuid": "de882fc2-d3f6-44c1-b514-87ab486bda3f", "value": 1091584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647849868, "uuid": "e5bd5215-9ea2-43f5-8a98-c6e5c5caa80b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849868, "uuid": "4b943280-495e-4f1e-ae18-9d212a75e396", "value": "invoice-32894.pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd14d35a-a939-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647882599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882599, "uuid": "76f2a7de-98d0-4c79-bb2d-672a7ff475cd", "comment": "Malware payload (Formbook)", "value": "c99e2dfb7b573ead8c2be74aa07ac855", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882599, "uuid": "aad2387f-10cd-44b0-8f5d-766ecae740d6", "comment": "Malware payload (Formbook)", "value": "0df55b25d8e1385f633bb9953a340d09968f92142f04728baa4b68d2ea4753f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882599, "uuid": "f0e59ade-e76d-4be7-b9b9-2ae602a8a9d4", "comment": "Malware payload (Formbook)", "value": "cc8a6d3c6519191f5344bb834a1624751fd4bd77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882599, "uuid": "c19663d6-5400-43b8-80e3-87d301dd2497", "comment": "Malware payload (Formbook)", "value": "96c9141f560b4888879617a562406afd125a8f69983bbb8edffe99f9b88aa9e8a41b6f142685c79208fff3fbb594ff2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882599, "uuid": "d675d0b4-4fb2-4554-90f2-040160bd6d95", "value": "T10C23390D3BCC7262C52DAA7D8D92919447F59EB33622D20BCF84365944B3B97AE01F87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882599, "uuid": "c215563c-fdf4-4ba7-b5ea-9df41162cdda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882599, "uuid": "48d72392-6a05-4d64-ad92-a63d4f0ae59e", "value": "768:HmIZmnegS/rhGymn/3R0nq0VKmXUu8uA55VCQvfnCZcgqEjFL7ICpppppppppppz:+S/rhGya/6qgU7CQXnLgqEjFL7Iq6Ky0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647882599, "uuid": "70b485ac-4834-4c7a-98f3-aa0d1820aefc", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647882599, "uuid": "0f4977da-fd8c-49f7-9eb1-c7cd2d6dd7ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882599, "uuid": "f8c87cec-82c8-4326-a17f-59ad9d065de7", "value": "NEWPO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e82061b-a8ff-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647857395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857395, "uuid": "4635a834-c9f9-4f91-95df-231e15f88cfb", "comment": "Malware payload (SnakeKeylogger)", "value": "26fd266d93aeeafa7f60848f889ab6c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857395, "uuid": "dc062431-e84c-497e-b3b3-0207907cbd94", "comment": "Malware payload (SnakeKeylogger)", "value": "0e9b91a81b473090b165df47b16b421ae407d211a2dcc97c13b1d833f715cdb7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857395, "uuid": "57409aca-0d8b-48af-8fc8-85ff7291d02d", "comment": "Malware payload (SnakeKeylogger)", "value": "c51f632e6f464b0ff2cf746a83dc768e4ff9e839", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857395, "uuid": "74131419-342d-4dfc-8ed2-f919e2be8ce5", "comment": "Malware payload (SnakeKeylogger)", "value": "dd3b99e4f602eb5bd960dad1098c5446164aab9b0d83dba474d1972cea3028fba5b578d96b7e4241abb59ce080a02731", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857395, "uuid": "102aab3e-6ed0-4822-ba7d-0aafbeef1928", "value": "T1CE6533B8A7180CB6ED66CF724C3923E94FB057D48A2F858AEDE352C51835B5D48F9231", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857395, "uuid": "c97c04f1-cbce-4846-9d08-ef95d91e010b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857395, "uuid": "f60d88ea-2513-4678-a4ad-b05c59fca9e2", "value": "24576:sYvIGDMJBwwyr913oQkQYbdYg4i5HzNiDiiOX0iAfGIbsX9DIEXRD/oclnVrpzPQ:bIGQvwwe1odQYlDg+ndIgaEXRDlV1PLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647857395, "uuid": "9b4f0ba8-18cb-4dda-a455-cad71d058bb4", "value": 1532928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647857395, "uuid": "77a0966e-fb64-4f2e-a8ac-df77598a574a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857395, "uuid": "9c252d4e-f3a6-4b53-b877-54917ac92261", "value": "26fd266d93aeeafa7f60848f889ab6c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e806ac0-a932-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647879487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647879487, "uuid": "e9f88daf-5afd-4a14-9b8f-34d6d3d88ae4", "comment": "Malware payload (RedLineStealer)", "value": "24bb9dde2e81228ac522a9737f37ab71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647879487, "uuid": "ef3dc61b-27de-4efe-8abf-1faa23236286", "comment": "Malware payload (RedLineStealer)", "value": "0edb9cf6ee168a3e62e29140044461b376f0a49bca70413eea80f5488633db05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647879487, "uuid": "e1e3d510-c516-4a8c-a80a-39a9470bc60e", "comment": "Malware payload (RedLineStealer)", "value": "5b667d59f3a17634de40ea1c75937f1daeb6eb89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647879487, "uuid": "405cc376-a933-4755-a6f1-5c318912c9cc", "comment": "Malware payload (RedLineStealer)", "value": "629af6d9a9f47ef8b49218bc61b9f0540184c4fb6b2acc7d0158fb51d5537e230dfd54729402458395daff1065bf427e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647879487, "uuid": "5c23d07f-fb32-4c90-b874-bcb4845d1a42", "value": "T1E3149E6877DC5624E5FF8EB479B1619053F0E0E26C02D79F1EC5B09A1D37B80EA12AB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647879487, "uuid": "d9732cf6-8f2b-43e6-b964-53e07884f75c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647879487, "uuid": "8bc6cfdc-c690-47a3-b3ad-2c49f17d9d43", "value": "3072:RCr7QqOHQMxovfgHTYCiHlNshz6DAmRzG+fx455h8Ks8Cp5GiJa6:s7uUshuAmRzP0hBPMm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647879487, "uuid": "ab5e1b43-eb6d-409c-aaac-b9397df54462", "value": 191488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647879487, "uuid": "8ed9b236-93b9-4a98-98a4-6891f51451ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647879487, "uuid": "6738d89a-d0dd-4865-afab-d38eb6967f9a", "value": "24bb9dde2e81228ac522a9737f37ab71.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b76be2-a938-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647882083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882083, "uuid": "583b51d1-a89b-43d3-960b-8399e14255a9", "comment": "Malware payload (Mirai)", "value": "b259ba1a2e6f7587c5e72a27edc6fa96", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882083, "uuid": "c3031727-4d51-4407-a445-7cbd9c1102fe", "comment": "Malware payload (Mirai)", "value": "0f6dc39bed835959e66f3a247ec8230816550e2d07fd4d24a41bdaf6be660c6a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882083, "uuid": "19ef2a75-26f7-4e9f-93ee-c5ea323c11eb", "comment": "Malware payload (Mirai)", "value": "b2059e89378631a1851e1cf3ebb75a6577a29c99", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882083, "uuid": "bfa2ed58-8257-4402-9b8a-f5282db92247", "comment": "Malware payload (Mirai)", "value": "3a5b80562b5d9140645df17bc91f5a702ec3586dbd731047bc6b67de2f5fdf60c1d5f6c83e1519851d8659a9ad948a47", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882083, "uuid": "c7c8921b-32d6-4a62-82f1-f01a4cf800c3", "value": "T1C0B2E1610FEEE570E6940F36E8280340E25505E8E2DDB1B06A4D0AFF7ED60DA667C367", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882083, "uuid": "8b5414cd-a7fd-46d4-ac64-668189d8e7aa", "value": "384:xNzW7P4iKlHE10a8P1KVRX7ONaTyflTuNhGwJYNigSb7QtmdGU5El:xNzW7QieHE1QsQaQTuNF+PSwt3Uy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647882083, "uuid": "1be0ab10-8268-4ffa-8571-0982284f265d", "value": 24868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647882083, "uuid": "417933e7-0a06-43e9-ac16-82a9ac054889", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882083, "uuid": "99ed0637-68e1-42da-875a-75c986efaf0a", "value": "b259ba1a2e6f7587c5e72a27edc6fa96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3116e7de-a8f1-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647851440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851440, "uuid": "e2b701bd-4f80-4e77-acaa-a9cd3c3690da", "comment": "Malware payload (Loki)", "value": "0c31cadf04674fba0344cd8d35b9c554", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851440, "uuid": "b380e3e1-7f34-4205-b730-b76ef0c137b9", "comment": "Malware payload (Loki)", "value": "0fc16836e431fb1cb80de944351b3e0b29bdd6e09b87e29bd345dec8dff968c3", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851440, "uuid": "c6c57120-5a3a-4867-b4ee-7fabfee6422f", "comment": "Malware payload (Loki)", "value": "402a559629c0e0bbdf12289670f977ac12be76ce", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851440, "uuid": "d63dd5b1-2287-487f-b5d7-1147def02bba", "comment": "Malware payload (Loki)", "value": "e9bc3077d2469eedab9cb8063c56df3c4e141974ba01c9fcaefe7e0036cadc0331b2063962f28ce505dabf0c5b82b28c", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851440, "uuid": "bbe81c6c-9584-4eeb-93d1-c7c0176a05d8", "value": "T19615239D73E49B32E75BE371D895FA88077300AB7A03F7048CD4545A181376C4AAA6BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851440, "uuid": "1f08bb65-1e13-4757-b78e-4942b223a47c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851440, "uuid": "9604425a-3967-4318-9fc5-a073fbabfceb", "value": "24576:RWmll9r3umEScSTT1hpxQNMcLHYRpnI/RIITdIG:ImZ6mdTTrpxsMcLDISIG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851440, "uuid": "97c96656-43ba-42b5-9e19-37b653ab6bc6", "value": 949760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851440, "uuid": "e71b48e3-7586-4112-bc71-3d4b0231d2d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851440, "uuid": "db552be4-5a23-427e-8a2c-3a07a85f0eef", "value": "DHL INVOICE DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e914300-a8e2-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647845154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845154, "uuid": "697bc0ba-cd38-46e1-9639-0f5dc33ca1dc", "comment": "Malware payload (RedLineStealer)", "value": "07cd982164ca2551b2a36c9c6df9a155", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845154, "uuid": "016d2927-71cf-4a49-ab14-b936cd8d76d9", "comment": "Malware payload (RedLineStealer)", "value": "0fd6f953e22ec0ac9d7120b4bf8133f54b6f03b48e275082506599c813790211", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845154, "uuid": "2b989b7f-8aa3-434a-8912-1407cc3ada6a", "comment": "Malware payload (RedLineStealer)", "value": "fdda5380aed449a5073e10d9b5a6959ace769b82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845154, "uuid": "dbc8e8eb-6fd8-4441-b47e-36953b2e72aa", "comment": "Malware payload (RedLineStealer)", "value": "c2892c02b1fc6cc16b50bc3d682accd001da259a637b652aa0295a2d85c5dac0e57bd37c019050c701584b6f2ca976dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845154, "uuid": "ecd30a50-c2fc-45d8-97fd-d9f086fff7a1", "value": "T15B3633AEB6846DE0FE5F24701A1EF3259974DC6D479117A3B0E3C26D86AD213F8601BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845154, "uuid": "582bf797-1b20-4b6f-b5f6-dd81a97833d2", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845154, "uuid": "581eb981-8b75-4b93-8ae9-4f0fc1367253", "value": "98304:6jlJbrVe9LNCf0+fEBM+zhYJCYFFXZ6OmZBndQCimkdBzjWp6qiFIAbicT6WZd4T:gJPVe9LYVEBpzh0Fp6HZBdQCimAtq6pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647845154, "uuid": "02b68439-8700-4736-9b33-e8c5cb932408", "value": 4917552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647845154, "uuid": "c9095dfa-012d-42f9-99d0-9ecac74acad1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845154, "uuid": "fc6e7785-f24d-487b-a019-09a98a4f37a3", "value": "62731016.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42137a1a-a94d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647890982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647890982, "uuid": "c62af8b0-fa06-488b-82ce-20cee59ad766", "comment": "Malware payload", "value": "349d53a40cbe3fd2893429ecd73077e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647890982, "uuid": "505f8304-b7d5-46c1-8ab1-cafa2b0bb7be", "comment": "Malware payload", "value": "0fec89e861f7e2056d19495d481dfe72ce5dca3b8a0ab868d3b1f4ff2a60f5df", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647890982, "uuid": "9c01afed-d1fa-40ec-b4d2-7be9a43308c9", "comment": "Malware payload", "value": "49dbbe094c4f4e2c7c17af16ef2550b63e4dcf7d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647890982, "uuid": "d97a2c5c-995b-4fcd-9202-ba85b53d9716", "comment": "Malware payload", "value": "0510079cd560196d0b2fd2b0743a60a841f6cab3ab8d29f321a7da10ead4915d58d0d5d6947fdd4470a4988059acb242", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647890982, "uuid": "8c46fe2d-5732-4e18-9550-38e118372273", "value": "T1AB9423850B8BAA8EF18CA4851244385C59463BBC2DE35DD97F417D89EC20A9B681CFF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647890982, "uuid": "3825b6a1-6f73-47da-9b8d-a30edd51ccc5", "value": "12288:7zZW6660YzITBWULJka8amhPFYqNxlU0bJ+UBhm7r:7zo6660YzCWULeanmhtYklU0ldBhm7r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647890982, "uuid": "a1040095-461d-4b9d-ab96-77766bf27896", "value": 445927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647890982, "uuid": "57305e95-1d81-40f1-a1df-1a99d0babbe7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647890982, "uuid": "86a2cdb8-07e7-4dad-aa7d-f3389fe13174", "value": "PARKING LIST, BL AND TELEX.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3422f58-a8e2-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647845243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845243, "uuid": "a68d06f4-386e-4b45-9292-ba1901776d81", "comment": "Malware payload (RedLineStealer)", "value": "1f6549d39556c34a5f90cf0da13fe14b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845243, "uuid": "f70c8eb1-5768-45ba-ad69-291382518d35", "comment": "Malware payload (RedLineStealer)", "value": "1008f72ed68a5207ee3448d5e4fc1ba2f6969e2ff2d64f1b4cc328d680706178", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845243, "uuid": "8f154c23-6d10-4cd8-a660-45fc9f4bfbcd", "comment": "Malware payload (RedLineStealer)", "value": "02f148d2acc72fafb87f3f71290071f45691225a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845243, "uuid": "4f15ad49-34e8-4997-9c91-de40f25df040", "comment": "Malware payload (RedLineStealer)", "value": "8dcc1a6f4b9518b8d9ca432dae0b7c5ee32c2e27a955cc5939612d688ed19e4f2509a8d1c05113adecb1431e1ac67f63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845243, "uuid": "967207d3-0445-46cd-94fc-cd7cd68d3507", "value": "T1673633896A80BF8DDF870B341EDE95A0BD2DC222BDECAC37271913C05E358EA155D6D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845243, "uuid": "54d9fe68-6d9d-415b-b79d-756a511d2026", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845243, "uuid": "03553168-2eea-4316-bc9b-6783f1dff4ce", "value": "98304:+36QWHk9KpBAtQTrfN+Dr/9zm1ng9s499puwGptVukXxBmetwWLTRu5:+3NWEdtQnY39zls+T6hXHLNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647845243, "uuid": "7464e7e0-e4bd-4d2b-9413-9c77cf01e6a8", "value": 4915504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647845243, "uuid": "d0405be6-895d-4105-8017-42466a9ef0ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845243, "uuid": "53d6f803-83d3-4764-aa62-96b165a3baf5", "value": "99233144.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0708f34-a92b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647876645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876645, "uuid": "eb87ef0c-99fc-4b67-b052-1a9e622d1f1b", "comment": "Malware payload", "value": "9d707c90a3d7ad3e96c7a05a2fb47170", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malware signed with Corel Corporation CERT", "colour": "#514C2E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876645, "uuid": "f5be0fdb-29ad-46ab-a8ba-fdc88b6c9dd9", "comment": "Malware payload", "value": "1020c9e7b076958ab67bb0af45f79c22326394fd1c04015a483ae24f7614a05a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malware signed with Corel Corporation CERT", "colour": "#514C2E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876645, "uuid": "4ba05354-6b8d-43aa-b716-fba22fb7e8ae", "comment": "Malware payload", "value": "cb1b4322069bc48e8c4ef83e5a5dac4a3b04ce0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malware signed with Corel Corporation CERT", "colour": "#514C2E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876645, "uuid": "4f139f3d-9c8f-4426-9beb-8966f56c4a1a", "comment": "Malware payload", "value": "2392585430cfae67e45f5657452d806aeb73a25fa8c55eea6b4b1447f539005cd46e99237c296daf993fa6695a61486b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malware signed with Corel Corporation CERT", "colour": "#514C2E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876645, "uuid": "961994a8-3a30-4054-9586-4cc5f3148726", "value": "T15D2733263614A8DBE69570F2A809D855EBA1FF042B8DC5CE73C1734DCBB45A2893E731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876645, "uuid": "1a7bed89-d42f-4487-b6c0-78b6f23d345b", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876645, "uuid": "a0b34ff0-4b1b-4d31-a182-c618350b50c6", "value": "393216:PugkCLVLnrrVhgaQb3vIZe0jajssaLKHmSFl1VQ3cYxTJJL5YnAcSctH7Dl7apaA:PugkCdn/gaQL0MtaeHmS4cYxTfLONSW8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647876645, "uuid": "b247aa02-4669-4cb5-8c81-e7d48ef15364", "value": 21627416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647876645, "uuid": "67816247-7d84-4a19-ae54-877640e5d2fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876645, "uuid": "aa533dff-1bd2-4bac-ad40-75a2a2254c58", "value": "wzdu53.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe85401-a8e4-11ec-9275-42010a9c0029", "comment": "Malware payload (PhoenixStealer)", "timestamp": 1647845801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845801, "uuid": "c4a8b128-c999-4546-a20e-8bf5cb2c2710", "comment": "Malware payload (PhoenixStealer)", "value": "c338c0ae185d5592efba7ff5669e55e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhoenixStealer", "colour": "#803CA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845801, "uuid": "4c33983d-a7c6-42a9-9d2f-00dea09d9eb4", "comment": "Malware payload (PhoenixStealer)", "value": "10280ae883a86aae151fbceaf56912f5b71f6e1432ee59d21cda735885425a2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhoenixStealer", "colour": "#803CA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845801, "uuid": "3e82b5a6-3e29-4568-841b-152c3009ee48", "comment": "Malware payload (PhoenixStealer)", "value": "a2498266ce7dde285cf5d8f5a7dbabc83ac098fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhoenixStealer", "colour": "#803CA9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845801, "uuid": "fa90047c-8415-4719-a7ba-2f9bc50a2007", "comment": "Malware payload (PhoenixStealer)", "value": "ad941cc312bcba88e8640bfa5ce659b09946735a1ef4b5eb9a7def54d190d48e8be19cb358866f5bf5eab64ae0a77c81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhoenixStealer", "colour": "#803CA9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845801, "uuid": "258a0419-a1f6-424c-84c9-93f75cce9b08", "value": "T164C4BE17E6428076E4632430265D9B7649BD76300A2655BBF3C42E2D9EF02F2AB35F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845801, "uuid": "f3e2022f-2625-4478-8c62-87c888f80088", "value": "06c6e92acd3ff57b00b3132976b3f6d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845801, "uuid": "6da83107-f417-4b0d-85fa-32505eddc9b1", "value": "12288:F7vT8cGUCZmxIwNjVGCXZqmmJUL+JHkdIUnjoqhwAw4d:Fz4BUCZmxIw1VGCXZ5mJdkdZnBhb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647845801, "uuid": "7024bb1a-d5a7-41ed-af0d-27af77ce5c6b", "value": 558592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647845801, "uuid": "f16fa32d-18e0-49bc-ab2b-07f36679ac5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845801, "uuid": "dcde1003-5160-4cd8-b7af-2f0c27ad41ed", "value": "37450663.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8761132b-a953-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1647893676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647893676, "uuid": "d53ed404-166c-47d9-b46c-bb65bad4dd5e", "comment": "Malware payload (Gafgyt)", "value": "c07d9b59767ddf2902d78927f9eb942c", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647893676, "uuid": "6834f9d7-89dd-4084-b21e-d25c6ca2b8c6", "comment": "Malware payload (Gafgyt)", "value": "108f0bc99244fbdee9134f29637ff7215a7e0ba5e2d01280a04432c4492b8600", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647893676, "uuid": "5c23ba8c-a349-4b50-b32b-7027690679c1", "comment": "Malware payload (Gafgyt)", "value": "5857d0a91cfcf6540c3fee72074c6c5707ec4726", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647893676, "uuid": "e446ca46-877e-48e6-b99c-02a522374d83", "comment": "Malware payload (Gafgyt)", "value": "b22e1a31c213ac0cb3f13053b4853a360ce4aa043821129fce54143a620ac40a9f143e7ee7edaa67eb7ab9312416a04e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647893676, "uuid": "12902638-1e6c-410e-ae7a-027965e87751", "value": "T175C329377691CEBAC08351B026DBA6619D23FCBF0B22211B73947EB02B398D95D59F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647893676, "uuid": "8e615b80-09c6-4028-b52d-69aaf7892aaf", "value": "3072:Xir9sixRYjv3Io6hbGLi8rHIPZhDipdKIm7FVVPNuXklnNU:WRYShu9wkpMIm7FVVPNuXklnNU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647893676, "uuid": "095e5c6a-4516-4022-9e64-d5509fd461ba", "value": 120840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647893676, "uuid": "9193ffdb-58a9-44ba-be74-714044789e81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647893676, "uuid": "45e5ad9d-43db-45d1-b1ac-81427df48bb3", "value": "c07d9b59767ddf2902d78927f9eb942c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "922958be-a938-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647882097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882097, "uuid": "cfa91be7-a3c7-4970-bd4e-df61d88ba266", "comment": "Malware payload", "value": "d283d5e6b5b76dcd1b0d48de0359941b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882097, "uuid": "14b8a672-446b-41d7-8951-9d610add5eb5", "comment": "Malware payload", "value": "109181ba20e003569ec4e8df83ab70891311c3f6c7408c9d2063671d1fe0a681", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882097, "uuid": "bedfc605-8859-4cfa-8b7a-ddf5cc3e525f", "comment": "Malware payload", "value": "ed3a262c2605bfdcf27f460bc535a36277984c73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882097, "uuid": "08ff62ea-217a-4d7d-bfc9-f2e5f1d3f672", "comment": "Malware payload", "value": "c0ebdac3240466318240774d818dcbde2ff0dabf7c6d4d258d1717a87632d26840f32137723cda7d43d9ebcd408aec1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882097, "uuid": "c4886b69-289b-4f31-be7b-e1ed6064bbb9", "value": "T1F7659DF19725632DE18D2E3532B43C7E2240539A311177A6EC1977FA803AD81FAD25EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882097, "uuid": "13eb1850-bffa-4460-97bf-d0fdfe069a5f", "value": "a8287f07d3cf5a1d2b7d1dc33ccae592", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882097, "uuid": "59665a4a-467c-4fd4-a143-eb8741752de1", "value": "24576:NxJCVOHZVXx4nmULV5GRLTNEyTFSfUNke67n29b2cemv:XW2WjzcNE9fUNkekA+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647882097, "uuid": "eefa3586-49e3-41c1-a2c9-7cad57ab276a", "value": 1456128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647882097, "uuid": "372a0e7d-8206-4294-8273-89c4ba5eb94e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882097, "uuid": "15437007-b170-4110-9e22-5418407c2b4c", "value": "d283d5e6b5b76dcd1b0d48de0359941b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ad1f67-a8b3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647825034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647825034, "uuid": "5e7728ea-172a-4ba7-8102-459fafbee6d1", "comment": "Malware payload (Heodo)", "value": "31064f6489e4cdbca078bc5f42b3e85d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647825034, "uuid": "92eca871-f7a0-4742-a611-bb2492ca68e5", "comment": "Malware payload (Heodo)", "value": "1095fc8664db957fc954c7e409f150aab4101a4463954d047be2fca91e7269f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647825034, "uuid": "49baacd2-e7dd-42cc-8a1c-e9307b61cd9b", "comment": "Malware payload (Heodo)", "value": "7a46c6c9e8e77d8a03b94e0ee84f728fb101c96e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647825034, "uuid": "527cae35-6950-4064-b940-a8bdb85be85e", "comment": "Malware payload (Heodo)", "value": "cce4d1392ff548241f3a00adc9122f9bc904c8f90b23bfad1ae28227d7207157ccd8828ee591c71d033e55f5545e1021", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647825034, "uuid": "15a12f19-2458-4396-80d8-6ef4135af85e", "value": "T119B43A317492B279C2EBD73408A35275B21AEDF157E274E36EE707CC4B366906E72602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647825034, "uuid": "e36c4e58-e497-4949-9d88-fcc75721ed9a", "value": "55cf9ae1e74cef637eafd17181390202", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647825034, "uuid": "a62e6319-20ee-4df4-b697-e56e992987e9", "value": "12288:7FFCpYDLbBHqKK85H3jR2VlMD4zeSvturG9+:7VDLbQKGVlMDOtv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647825034, "uuid": "27d41985-d1e8-4e37-a8d9-d1ca9d23cd82", "value": 516096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647825034, "uuid": "20c6ea5a-dbc5-4f18-908b-59926f3ecaae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647825034, "uuid": "b5c98487-c205-474f-81a0-ba1f7d4d0f51", "value": "31064f6489e4cdbca078bc5f42b3e85d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c911f57f-a945-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1647887773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647887773, "uuid": "c5aa6a0d-88f3-4bd0-aed7-60af500957f6", "comment": "Malware payload (ArkeiStealer)", "value": "6418a2893ab5e498347d4a04079ce834", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647887773, "uuid": "ca79305d-793c-4a52-9a5f-e305ac4953c7", "comment": "Malware payload (ArkeiStealer)", "value": "11212d76a760b3a88eafaa75678220e4c478923b3613a4a65f8111b3e8187017", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647887773, "uuid": "59690f7e-e659-4bc4-83d5-274bf12ccee7", "comment": "Malware payload (ArkeiStealer)", "value": "951e3c030d3acb5bb3e2d294bc34217eb8064cf4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647887773, "uuid": "6a6e2520-f91f-447f-a0f6-8cbd660ebfa6", "comment": "Malware payload (ArkeiStealer)", "value": "36a7314418257505edcba138b2b201f5d02546b5d2746b25affdbd9ef66742b58bce216bff64978d7b98e42aee9efa38", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647887773, "uuid": "8ac4e944-d109-47bc-b8f7-ec0265b41f80", "value": "T1FDE4BF26F2D2D076D0732131DA6E27228EBABA3214319487F7D90B565EA11D1BF3E713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647887773, "uuid": "bf909f83-cd7f-46fb-b048-a279867d4e46", "value": "764f2c8a1402bd58514309fa518ccb90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647887773, "uuid": "9f847f7e-3564-4078-b994-311519dbcfd6", "value": "12288:04weHbKrKUHoi34RykUM5MGxZ4LpfzOpxhQp1iBKclqZZT6V9Bhyg8ORKODNgdsf:R8lt11b/LPMHcUTtOE4O8gl3D18d10rR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647887773, "uuid": "577f3957-c3b9-4ea0-aca8-aeaa3f13bbb2", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647887773, "uuid": "bca9b5b3-e9e4-44b9-9b01-9d223371c8a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647887773, "uuid": "5a64e8d3-6d90-4da9-b1d9-e8d8b0f527ba", "value": "6418a2893ab5e498347d4a04079ce834", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "202aedc8-a943-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647886630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886630, "uuid": "7da56ccc-276f-4263-8cff-34d49684c2eb", "comment": "Malware payload", "value": "df14255c500bbf2fd0b9740021fde603", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886630, "uuid": "34ee5a66-4e7d-4627-bfaa-b10126c960d9", "comment": "Malware payload", "value": "119dfa4f0d41f93459eb62d39659b97e6d6e8ae4c3dba19577477a271b0fe91b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886630, "uuid": "9c07c649-ddcb-4046-ac7a-17ef057370ce", "comment": "Malware payload", "value": "88e861d5f6b5f5d147cebd69994b74b895772576", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886630, "uuid": "9a9451d5-d7cf-45f6-af87-c61b8860792e", "comment": "Malware payload", "value": "1753c4ecbb0ddaa8b9a2385d1d8b519c995693f9813b751938c319c7944f35b6a6560f278a3b08f2584a1a9a7b132e90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886630, "uuid": "af9df25d-cd4b-4c0d-95d2-96cde76ffbd5", "value": "T1AE22E511FBF849B9E97F8F356C72526417B1FB524A26D96E6888500B0E337404AA3F32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886630, "uuid": "41191cf4-9520-43ab-9054-0f65ace7da4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886630, "uuid": "26746f07-3673-48df-8930-aebcb146752e", "value": "192:vgWZMfn4E1lTDO82B5J94Qu6Q2beJcnI:vnVUTaFB5J94yHccn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647886630, "uuid": "70022b62-326a-4eab-bbf8-ece930934ad7", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647886630, "uuid": "194981fa-c25c-4f88-ae1d-a888bf517718", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886630, "uuid": "5ea87eb1-ac21-4f1b-b2a1-8d8dbd556e45", "value": "SecuriteInfo.com.Trojan.GenericKD.39240318.16442.9435", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6088caa-a947-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647888654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888654, "uuid": "3e245493-f4d9-4bbe-bfc4-283312454e40", "comment": "Malware payload (Heodo)", "value": "5deaa17d1004d9c131b7fdea7433d306", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888654, "uuid": "10a49bdb-a757-4e4f-88af-4924df29d806", "comment": "Malware payload (Heodo)", "value": "122ad0f9236bf8789dfaf46e4023f4bc684180a4aca91d72fe8735425fcecf68", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888654, "uuid": "74a21e9d-91d4-490a-a512-22ebaee42943", "comment": "Malware payload (Heodo)", "value": "b276ef7e77607d904061a0f6c8ec84870cccbcef", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888654, "uuid": "a990db0f-12b8-4322-b5c5-378bb8e233ed", "comment": "Malware payload (Heodo)", "value": "7c50da32797ff2482ed7fc5889b1364b0bad333f4c5d8e9d38f700ff7fbe25d40e461e337bc97db746503bef29385a99", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888654, "uuid": "22dbd893-5215-4913-a372-7e5614746244", "value": "T11DB43A11BC916832C36FAC7456073262588EE7F0DBD1F26FA3E0495C9A7C5E36624BC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888654, "uuid": "8f3581ee-0298-41ba-8dcb-ca8458e4df64", "value": "14e6ae8d1400b6271725b3f01025b85e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888654, "uuid": "91b88403-0172-4b06-b177-6cc8a3846289", "value": "6144:VikzyaB9eoCyx/mEhHB5RYSJ/x0+qiCjzQNPj79GkqbscgCG5qH6scI:VNnCGmyHB5SSJpX0zQN39GkUGQSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647888654, "uuid": "7f9e348f-5a9b-4c3c-aea4-40bc1adf0810", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647888654, "uuid": "ea90e723-21d0-41e7-ba35-9e4f11e9f280", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888654, "uuid": "6ef8a5f1-cef0-4fc6-9408-485298aa7ec5", "value": "emotet_exe_e5_122ad0f9236bf8789dfaf46e4023f4bc684180a4aca91d72fe8735425fcecf68_2022-03-21__185045.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e42791a-a8f4-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647852724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852724, "uuid": "137d59c6-110c-430b-9f67-7a5581d067e2", "comment": "Malware payload (Formbook)", "value": "4597260ba28f5b8a64df2f4369269379", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852724, "uuid": "6aaea02e-9204-47d7-a785-aaab7387affc", "comment": "Malware payload (Formbook)", "value": "1363922a984440ab7ffb7f1f4872704bc6a96008412d399728b20cc8cb1e4abb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852724, "uuid": "91bb5cc5-d5af-43be-9bd1-841187cf7cb2", "comment": "Malware payload (Formbook)", "value": "3ff4640cbf8bb28e6d8d9a8533007404d9845924", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852724, "uuid": "50387930-d5a6-45fc-acf3-b22bc31bd9c3", "comment": "Malware payload (Formbook)", "value": "9fe7eef28e2affbe67d1d5a49d70a72cda858ab06536001bf0d7adde2a06a37b8b77a38d1f2a18cf552fbf153694f4db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852724, "uuid": "d76bdde9-90bf-40c9-aace-481d88b5dd6c", "value": "T10934121ABDC24DB3D97F173102FFE2FA97FA95D81A2061072F182F7636A06960346253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852724, "uuid": "ffaecdf8-7305-424a-8da9-343136034df3", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852724, "uuid": "0e844bd8-6659-41e0-8f22-3be377ecdbad", "value": "6144:rGi64jFVgVjbebhDN2voGGXNQF3mtEAxc:mygBK2wXWmiAxc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647852724, "uuid": "7d26c07b-d264-4f4f-b5fc-90818e5facf2", "value": 247501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647852724, "uuid": "44b26c6c-2595-4fe6-8b14-58695217aaca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852724, "uuid": "d1e48596-5654-4175-86a6-24d9837d89c0", "value": "4597260ba28f5b8a64df2f4369269379.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "252f6710-a8f7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647853997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647853997, "uuid": "847ca449-f503-45aa-be30-b25c53b454cf", "comment": "Malware payload (Heodo)", "value": "102bfd3f5a20adf0eacb119241d97109", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647853997, "uuid": "ca57d869-0e5d-4ef3-aca1-1e1d149f541b", "comment": "Malware payload (Heodo)", "value": "139f317ce56175c7506a89279f55e827847efeb7281a0d2a646e0cb70c48fc68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647853997, "uuid": "e5393f0d-6358-4a6b-a056-c0ec9df023d6", "comment": "Malware payload (Heodo)", "value": "24700672a941993052c1d2121ac4464baec2bd71", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647853997, "uuid": "d32cf9e2-2a9c-426e-9adb-03638327466b", "comment": "Malware payload (Heodo)", "value": "d21c393418ebc4119575ca6546c58e9f9902c8063acdedbaa20d099ab529faccf9d243faceaf58b3bbfb4d3a16e9fdb1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647853997, "uuid": "2546126d-cc12-4046-ad80-cdda2ee63dfd", "value": "T17D056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647853997, "uuid": "753d01f2-f00b-42a2-a503-372f0bf06d6b", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647853997, "uuid": "fe953ce8-568e-453e-a27a-46a3937050f2", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rC5CGNHrH2tZ+d+:gMV/rC5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647853997, "uuid": "1d9016d3-910c-4ada-ad24-9aa5dc21e1ab", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647853997, "uuid": "aeaa4334-bb6a-41ce-9a69-cf4d2c97ea51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647853997, "uuid": "96c1d3a4-8297-4310-a666-8c40d430c894", "value": "102bfd3f5a20adf0eacb119241d97109", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8dfef47-a920-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647871935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647871935, "uuid": "65ec1a29-4678-4b32-8569-c459ecf7d947", "comment": "Malware payload (Heodo)", "value": "874b811ba8aca19ecb2c17b1fdad88b0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647871935, "uuid": "6eb744f1-1a46-4749-99ed-956275772140", "comment": "Malware payload (Heodo)", "value": "13cfd306936b3cb7470eb5c5ac209437d267c3ff2875235ebc31d4d146239e4b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647871935, "uuid": "5d3adb52-84cb-4f5d-acaa-ad88254d4f37", "comment": "Malware payload (Heodo)", "value": "b1af2af2bad3bb2ee6e4fbf11e50965a60f0e400", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647871935, "uuid": "a53a7079-4cbc-4f28-b900-ea88ad3e423d", "comment": "Malware payload (Heodo)", "value": "bcf100fbeb6d3c79813205b3cbbe4994e5901c998f1f8775917acdde7375d148ebd2e24d5a61f6fad49fa52a090fd394", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647871935, "uuid": "035d9ec7-166b-44e1-b579-53f86708cc4b", "value": "T109059F7A2B43F27AC7E50DFC186002981A75BAB2C7F7A4272F88327E5E717C15E61911", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647871935, "uuid": "414caafb-dc43-44eb-bc72-5f4fb2301786", "value": "cb131077fd443ccf418450d8ed763df9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647871935, "uuid": "5fbbd50b-7c65-4176-946e-cd462bfc9742", "value": "12288:KVHML2QJe6XxhqCW4QHR5f/jsVL6TwEHJlTeRNV52:GML2QJNxhqgQHXj1p0RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647871935, "uuid": "ba2ba6c0-bc01-4215-839b-531f95a92080", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647871935, "uuid": "277e5d87-7265-4a04-90cb-3e2ed8ee0796", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647871935, "uuid": "06ed8a74-4cae-4881-827c-3d7e2f64c694", "value": "emotet_exe_e4_13cfd306936b3cb7470eb5c5ac209437d267c3ff2875235ebc31d4d146239e4b_2022-03-21__141207.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "623c4e0b-a8f7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647854100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854100, "uuid": "68812b44-10c9-47fc-8925-9b1dacf8a9c8", "comment": "Malware payload (Heodo)", "value": "9d0868e7b9778debffcc1b1047275580", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854100, "uuid": "44e12043-f9e9-4399-b2ff-a7a856acacc2", "comment": "Malware payload (Heodo)", "value": "14a0065f8f80aea5961127620ee7cbbd69c2cd20105f0e18663852a61babb3ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854100, "uuid": "a6990aa2-0480-4244-a880-8454f3695723", "comment": "Malware payload (Heodo)", "value": "234b4b99cd8491509ae9b9dea88933895a433a5d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854100, "uuid": "9418b117-6675-4650-8d8c-c55130a83d2b", "comment": "Malware payload (Heodo)", "value": "db2b42d2af4a3aa2e78e70cd12ce82fd93511ec1aaef3b64c1d6963d00a7c40984dfc6d491e013a179473c391b162688", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854100, "uuid": "037dfca4-73dd-40f4-9c58-d19328e6d7b0", "value": "T126056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854100, "uuid": "321537a7-aa7e-4070-80a0-f8c0233d0ee8", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854100, "uuid": "a9432e87-54c5-448d-a5a4-a41d0b86dd18", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rW5CGNHrH2tZ+d+:gMV/rW5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647854100, "uuid": "12e55a8d-3d93-4e2d-bf50-1c68d056e94a", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647854100, "uuid": "a65985f9-e736-4744-a874-4349c0c0b98a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854100, "uuid": "cf847ad8-6bff-4ffa-9478-2ef6b0e0649c", "value": "9d0868e7b9778debffcc1b1047275580", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab8e7945-a91d-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1647870543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647870543, "uuid": "a4f5b0d5-5d3b-4aed-bdf5-b6a8ee861b91", "comment": "Malware payload (RaccoonStealer)", "value": "63b9f9e17254c53c4aacbf9b636c3465", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647870543, "uuid": "464faeb6-9e54-4268-bae0-d62d9ab91962", "comment": "Malware payload (RaccoonStealer)", "value": "14eb78c6d9f873f43e453ca56c4d9d1ffbb03ee79fddb87cadeef59626299b6a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647870543, "uuid": "9d47bbbb-9436-4b2c-95ec-51a32c1fa62c", "comment": "Malware payload (RaccoonStealer)", "value": "5bef0077d1090e0216a915de11f4786a49c7f232", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647870543, "uuid": "ffe6c064-8c0d-4b83-a976-17581620a025", "comment": "Malware payload (RaccoonStealer)", "value": "34d52708c19c6ad7e912339a63c36db68175e46e892dafd069d8dea6f144b6afa86f07b3fabf53e9a3728611787d0acc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647870543, "uuid": "c0c8f1a6-0127-4ab4-b5b6-cf0241f480d0", "value": "T104C4F150B7A0D03EE4B701F8797983A8B42D3DB26B2055CF62D52ADB56346D0ECB8357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647870543, "uuid": "be648119-463c-4d3e-aa27-0ecab0ebd867", "value": "d626a2a864a52e91dc5f85b5e98029ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647870543, "uuid": "ee7b44a9-60cc-4c0e-9473-201487f7bd5f", "value": "12288:u1kiKixQQwtnK+uDdkZ1bZGgbbgnKgz7eMcey4:8kexLIIDC1NJbgnHGla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647870543, "uuid": "dc7fc1b3-9977-4576-ae3f-38f4a7fdc16e", "value": 564224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647870543, "uuid": "f398656d-cfc5-4b4f-9a77-c604e000b143", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647870543, "uuid": "7bfb17d2-d8db-4b16-a3a1-ebbff4f687dc", "value": "63b9f9e17254c53c4aacbf9b636c3465", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5617a8df-a8fe-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1647857086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857086, "uuid": "53f5cee6-d289-416d-bc14-a23899d8533a", "comment": "Malware payload (RemcosRAT)", "value": "c57fab3e57d2503a86b8eb2af81267bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857086, "uuid": "fc8a6956-721b-43c3-aed1-356c439c1191", "comment": "Malware payload (RemcosRAT)", "value": "14f5e62e12513008807eeb7ff5b672437020b75828238620492dbd2721c1e3b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857086, "uuid": "de43caef-2b28-4362-9a42-a7363ee6ae91", "comment": "Malware payload (RemcosRAT)", "value": "188b9833a5140061f9fb482e2bc041027b425d5b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857086, "uuid": "c475ae1f-f15d-4d08-b68e-23c45a61212d", "comment": "Malware payload (RemcosRAT)", "value": "61891433257af3813e80b16a790a1398d727b78185a25b9d0a9d980c06274b7b078e50e50e70541f7489589361b27274", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857086, "uuid": "71d0e5e6-f241-4b1e-9b86-6b23cbbebad9", "value": "T14B55122FE544D0ECDED559B78AB4D4F8C7A3C27FD90BD81096EC77A228F66448B00562", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857086, "uuid": "adba8d8a-4d6d-43e3-9d78-44b6b3322854", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857086, "uuid": "8532a9be-540b-4a7f-8b28-d42de18f6079", "value": "24576:2gAl9ejURkkFbfYldfGugvuljdVd+kBATxA3kQ3oWaa+5KZbSw:2geeQRkybgldf+uRlATxA3kCoR/52b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647857086, "uuid": "31f2dd20-be95-4754-b6f9-9532e0f332a1", "value": 1360384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647857086, "uuid": "6484f2c8-d798-4dd7-a200-47ce55346a15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857086, "uuid": "b2857029-9936-4268-9380-83133d79c301", "value": "c57fab3e57d2503a86b8eb2af81267bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad0075c7-a8f0-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647851218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851218, "uuid": "0015efa3-416b-4fdb-9841-c8fb1e74e49c", "comment": "Malware payload (AgentTesla)", "value": "62aa634b9fa754687650e94ef43cf879", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851218, "uuid": "abfc5841-3719-4fd8-ad46-f35d992eab84", "comment": "Malware payload (AgentTesla)", "value": "15e28bfc11f55c2f0ff55c9525585c83060d400bc5763af3135040d2fbf5528b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851218, "uuid": "c6490863-a972-4ea2-955e-459a728fd0cd", "comment": "Malware payload (AgentTesla)", "value": "25357194d015f495d6811238b60a69b56a5317c6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851218, "uuid": "ccfe4b70-aa04-421a-b88b-9236b0335356", "comment": "Malware payload (AgentTesla)", "value": "095f0907eee8efbff18922f03a11499b43ae0a8d6fb4523cede23ecae90e6cb56c717946825aa2abf3036451145cf15d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851218, "uuid": "da6455ea-b377-4556-9e8b-6a83250e8b9a", "value": "T1A91412817A1EC487F5D0287D333BFE119814CF53494D081AAA4F79053F7B3AA4B97AA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851218, "uuid": "e004961b-ba6a-489d-ac55-da84f1a77b2a", "value": "3072:Q4wU6FIGbof1NsfWfijwR3CcTyneG04B2nA2JWpSz9jcXsFKYOZTSS4iwePDNWM:kU6Wa2N8JjomeG0I2EQz9jGsKNSS95x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851218, "uuid": "381c7fe6-7a3f-4a97-9807-13475e21f5f4", "value": 190712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851218, "uuid": "1d6ec2a1-9028-4685-8a7f-0cfad67d53c3", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851218, "uuid": "be74c761-b6b8-4026-ba7d-1be068df115c", "value": "Shipping Docs & Forms 2022-03.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e31831-a901-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647858609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647858609, "uuid": "c4ad3868-dbd5-4e54-b7ad-3f3525d52a88", "comment": "Malware payload (Heodo)", "value": "5f2d6217c3d0477eacd905f68748a872", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647858609, "uuid": "282a87c9-a1d0-4bc1-8a52-b49780129200", "comment": "Malware payload (Heodo)", "value": "15f1d8394650b09dde6919aab985d327b2edaa4c31d3aa9ffb64348d4b999b3f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647858609, "uuid": "8453aea2-1f52-4feb-bd73-57edbd844e74", "comment": "Malware payload (Heodo)", "value": "1e5965b248a10ff3dcca67e42b3dca8a2483bfd2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647858609, "uuid": "c791c67f-18b6-4773-a1a0-25bb18cb6c9a", "comment": "Malware payload (Heodo)", "value": "b1dbaf6599015d1e7f9d390df9c3d0d267815e89cdc7c7e963e3b016348b8dc047fac70ff2a8605bc9f8611a35c2d832", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647858609, "uuid": "bf325190-8dc7-41a9-a766-978ccc9661f6", "value": "T160D45B11A5538073C7FB25F2CAF163B766DAAB91C72B452E02A8C07F7924E437752E21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647858609, "uuid": "889be0e9-9186-47d5-a5f6-7f73736d699c", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647858609, "uuid": "b5cad586-6a1e-49bc-9efe-7fe1dfad2647", "value": "12288:UWBpwupxl0OeL/grx5GzO+r9AjCb/XKh:Psupxa/g02mbvKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647858609, "uuid": "a9d34857-5089-45d9-8a8c-3f125f0735d5", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647858609, "uuid": "e378a5b3-4bc5-4f80-8ed9-339c77779c8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647858609, "uuid": "0316ea09-c1c3-4957-8d8f-fabbbdb13f72", "value": "emotet_exe_e4_15f1d8394650b09dde6919aab985d327b2edaa4c31d3aa9ffb64348d4b999b3f_2022-03-21__103003.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1edb6321-a96f-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647905526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647905526, "uuid": "7c0d9c57-e69d-43b1-a66e-f2880bdd5647", "comment": "Malware payload (RedLineStealer)", "value": "b01feb3d95ebf4015703cb40886aebeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647905526, "uuid": "34a64e6c-d626-4884-bb4a-47714ee9de7d", "comment": "Malware payload (RedLineStealer)", "value": "16097ef7d2a32abc1f569862ba55f782200186a940e8e2eafc5d55b2d61aaa5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647905526, "uuid": "adc2b4b7-a52d-4aa1-bdaf-887cb46a6b7d", "comment": "Malware payload (RedLineStealer)", "value": "42a4e98cee2355eb0f5da23c0fefc0b632babe79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647905526, "uuid": "fb0fa91f-74c3-4b03-9d38-090053d033fa", "comment": "Malware payload (RedLineStealer)", "value": "e73a4fcfdbe03e82828a7fd6c03f77eb820625605a1d9a5b3d6c6ba4448b49e8c2ce6eb0fa8968817281f80895420599", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647905526, "uuid": "3e618cbc-9125-4f65-9512-d3d324a1a80e", "value": "T1BB84CF10BB90C035F5BB41F849B993AC753E7AA05B25A0CB62C42BEE56357E0EC3135B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647905526, "uuid": "1984b9fe-000f-48ea-abfc-bef2651cacc0", "value": "42499a002b9d8635fd26126765c4da68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647905526, "uuid": "a007cbb4-1bd0-4ca7-a4d6-b5e97107a5f1", "value": "6144:BKAfumTje9kRCEIGlaqF6CekhH4xOCY1d61YYBQ+s0AplbIo:B9xe9kRCEI3Smk5jCYz5Mfkb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647905526, "uuid": "84d35c7e-4848-4531-871a-2781a29039da", "value": 375808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647905526, "uuid": "a55d87ce-baca-420a-a090-e08dd135e69f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647905526, "uuid": "dc7bfc3b-69b5-4c6a-817b-76ea22b94004", "value": "b01feb3d95ebf4015703cb40886aebeb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1051549-a8f0-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647851279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851279, "uuid": "4cd59cae-2ab6-40fd-b9b6-013d3c06cafa", "comment": "Malware payload (Loki)", "value": "767e66127d697184ca22e908eba06bb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851279, "uuid": "115ec245-2eeb-4f47-b279-2ce75f49e718", "comment": "Malware payload (Loki)", "value": "1627267270ec12b3e87373d503b6150ab1e5ba5851fba8842108e66808834fbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851279, "uuid": "cff8e10e-f987-494e-be44-0d9e0746677d", "comment": "Malware payload (Loki)", "value": "ea785fa8da919b1d9dfa968e138e338fbd987fa6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851279, "uuid": "537031f6-ca05-42bd-b5cd-a348999240be", "comment": "Malware payload (Loki)", "value": "a84a55a642475c2b62a171947f119a9b58840b99a74cbed60729a9f1d19140cea982bf3d59f0b70eb4652abb598345a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851279, "uuid": "991dbae7-f37e-40dd-8118-9abbecb64f46", "value": "T161341286DCC47C2FE2C755B247735ABDD3BAC30C12616A930760BE43AE62BB77605186", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851279, "uuid": "de28b481-5d04-450d-b10d-b7e046cf6c72", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851279, "uuid": "a8135075-3554-4f55-81d0-e225a91f1a40", "value": "6144:rGi8l6DbIQwD9F8NqGSMg8M4FW5kLi5O6a945MBe:oUPIhF8NtRgvkO5gaMs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851279, "uuid": "35107033-45b2-4054-851a-449cd77178da", "value": 243050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851279, "uuid": "82bf0ac3-de6d-4d59-b2aa-bc9626f084c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851279, "uuid": "988f6ab5-a3ac-4b31-9da9-9ac99633e019", "value": "PAYMENT&VAT_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36028910-a930-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647878507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878507, "uuid": "c28fb2b2-ad34-436b-b897-ca058067a903", "comment": "Malware payload", "value": "7f112f6e13881f372317fe359fb208c8", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878507, "uuid": "111b0de3-de4b-4bdc-b491-979e06e02483", "comment": "Malware payload", "value": "171583f3e81de9e264d92a89d88e88396a4eec4cd575365a93909bff8aa6e50b", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878507, "uuid": "11bd8d86-78e8-415a-af7c-ab9e9551c364", "comment": "Malware payload", "value": "e1513a6b4f15dbc76ae031e09936cc1f0c40c95e", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878507, "uuid": "1992ad45-94fa-4bae-9e85-ca07be92d698", "comment": "Malware payload", "value": "6f65f57a7fb8f86b05c55e1302971da9355c6a89772f06abac1cde54e34dbf31caac3d401ff700c383caa43c1f32158b", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878507, "uuid": "03478479-92ac-450d-8b22-0ad6c7a9be5d", "value": "T198537D71B8D37CE362DBDC932058A6256EE0185B931FAB54E6B1BBD04EC05605BF8C1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878507, "uuid": "6bc8a7cd-69a0-4a91-b620-8343ef3c5fcc", "value": "1536:CGK085BaU8O0FMOlHY0Y3NgpUMYNslYkHixXUpo:1Kd5L0fN38UUMks6kCNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647878507, "uuid": "86dbdc43-7c8c-468c-a79c-e39c5128f57c", "value": 64017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647878507, "uuid": "144aff2c-38b8-4752-ac63-1ca65a5eae06", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878507, "uuid": "ec68f171-153d-4891-8de2-a0e9ba136886", "value": "css.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd7c9685-a8ed-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1647850011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850011, "uuid": "415e55b2-28cd-4c40-84d6-6448bac236f4", "comment": "Malware payload (Smoke Loader)", "value": "f44a4256b28c740f41bcf98ad1da7c54", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850011, "uuid": "25268fc5-691a-4b68-bac5-c11fba341c5b", "comment": "Malware payload (Smoke Loader)", "value": "179f95a2f266631257fac017eae04785c175e9af74dd1e4864343d17a52801e7", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850011, "uuid": "99c84042-653e-4d51-89c7-affb3c9ff572", "comment": "Malware payload (Smoke Loader)", "value": "725d1044e7ef09ba8f4cace446966e38f4f04051", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850011, "uuid": "2cd3f62b-b727-46cc-99de-d7ce81fc709d", "comment": "Malware payload (Smoke Loader)", "value": "31d866ee5142149c6b6b670a8c844e6e5defe6b69327227bfa98445d6cf4b37910ae2d7b47700bca070af27d9829484b", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850011, "uuid": "502c2d61-b199-449f-9034-ee1283c203b4", "value": "T1C2549E40B7A0D03DF17312F8797AD7A9652E7DA15B2191CB22D22BEE16342D0ECB534B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850011, "uuid": "e3e62f58-f358-4a12-b7ac-a89739cd657d", "value": "31ff0fcf24c663417943c5927af948dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850011, "uuid": "7d2077d3-1194-4256-8b2d-d90830774235", "value": "6144:kSvgQzzwd1sZ3U8QzL3mxFFdOGEPHW+9K4co6VW:xvVzwd1s9UzP03dVKlRGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647850011, "uuid": "17956556-fca9-4616-8e5e-8f6abea0d6b6", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647850011, "uuid": "bbb248d1-6cd8-4dbc-ab3b-e2039d7554bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850011, "uuid": "32b39836-07e2-4c93-8f72-24d70a871886", "value": "f44a4256b28c740f41bcf98ad1da7c54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c99d0a94-a914-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647866728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866728, "uuid": "d632035c-e9b2-4d63-8dc4-877d1305e890", "comment": "Malware payload (AgentTesla)", "value": "04bf0d04ec8cd0d6f89a4ab288e9a606", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866728, "uuid": "be4e4a5c-dee8-41da-aff0-95e289a7c103", "comment": "Malware payload (AgentTesla)", "value": "18666b5623a118eeb0523d82050b6d2b27832afd5d083b7f738e3cae9c10b039", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866728, "uuid": "0e35ddbe-ef29-44f5-9294-7d943ee59cdd", "comment": "Malware payload (AgentTesla)", "value": "fd64507bc66121e04a82842326b35f6498c2d122", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866728, "uuid": "f03ca5dc-a3a1-4940-a398-dc8a57454341", "comment": "Malware payload (AgentTesla)", "value": "eff3783c31147c7325261ea4b507d6ea0ea6654336763060975420d131b5ca56da0b4644084ed1f59c43f955e0455522", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866728, "uuid": "e53366ce-ef4d-47a1-9de0-a63ac928af11", "value": "T1C235231E33F782B3C16E577010E6E90407F699865A63FA046DC8B35C0A03BE65E5A67F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866728, "uuid": "3a99a877-f820-4ce6-bc67-78675642c095", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866728, "uuid": "a2fc5c56-6f48-4332-89b2-ffda92cc160b", "value": "24576:YH9thVK7KE3jmJuGh5GzdTsgCYDX34BWXgef30Ka20qJKa:Yd9KFjmJfh5kdrYBWXTf3O20UKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647866728, "uuid": "92da92c5-a7a1-44cc-8844-914818911919", "value": 1097216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647866728, "uuid": "8a6f665e-75a9-4b69-8313-8b74cc633b31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866728, "uuid": "313ba6a7-a55e-4cb2-96a5-2be3750a4120", "value": "Payment For Outstanding Invoices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96b49980-a8e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647848175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848175, "uuid": "3d145758-b66b-49e0-a84b-c2568d468da9", "comment": "Malware payload (Mirai)", "value": "3514265d326f8acd82051cec137202ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848175, "uuid": "e30204e1-286c-48dc-b746-ab69ecdec6a9", "comment": "Malware payload (Mirai)", "value": "188315a9902cf9f0f4dc6ae3de7afb003e1576d917b4279ec0bd736a7779022a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848175, "uuid": "3042afe9-f76e-4851-baaf-9ecab061e10c", "comment": "Malware payload (Mirai)", "value": "16ca72858dccfa73b34b8472565dc2f8cf7da513", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848175, "uuid": "c8e21356-3cd3-4951-8495-96f19b5a91fd", "comment": "Malware payload (Mirai)", "value": "87345a41c3c48dffebf2e11983c068c654205c10a91323112bc82de14ff86aa26735654442dd87a594b0529582a46cbd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647848175, "uuid": "1646198e-c39b-4d6b-a880-bf797792ef26", "value": "T1C18349829641DAB3D5431AF502AB8B150132FA3E5E1BDEA3F31C3DF49F129847261BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647848175, "uuid": "f894d7c1-b9d6-4def-9fd5-2d5f20e360ec", "value": "1536:NYPRYsI/cU3wVP0eFIudDy30CqOVq9gvS5hiNk7she0QzUzJYQ2Wk:qPH1U3u0Hude3pqOYz5hiy7Ue0QzUFYV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647848175, "uuid": "bef1e72d-ecad-4056-948f-66fcad9e513e", "value": 87924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647848175, "uuid": "dff9d78d-d325-480d-8786-93f0467310d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647848175, "uuid": "031248de-5f10-4255-8fc0-52e80af2d576", "value": "3514265d326f8acd82051cec137202ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75d74800-a8c2-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647831369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647831369, "uuid": "1625cc0c-b69a-4bef-8b6f-1f7151532228", "comment": "Malware payload (Loki)", "value": "79170f2df9293dd5ab502284027180d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647831369, "uuid": "ea9c1624-bb08-4543-a4fb-d5fdac0bff80", "comment": "Malware payload (Loki)", "value": "188f27b2a8de6beae7ceadc333671e53102baf203660ad06a7d94fc1c3c82862", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647831369, "uuid": "561d2f81-445c-49bf-8253-c4a825165a10", "comment": "Malware payload (Loki)", "value": "f661209aee451e02bd2a1340bb3654638ff30d11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647831369, "uuid": "46f23fea-bcbc-4a17-a037-d5508c473c48", "comment": "Malware payload (Loki)", "value": "f48b962a172b5e2f798df8eccebcdf27d6e3276d0252c0f1fc54b2a1efba4b0151480eeb9494c75949ebfe0e911cd84d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647831369, "uuid": "b6a63181-b909-4428-97f7-9e0d95ae56a0", "value": "T1531523A137B80335D79DB7F5D4A0A48A0B7284ED3606E200FDAAE4CA1D1770D5B396F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647831369, "uuid": "a2364bc4-4437-444f-8735-dc4afa479114", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647831369, "uuid": "db3b18d6-033e-411c-8b21-4e52ce2534fd", "value": "24576:gp9l9ejTEUbiaSNvd0nGHG6W5BUhObE2:gph2EAhW6nGHYUd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647831369, "uuid": "ab539b96-21c7-46ff-a4d8-ab247283ddff", "value": 931328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647831369, "uuid": "ca3b7d5b-af77-4738-97de-8c6b5c5ced42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647831369, "uuid": "4ebd228d-9c1e-4643-aae0-1c10976136eb", "value": "MthgEw3ZladWDEj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60959342-a8f2-11ec-9275-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1647851949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851949, "uuid": "70569b0c-e72a-45ac-bf2b-48fe70f63a4d", "comment": "Malware payload (STRRAT)", "value": "b41d76378193d320b770d7b1ff3fda72", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851949, "uuid": "26f18fae-02a7-4453-b180-c69be66aec42", "comment": "Malware payload (STRRAT)", "value": "18962c6a05bde5bd3408bab74c48c7a22d04ba9570d91d86d286b3341a1e1a26", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851949, "uuid": "6ef30d9f-ef0a-4eab-b640-4453ff5f3694", "comment": "Malware payload (STRRAT)", "value": "bd94a494ee26568d790632979a91c8eaaacfbb8f", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851949, "uuid": "7b6974dd-41e1-4a9c-bd8f-79d94461b8b9", "comment": "Malware payload (STRRAT)", "value": "a65012872d3734fde3926ebb2883214f9bab3d4362a1f283f1664fb598ace11f2ecc98d9e1514750ccde386c2203199f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851949, "uuid": "73943968-985a-41c0-9177-b9c3fbf7eddf", "value": "T1D70422F1524234223596B820D4BBD46B2937DE221738AE57D9FAE23D90013C97CF4E99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851949, "uuid": "8e53ac23-f900-45db-a938-137925da8127", "value": "3072:FCQWd3+08IuJVy6peFiF1GTIrErd8UnAS4LUiKLPaUb:jWD8BJbpeFCGT2ErUSRbLyu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851949, "uuid": "3b3c71c5-9b54-4ecd-b17f-f916af13c2df", "value": 178390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851949, "uuid": "01442b26-c435-4c6b-b2aa-290d39c27e02", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851949, "uuid": "1b037421-ec62-4d1e-aa88-2f8881ba5dfe", "value": "E-LI0788254443 ___ 00062805 ___ 21-03-2022 ___ pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "170fa81e-a943-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647886615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886615, "uuid": "2053eb8e-d877-4bcc-8bdb-7eb52f2fde65", "comment": "Malware payload (RedLineStealer)", "value": "b804f974c207afea644f6630e1f0601e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886615, "uuid": "e99b2d97-a788-44b9-85fc-53cf88a6e955", "comment": "Malware payload (RedLineStealer)", "value": "189dfaba008341c37b942390d7c2b0a24a8ff6c0c925a92e0f491ab67aed2001", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886615, "uuid": "485dab18-8a76-4a97-89fe-d55f5ba7100a", "comment": "Malware payload (RedLineStealer)", "value": "c11e13862c254e341bbd92494021f6e397e6790a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886615, "uuid": "a4b257cc-08d0-4d2a-9c43-84b4ce6146a8", "comment": "Malware payload (RedLineStealer)", "value": "6662957f406dd410a53ac0b2e46c8309f950cc41644ebeac21b5c93030bb131d4ed0b1468dd30acdbdc66b3ed9c9fa70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886615, "uuid": "6739a209-7436-4181-9909-38248dd75ada", "value": "T1D3A4AD2A71D29E48D6241A37D157C2144BD2BB96A3B7D32EDD6F02732E033A44DD13EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886615, "uuid": "2c669b92-06eb-4314-b38e-65d5f1058f26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886615, "uuid": "2139b147-5280-4884-82ec-a545918f779c", "value": "12288:djrosKtFoHn+JCpcFJOQZL/4uDhdoDLiB:OsoFowVvtZr4xHiB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647886615, "uuid": "f2ae9f2b-97fa-4225-9e97-26dc13911400", "value": 481520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647886615, "uuid": "3aedc2e2-0bec-4e31-9126-140de5ad253b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886615, "uuid": "bee0fc7c-a210-4f44-8a44-4cf7972a3b16", "value": "SecuriteInfo.com.Trojan.PWS.Siggen3.13421.22630.10074", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7574d47e-a8da-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647841676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647841676, "uuid": "9c5a77d1-5cbe-4870-8e72-396111fde363", "comment": "Malware payload (RedLineStealer)", "value": "77f7945e48fab5c2efbc4ade2b6deac1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647841676, "uuid": "d4ceb35e-d983-4c63-8d6f-e88e78eb1ea1", "comment": "Malware payload (RedLineStealer)", "value": "1a2786ae6680459aa89e79fc3c93c73f9901be784ce2eb4267c5010d2c6d9b7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647841676, "uuid": "0079d1ff-6819-495f-a574-08cbd7b2cdb5", "comment": "Malware payload (RedLineStealer)", "value": "14de0c27ce0110715a4592ed238fe73b1bca286b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647841676, "uuid": "6f8dc048-d76c-4c71-ac20-f3ea86d5540e", "comment": "Malware payload (RedLineStealer)", "value": "9f76045db21e9f0d003a917bbdf1bcd62d330a1e1f512897acc7217b765ab078996f53fc01a0d2eaf74089ca2f3d448b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647841676, "uuid": "81472b75-aa10-42e7-8674-e410759b5967", "value": "T1B794F12276D2C071C0863A707427CBF96ABBB432A535494737E8077D5F303E16AB639A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647841676, "uuid": "d00f7677-6833-4d5e-901a-21c9b5a0388f", "value": "dd74d0a493381cbdbb2d3a82a03effd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647841676, "uuid": "c36b356d-7cfb-4dc8-8d1a-f36b451745ff", "value": "6144:zKbKhbhKXDFbfrhDVaoV2TwrKwnq3CAR6Gz1GjJD8x5KOvGQt62:zKYbEXDFbfrHjV/r0bwjJDw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647841676, "uuid": "71896649-4509-44fb-bc35-4eb85c943852", "value": 414208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647841676, "uuid": "8d182958-87b9-4447-992b-3ab378455685", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647841676, "uuid": "41dfdc28-8bd9-470e-a501-c6d11fd15f13", "value": "SecuriteInfo.com.Trojan.GenericKDZ.85453.19981.19333", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4f12f77-a947-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647888652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888652, "uuid": "6201a390-da11-48c3-8090-7a7257a53cc9", "comment": "Malware payload (Heodo)", "value": "5fa5af8d66395a5a7fae4d94985ef297", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888652, "uuid": "a5838642-32be-44c9-9060-68e4702aa441", "comment": "Malware payload (Heodo)", "value": "1a974ed3d87ed52c230ff7fdfdcb574351defdd6b4db3cbedd95851f528b5373", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888652, "uuid": "073e48c5-1f27-44cc-ba46-05219e6c5a6f", "comment": "Malware payload (Heodo)", "value": "24b9f5960aa0b601356dd9b95c27e595b1733ad4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888652, "uuid": "551642f1-e32b-4cb6-8477-e9c49ca44d4e", "comment": "Malware payload (Heodo)", "value": "ada5303fe3be7a4b3f9060e23e78c3f545e532a7224c68a94de3d1fb31fec3298aeca54469cd8ca9336447370da0288c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888652, "uuid": "f6219946-7d4f-44ef-abba-346dfd3c8bec", "value": "T188B43A11BC916832C36FAC7456073262588EE7F0DBD1F26FA3E0495C9A7C5E36624BC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888652, "uuid": "eb566142-2ad8-45de-91a3-8718560c5754", "value": "14e6ae8d1400b6271725b3f01025b85e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888652, "uuid": "23bda429-92df-49b0-b89b-4034c8c10958", "value": "6144:VikzyaB9eoCyx/mEhHB5RYSJ/x5+qiCjzQNPj79GkqbscgCG5qH6scI:VNnCGmyHB5SSJpk0zQN39GkUGQSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647888652, "uuid": "997a5890-4ab3-4fd3-a900-c4746e2a073c", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647888652, "uuid": "0e373933-8f43-4604-979a-074f9d453e81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888652, "uuid": "efa51656-f7de-4238-9cbb-4926ec69c37d", "value": "emotet_exe_e5_1a974ed3d87ed52c230ff7fdfdcb574351defdd6b4db3cbedd95851f528b5373_2022-03-21__185043.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a55cb9a-a8ef-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647850597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850597, "uuid": "e1dd9ea1-4045-49f8-8f0d-64ca2fe0e8c6", "comment": "Malware payload (Formbook)", "value": "3c26bdc18540879fae8040bce2a66f63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850597, "uuid": "3b876c6b-96c1-426f-9775-d32c52e53616", "comment": "Malware payload (Formbook)", "value": "1ae613f84becf2566b3e2a84cdbaecd787c2a7c538d3946ec8309c85c4521ad8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850597, "uuid": "6219ee02-a204-4b6b-97de-8378e21b6fba", "comment": "Malware payload (Formbook)", "value": "395c9b72611e5274207c11d60d3fc28db8b87c6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850597, "uuid": "b3511b12-fee4-4b86-b8b0-97eb3f52c568", "comment": "Malware payload (Formbook)", "value": "a7edd4db8b4ed14ecb3bf7d6e951b851b4cc74ec315dea92ebc0cab615495f44e6d3ca274f112f6d0ea3a91f9501075c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850597, "uuid": "36f60120-573f-41b3-bf0b-74196af8f156", "value": "T1E22523AD3FFC423AC5AC6372E8C436C41BB628217582E75CD68A540B4A11F164667FFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850597, "uuid": "5fc2456e-bb16-448e-822f-c160f03b7346", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850597, "uuid": "844c34d2-ab59-4430-be88-8c97f18ba85f", "value": "24576:GTGil9oLjjhha0BrMvuMrm/K/ERUGEp/V45zI6L1W:GTGUoLJhaArMvuMS/K/ERUGIV4BFL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647850597, "uuid": "f1a2c20f-1528-4e22-813b-bc3265f1e337", "value": 990720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647850597, "uuid": "9e81a2ef-920a-47ac-a469-722fdc2a1d7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850597, "uuid": "3cacb758-fbb4-491e-8017-33f23bdcb366", "value": "Repeat Order For March 2022. PDF File.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10094e8d-a922-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647872430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647872430, "uuid": "e07d2402-d178-4dda-a550-1ad6b7495832", "comment": "Malware payload (Heodo)", "value": "b18b95be6894d41eb1f5fd086cafee1f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647872430, "uuid": "bac7a867-a5c9-45be-95d9-5f9f5d66a54d", "comment": "Malware payload (Heodo)", "value": "1b48c798d7f9870f1b9c01baab8f8c28ea2d6ba06096ba518674de3b9ce770a4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647872430, "uuid": "e5b93771-9859-4933-8656-6d4e7b3295fc", "comment": "Malware payload (Heodo)", "value": "e7ce298d74a0f67b049370e62649273d045c9b16", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647872430, "uuid": "a1a01ddd-2a87-4bdb-88d5-a79aa15ba5e1", "comment": "Malware payload (Heodo)", "value": "c5cc47d98500e8dca2c82b94da968fd41986145c9e9ee5bf2bd6d22e3cb2b2c61a5b99d1f462f3570daef4d1b839de4f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647872430, "uuid": "488c453a-7589-4445-92f4-36e79aa0ff29", "value": "T1F1F2AF31F2E28F55E436587C4A8CDAF4D73DDA2242067E2C309A53BC5F633566A4E24D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647872430, "uuid": "3c8954ad-d9d1-47ea-a352-0c61f2079826", "value": "768:K0t+5eEAjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooaDx:K0t+gEUOZZ1ZYpoQ/pMA39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647872430, "uuid": "db5cc6ee-e0bf-40ca-bded-1c45e15d7bcc", "value": 36456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647872430, "uuid": "696b5a7f-6be0-4c81-aa32-446c0e9c8919", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647872430, "uuid": "3ea37dcc-f789-4fdf-b7ac-c064403a4565", "value": "139-426592.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cfad296-a8f3-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1647852346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852346, "uuid": "64ac6def-5924-4bc4-86b5-1d26161a9fc1", "comment": "Malware payload (AsyncRAT)", "value": "f1377a4da3174c2b1b57175bcd9987d7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852346, "uuid": "c3f33a91-622e-4fed-aba8-4182271c97a7", "comment": "Malware payload (AsyncRAT)", "value": "1beb658423ab09744b840c803d62f97986d95e632cf77ade7529b35b0a114680", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852346, "uuid": "8b2d8193-b722-4ff9-ab5a-20a4306e9af6", "comment": "Malware payload (AsyncRAT)", "value": "0a84040ee50e7966f1fce8a11bfd88a56a242a82", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852346, "uuid": "1af01fcc-7e69-4486-b734-a2855e28defc", "comment": "Malware payload (AsyncRAT)", "value": "8f2c15f3ac1bbebcbceaa90249a740a4ffc1d0db7428a81be49709bb91e8223c546765f36dfb837c013ce64cb372629d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852346, "uuid": "8660870a-f98b-46aa-899d-d5d131d8fbdd", "value": "T18C1523AC7FA9536BD7A8B1BEC5ADE2401BF74CE71843CF24084580C652627254B26F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852346, "uuid": "53f6863f-7965-481a-a89d-c8170e832abe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852346, "uuid": "dcc2f5b5-1157-44fd-9440-98fc4aa2d644", "value": "24576:24+l9T0qai3P17lKvP6Gj9HtQ7Kub0o9dL8oQ12y:24oQqf/1ZHG/Q7Kub1Tr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647852346, "uuid": "879eeb52-67c9-413d-8d5d-afd003a87375", "value": 893440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647852346, "uuid": "4ff20e03-f517-41a6-80d4-f9856dbbc154", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852346, "uuid": "0b9c600f-5339-41bc-8209-9f8ec7e3de70", "value": "f1377a4da3174c2b1b57175bcd9987d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3749b73-a8fe-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647857215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857215, "uuid": "e39cf4fb-adcb-45f1-ab57-27b7ecac3ef0", "comment": "Malware payload (Formbook)", "value": "7952b7a232367ee80e7c1f20c2051b35", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857215, "uuid": "2655e6b6-3452-446b-822c-e0825b32ad71", "comment": "Malware payload (Formbook)", "value": "1c67eb0637866fef3d52fa28ffaedb9869c7f92560a58db83f1d0bc27cc8df1f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857215, "uuid": "6e5fbf38-d7b9-4304-9ea8-287ff7311dd5", "comment": "Malware payload (Formbook)", "value": "fea3ae9ecf2d69b53f46ca823240b39b5c721c43", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857215, "uuid": "97b63a66-baab-482e-82bc-0047c1ddab2b", "comment": "Malware payload (Formbook)", "value": "3791c8271deb422d18da117aee1b10290cb445a4692e35e81055ca004f11948738edb56f706c647fe9ef6de16b95cfc8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857215, "uuid": "43702cde-299f-4d3f-8f94-34b4261d8590", "value": "T1F634123AF1E25973E45529790DF3D73AC77612C742E3DB2B57642FE928321EE0109A81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857215, "uuid": "8075e6b7-5594-414f-9caa-2bb7ec2d8165", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857215, "uuid": "6384fe0a-f4bd-4d27-a55b-34906dcecb66", "value": "6144:rGiusAP6ovV29DOjy0iKzhFzZNm4rCLL8JWMthj8:2y4QqNiKdrNtrC38A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647857215, "uuid": "20dadf64-7ec7-42c9-ad72-aeae16de2188", "value": 250262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647857215, "uuid": "8084807e-b221-4249-9e6b-c08eaaba38f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857215, "uuid": "d8cf180d-9a5a-40a1-a39e-d43f40da7610", "value": "7952b7a232367ee80e7c1f20c2051b35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a052f5e-a94f-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1647891855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647891855, "uuid": "341e83b7-276f-48fe-9091-643f3106d1d4", "comment": "Malware payload (njrat)", "value": "7f71b8fc9a63fed4f2e68a6d87ef8365", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647891855, "uuid": "da8c0c0f-1284-4a2c-a198-50dd45b8e8f5", "comment": "Malware payload (njrat)", "value": "1c8384b387eee3f0be1540a3b61886cf9ea7e4b067cc498f59d6a618044d0e75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647891855, "uuid": "feefc73c-4f4b-443e-853a-c910072d521b", "comment": "Malware payload (njrat)", "value": "ba97aea5ed4da162e53988098e914e175d8a174d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647891855, "uuid": "80331ea8-1f09-4e36-a403-ed09ec95cca8", "comment": "Malware payload (njrat)", "value": "a92ef11669e4a7111995a3667c37b37de46c876b43001123f1cce2ab991f4c82d88ac24751f91ca370fefdbe2be4a525", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647891855, "uuid": "2bb31eb7-691c-4dfa-81e6-57a97e6b159c", "value": "T167033A4D7FE1816CC5FD167B06B2D012077AE04F6E23D90E8EE6649A37636C58B50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647891855, "uuid": "53433f74-fc7c-4954-a48e-af5387e3a46d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647891855, "uuid": "8615f842-e882-4381-8863-ef63dd5f3b8b", "value": "384:RADCVgibvjpPu7w9qyMT4f/DisWUbTrAF+rMRTyN/0L+EcoinblneHQM3epzXfN6:qGNN9ZMT4f21UHrM+rMRa8NuZgt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647891855, "uuid": "4a13a25f-a7d0-4620-a51a-ddf4f4cb8470", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647891855, "uuid": "4845ec29-e5f2-4b4b-acfa-8f3a01f3f6f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647891855, "uuid": "2f2f4d3c-85dc-4e5b-8299-c8a916b63145", "value": "7f71b8fc9a63fed4f2e68a6d87ef8365.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a70ddf38-a928-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647875260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647875260, "uuid": "cce996f3-e024-48c5-bc01-607b0018ab49", "comment": "Malware payload (AgentTesla)", "value": "4e1e792784fcf91379dffc5d08b15878", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647875260, "uuid": "97ffcd07-9b48-4026-8d1a-9d66f1d9f8e2", "comment": "Malware payload (AgentTesla)", "value": "1d065d3752cd646e83fbf2e95b2e8a2ef0fa9c265bcac75840caccad6d74af79", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647875260, "uuid": "637eb53f-5a80-40f4-869d-78c87f2bddcc", "comment": "Malware payload (AgentTesla)", "value": "22f9572a3c54463d62119026b17b05b31db2fcea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647875260, "uuid": "846f1c27-2706-4525-af57-f77cf31fd2e0", "comment": "Malware payload (AgentTesla)", "value": "1ad29f270586b74f2f12dd27f8bc63fd332b62de5dce3b317f40ae668d5a52fc43efdfac7f2e878c1b0656cd9440186d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647875260, "uuid": "b1a1efea-8807-48f8-8e5c-73e8937d8c89", "value": "T1C84512C6EA928161CC6C6B3990B65C5403777EA6BCB7E24CA88C71746B732D3143798F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647875260, "uuid": "fc923957-9fb5-49e4-b421-d81249a599a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647875260, "uuid": "843c4795-b074-4b2b-b626-2fbfe6e22435", "value": "24576:ps9P/7zd9iPIjDoTdXA6QXZxIY79Nj4l/kCoymYsd0:p0H3P26gA6QpxICN2RoymYsd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647875260, "uuid": "81c0a4ad-9be3-4148-b289-312b70747276", "value": 1201664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647875260, "uuid": "873f1b3b-3c33-411a-8c9b-49cbc660ccb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647875260, "uuid": "60e64ef7-eb43-497c-b05c-1aff28311c6e", "value": "GEC CON H2453ED.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29154408-a8f7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647854004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854004, "uuid": "3cbd89c1-dada-4aca-ae8e-7aafd3abfda5", "comment": "Malware payload (Heodo)", "value": "a56996951afb07a28581e3bebbf18a5c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854004, "uuid": "1e91a150-d5fa-4aed-a4d3-71924c0a8313", "comment": "Malware payload (Heodo)", "value": "1d0e52098565a050900abc975653c08183475f83ef4ce6feeb2a66cbf6070ada", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854004, "uuid": "2633976a-e1dc-4076-abe6-27f4def8a515", "comment": "Malware payload (Heodo)", "value": "b339e82d8ed90eaa86293a11334b27738bfd1e77", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854004, "uuid": "8072db1c-628d-4977-8a91-29c24ef6ec01", "comment": "Malware payload (Heodo)", "value": "e0fa9d6795febf6dad0058c0253720a3bbf38b0d7c2f38f667a8e1d961042e41f99f0a8527189f14d3a41fcdf202f7ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854004, "uuid": "0cd50235-9c01-45e7-81b5-9bff41b85d58", "value": "T153056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854004, "uuid": "dbecbe7f-eaf8-4717-bb50-c0195b834469", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854004, "uuid": "0948f2e8-92a9-47ab-915c-3808e8ba86a6", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/r45CGNHrH2tZ+d+:gMV/r45tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647854004, "uuid": "bb923e05-ce2b-48d1-9189-5889b620e285", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647854004, "uuid": "0cd386b4-cf1e-49f4-bc12-21d10ef7ab60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854004, "uuid": "ed2a1b13-351f-4705-b210-d0e82157b394", "value": "a56996951afb07a28581e3bebbf18a5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bd003a3-a8f5-11ec-9275-42010a9c0029", "comment": "Malware payload (vkeylogger)", "timestamp": 1647853176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647853176, "uuid": "9c9814ae-e1c6-49e1-b080-f3fae33360f0", "comment": "Malware payload (vkeylogger)", "value": "c40967960f1817c1458a587cdab9e3a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VKeylogger", "colour": "#FE96F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647853176, "uuid": "61595bb6-3ebe-4bae-8afd-d1e2971e7ab9", "comment": "Malware payload (vkeylogger)", "value": "1d4bf0958c9382e0ab0ee9dc4240fd01aa6c17b045f60a5fbe0a92663ccb875c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VKeylogger", "colour": "#FE96F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647853176, "uuid": "5d14886c-9d58-47af-84a4-395a6067c5f3", "comment": "Malware payload (vkeylogger)", "value": "0f7fd80ae64aa53afae14571c7ee47a159a33bbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VKeylogger", "colour": "#FE96F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647853176, "uuid": "a1c67def-cc33-4821-a041-ad2f7e8d82a3", "comment": "Malware payload (vkeylogger)", "value": "0f554c8fd693eb28a3344ba477398f475a09f6e7600f10a7c00c2b8975571c1ace34bd65982aae716fcfab6fd9a3d736", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VKeylogger", "colour": "#FE96F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647853176, "uuid": "b6885f8a-e73a-4995-90e0-e4462a52a6a0", "value": "T1B8147E0275C19131F5A219328AF5F9A99B3DF8B11BD189FB33C8426E4E607D1FA7091B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647853176, "uuid": "adf018be-a09b-4bd6-b883-9eda455a20f8", "value": "d7d3ecb862284bb9b0c1cb817c930c2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647853176, "uuid": "3805f48d-7f58-4292-8f8b-56f040f6cdf9", "value": "3072:WACYqXlb0lKAuyI6R2mXMsiuDhMtwsPTmIUZA3DrMC60vY0qUfqdwsf5hBQALdQb:lRqXMDR2TuDh3bZA0C7jPyd3f5xHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647853176, "uuid": "7126ee78-afff-419a-af2f-005310df4965", "value": 193936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647853176, "uuid": "c12f65ca-0dcf-4771-87c3-bec75a1f629b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647853176, "uuid": "f9f6d676-c518-473d-974a-2a876654b7cd", "value": "c40967960f1817c1458a587cdab9e3a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a061fd20-a946-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647888134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888134, "uuid": "32341050-8afb-45bd-b4b1-ef03890cbcfc", "comment": "Malware payload (Heodo)", "value": "3561f51c42a4081e727f0e1a654dd620", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888134, "uuid": "e0dfc1e6-7f8c-4d1f-a4c9-a57ed6f08cf5", "comment": "Malware payload (Heodo)", "value": "1d5b60682f435a961fade41bd440d61398e987f9d519f1cae9eb26c7aa79d58a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888134, "uuid": "1687927a-d24e-46a7-a93d-2983d88becb6", "comment": "Malware payload (Heodo)", "value": "79571896a8242a7c125274419bb1761ccc5c60ec", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888134, "uuid": "89a23d12-d598-478b-a0ec-baa48f8f4f29", "comment": "Malware payload (Heodo)", "value": "7dc2b6bcdbf760c1fd0ffbdb3169e41a9ece0c0c20f3a26f7be79b7ece2339b09e2147abb2e7464610034990a09fa797", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888134, "uuid": "d7458838-070f-4872-b2d3-49132b4c1816", "value": "T161058D8FF7C0E1B9C25B3337B1045FB5369F68314A62915FEAB2467D9A315829E28307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888134, "uuid": "6742a67f-02a0-457e-87b2-7431dd5ff217", "value": "da43c7a1230b5e9633dee3bb298abbd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888134, "uuid": "08748486-6306-40a8-9bba-42c2cdece702", "value": "24576:rtKv04BWEZaRb0hr4M29nJ1d/nThfhdQZQ+/s:4kba4MOn9hQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647888134, "uuid": "36de7693-c5ff-418f-9105-56a4ac26559a", "value": 808960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647888134, "uuid": "102e9bcb-428e-447f-80a9-97078ae42d5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888134, "uuid": "aecfbf4d-5b79-4d4a-9bb6-1c08578cae74", "value": "emotet_exe_e5_1d5b60682f435a961fade41bd440d61398e987f9d519f1cae9eb26c7aa79d58a_2022-03-21__184207.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5b09c43-a92c-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647877083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877083, "uuid": "401f0af6-445a-4c2b-9bf9-3e3e8fbd00d6", "comment": "Malware payload (RedLineStealer)", "value": "2ee275ca356c8064970086b9e79835e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877083, "uuid": "01c16bd9-17a5-4074-8999-185c1e07e67c", "comment": "Malware payload (RedLineStealer)", "value": "1dab8f4d4666f495e4505749663a1513bc4085b8bb7beb28caf99c80218011ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877083, "uuid": "6aeb8394-46b9-42a8-850d-bdbf128ab313", "comment": "Malware payload (RedLineStealer)", "value": "fa0b274fd6e57402f1fc2c5b8508ca1e0e7c0139", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877083, "uuid": "4cdf1c38-c94b-4dc6-bb15-61d014eaf8ee", "comment": "Malware payload (RedLineStealer)", "value": "561b0fedf2cc1f400be9484fb2587ae81ef171892331a60e32e07379cf054ffafb12ad9470e364ec2a6b3437f71e3723", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877083, "uuid": "5af76905-b4fc-40e3-85a3-ede3fc430ff1", "value": "T1C7A35D2067AC9F19EAFD1B74B4B2012043F1E48A9091FB4B4DC194E71FA7B865917EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877083, "uuid": "18288637-5b2f-4d8a-ac51-d02ab5cdbbc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877083, "uuid": "bdd7d9aa-0f94-43cb-b867-e414c40089b6", "value": "1536:xqsK1tqzClbG6jejoigIr43Ywzi0Zb78ivombfexv0ujXyyed263tmulgS6pk:f2tAyYr+zi0ZbYe1g0ujyzdYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647877083, "uuid": "6bdca9eb-2035-45a4-a2f5-3e57f4f4ce9f", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647877083, "uuid": "1ea065e4-e2f9-4ca8-ac4c-120b5f05cf45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877083, "uuid": "a64179b9-925c-43fb-8ee7-28a862c43ffb", "value": "2ee275ca356c8064970086b9e79835e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aa39b64-a8e1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647844584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844584, "uuid": "d899d48f-1ca6-4c88-82f7-1f24c4662cfd", "comment": "Malware payload", "value": "d60603a18e671770a33c3e66b1f3059f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844584, "uuid": "c210b225-b225-4afd-9184-8e9b4d6706b5", "comment": "Malware payload", "value": "1eb059916b79eacd3a080091a5a365df689ef9d7b779003d69df05cce085754c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844584, "uuid": "26b793fe-7545-4109-ab4a-b20641b4c723", "comment": "Malware payload", "value": "6d35f9562691065d6e3cb4a48df6a7a10be54b0a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844584, "uuid": "1f1b912f-b5fc-4069-9854-ec4924b49a66", "comment": "Malware payload", "value": "6ebde3ba22b4ac1d4d0e7f02101166244c691fbac2b846f4c6d6f5c5a0b9d105a35fdb0577d8ea4105c372169437c9ff", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844584, "uuid": "c2372723-0dad-4993-8fbe-3221192f6793", "value": "T18A429DB9E942F834D149D87D710D23F8F58D42918B36A14F3142A6684BD79C7C3ABD8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844584, "uuid": "36fe8156-f669-41c8-92f9-0ea0956cbcf9", "value": "192:ScIMmdDzxOr0+cZ4ayetw92h5bv/0a5CXbLKQ8/hxir:SPTDzU+yGn5CXHq/h0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647844584, "uuid": "615edf4a-c6ba-4f31-b143-8b4b8865257d", "value": 12153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647844584, "uuid": "a98abee5-00a6-47b0-b680-2313bdb8202d", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844584, "uuid": "c7e35fe3-3ff2-4bbd-b96b-f5408179e2e8", "value": "GOODNEWS DEAR LUCKY WINNER CONGRATS!.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc9e354b-a91d-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647870626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647870626, "uuid": "64934b23-ae3f-49d9-92e9-b307ee056622", "comment": "Malware payload (Formbook)", "value": "c0d643d32f4b6f9503afa1863d4fb528", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647870626, "uuid": "5b5b256b-ab81-4b72-a07e-ca4423de5fc1", "comment": "Malware payload (Formbook)", "value": "1eb8af23658c91ba76fe9516d0a7f8a678d0122454cb837183326c5a7fb95850", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647870626, "uuid": "42cf1203-f640-4049-b992-feecd80ef277", "comment": "Malware payload (Formbook)", "value": "eebd3e11c57fbfb95ee14f2fdfb271828632bc99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647870626, "uuid": "c616cf17-07e8-416e-a208-78339288a0f7", "comment": "Malware payload (Formbook)", "value": "ccbd7a4acf34965c0802196cef51201884e93657e3ca83bb72d14cf2ce9df881ad8a2403acaf9b26e43afb8f4760bc01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647870626, "uuid": "b1b7dd99-f3e0-49d2-95ea-f725d74df08b", "value": "T1F0252369B2E7D426C55A5232E4E6B5004FF98BCBEC53CF187AD4225C0E033A74B6716E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647870626, "uuid": "c3faba20-cc7b-4136-98ee-3f4c2ce26989", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647870626, "uuid": "bbf49e54-6f46-4433-9afa-5518f47e4bfd", "value": "24576:mmN9Wt+NZCt17twDYuaHkNlwVO9W0Rbtd3UWFWFjKSJ+LZ:mm/ytrwDzT9WytWFFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647870626, "uuid": "02d31308-0b55-4ef5-b57c-2ba478091b64", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647870626, "uuid": "f61a8264-e2e9-49b0-b31a-5138bd0861c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647870626, "uuid": "6d6d7728-e339-40ea-8b0d-5130e21294ec", "value": "Eq8RuAZT0ui98qU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d682d07-a937-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647881445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647881445, "uuid": "6e255c6f-578b-49d1-85ae-b48e3c709f9c", "comment": "Malware payload (RedLineStealer)", "value": "08c9c2ea3b478032f9dabb8fcdd2ee6d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647881445, "uuid": "caf79889-914c-4fcb-9998-342bbc6efab7", "comment": "Malware payload (RedLineStealer)", "value": "1ec91641c9501dbfb30954ce79f6bf6592fe12a1aa2339fca6ba302e1ecd8c23", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647881445, "uuid": "a1c90e0e-aa10-415b-914c-2b44bb69e559", "comment": "Malware payload (RedLineStealer)", "value": "1c9d7500cae5cc79c4dd9486b74194d4aa7daa8e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647881445, "uuid": "613ce7a6-b631-4a24-9613-c75cdc3c6c89", "comment": "Malware payload (RedLineStealer)", "value": "9f5a994aa0d4932650355a84ba273cc95ed588575f382db06f56e0fb48bfad0f842ee448459f6b0298dccec47c6dfa40", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647881445, "uuid": "457910e5-7d78-46c2-8265-52274330df83", "value": "T1F9657E76F18AC762C19102351984F5C0FF38F9A720BAB852B94D59F717AFE9990B34C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647881445, "uuid": "95dbeffd-409e-46b7-9c1c-3ff5bb2fe78d", "value": "f0a11e0271a5c976fa824da23e56b697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647881445, "uuid": "a20cc1e0-2f9a-4919-ab19-88fb5421b546", "value": "24576:6BNfTo+wwNuOVlCjTZOkQsHxSxxXUCZ0AA1:6jTo+XcZRkxxXUCZ0AA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647881445, "uuid": "27789d3b-d8ee-4526-9d79-72b100d8d605", "value": 1512336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647881445, "uuid": "a6bcd201-b463-4324-8bf7-77ccf2ff8e15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647881445, "uuid": "c61ae19c-9152-4cc4-9ce0-10a4ca80e6da", "value": "08c9c2ea3b478032f9dabb8fcdd2ee6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3c93230-a917-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647868061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647868061, "uuid": "cef1dc5d-65ad-4562-a16a-6f9da7c8e94b", "comment": "Malware payload (Loki)", "value": "ed9171cc6697b1a416d4f71b4c1c67ec", "object_relation": "md5", "Tag": [ { "name": "bz", "colour": "#5E7FAD", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647868061, "uuid": "c73c95df-7760-49af-ad89-3ad4ac09f6b3", "comment": "Malware payload (Loki)", "value": "1f0434605acbc2a1d9db18d103b64ca531645ff92e3d60e54c3e0eff8315007f", "object_relation": "sha256", "Tag": [ { "name": "bz", "colour": "#5E7FAD", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647868061, "uuid": "6ed2366e-8273-4a8c-87c7-a00f294ea1a2", "comment": "Malware payload (Loki)", "value": "a11b11c6ff21158b8dbdbad7265b85184eb5ad1d", "object_relation": "sha1", "Tag": [ { "name": "bz", "colour": "#5E7FAD", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647868061, "uuid": "030d8457-3d27-4740-9ac5-69b0986d3373", "comment": "Malware payload (Loki)", "value": "836fb98bac705280f573942a399de5b5c780b015184823e737d4cc2567427bb4c98ce6b8430ea137ed9be3f445190733", "object_relation": "sha3-384", "Tag": [ { "name": "bz", "colour": "#5E7FAD", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647868061, "uuid": "1a2de8af-15a6-49a6-b5a3-0ac7df0ad6ef", "value": "T1D3B42350D24DA89EAFE8E0B8F6CE48A316EB906BF9508B1BD5401F624D0F37F6917650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647868061, "uuid": "fd7c8d84-f367-4f4b-9b2b-819cbf25a23b", "value": "12288:zxbvI4sP7CLm3DaZgqYiIwAqB9gx2lkhU+cpWxwXlarsT0:xwPPhTaZgqYiI9E932r6XcsT0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647868061, "uuid": "50303c3c-0d63-48c5-8cf9-cfd931d26607", "value": 499918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647868061, "uuid": "372e1771-f326-4450-af13-85964b09eeaa", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647868061, "uuid": "14741dc0-e317-4ef8-95bb-81b128f477a6", "value": "PO#2100131410.pdf.bz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d66597d5-a8e0-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647844416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844416, "uuid": "6ac6779d-449e-43fc-a4f2-5d5d8f546224", "comment": "Malware payload (RedLineStealer)", "value": "9c237a09cc75ba8d5ca864e7e01c573a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844416, "uuid": "b71809e6-8acf-4b2e-bf10-fad6eda25762", "comment": "Malware payload (RedLineStealer)", "value": "1f6045e7e0babc57f0a2ee7359ccc5226b600494ee56565d19cda348b1e7c64c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844416, "uuid": "f7c07cfe-22ab-4a87-a4d7-6b4b4f239686", "comment": "Malware payload (RedLineStealer)", "value": "7f3ffa5b05c8af9ba61c1cef48e58f906606e97f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844416, "uuid": "88235ce9-556d-4c1d-8b3c-d9cee44c26b4", "comment": "Malware payload (RedLineStealer)", "value": "21e4bf2406faef7cc7cf784a9def06bfa465fd6a9aa30cd67f72011c60f9bca3422c39efc1717c524d9304485d13e1c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844416, "uuid": "c1ee6a6f-0ac5-4f6f-b139-e2f5d2f6f836", "value": "T10A3633B76259A33CD6FA1BB96E175C8D30D6BB5247843CE58EFD0228F1C8331B5061A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844416, "uuid": "103aa17e-09c2-4210-b456-dda56e680960", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844416, "uuid": "2c5e60eb-c7bd-4368-a5ea-db7bc24dbc10", "value": "98304:Dlp5N3y6+ZX3vVAv2TCCb92yuAWUKzvC50zrWyCq6/wa8IUc+:JDNi6oXXTCCp2cDKjCCzrts/98IT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647844416, "uuid": "441c30d4-7d24-4e6e-97e2-b5032fdf4bd2", "value": 5004744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647844416, "uuid": "182cd0ed-77cb-4069-b9b3-f0e4fde38f64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844416, "uuid": "1a72ed66-bd7c-4caa-848b-39676ce2a779", "value": "58988178.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b3acc3-a8f1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647851423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851423, "uuid": "55148cfb-7a0a-46ed-aa32-72ec2813fc34", "comment": "Malware payload", "value": "ed902c1796eec0c511682075b8fe63c5", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE ZIP", "colour": "#8B5CA7", "exportable": true, "hide_tag": false }, { "name": "EXOTICLILY", "colour": "#D74DC5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851423, "uuid": "db714d6d-1998-4701-9817-783c6879a487", "comment": "Malware payload", "value": "1fd5326034792c0f0fb00be77629a10ac9162b2f473f96072397a5d639da45dd", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE ZIP", "colour": "#8B5CA7", "exportable": true, "hide_tag": false }, { "name": "EXOTICLILY", "colour": "#D74DC5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851423, "uuid": "34e55c9d-14b7-41b7-8082-97a4764a27bf", "comment": "Malware payload", "value": "e9f1aa4fdd749854aead68a9566d1b960f4efc90", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE ZIP", "colour": "#8B5CA7", "exportable": true, "hide_tag": false }, { "name": "EXOTICLILY", "colour": "#D74DC5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851423, "uuid": "68ca5413-96cb-428b-8db7-ab4e59053389", "comment": "Malware payload", "value": "ddcb6fc0d6cae74496dadd632ca8c5e00c788088042c88d1038e6a80a97ff7eca9808c405f5cc806a1e95affe6ba7b5a", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE ZIP", "colour": "#8B5CA7", "exportable": true, "hide_tag": false }, { "name": "EXOTICLILY", "colour": "#D74DC5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851423, "uuid": "fb1f2508-6ff5-41de-932c-18de8a9fefbf", "value": "T1402533A39468AB225291B0F73BA9C406EB4B45545EEFE27E106E6351804F313D7FE9C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851423, "uuid": "1512efca-0643-4fc3-a31a-f864ecb9e3db", "value": "24576:DEGtDN22ifihJad2/hqk0RsUCbBYTIuw5P4:DE4D429hJe28kJUCzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851423, "uuid": "d6270795-3c81-4676-8d1d-86c7686b06b3", "value": 1034077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851423, "uuid": "ae39ae45-4b8d-48c2-b9dd-5313d81eb5f9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851423, "uuid": "737679b2-e6cf-436b-a6bb-98a121d3599b", "value": "BUMBLEBEE ZIP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc863394-a942-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647886490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886490, "uuid": "a85794eb-3b2e-4ef0-9cc5-729dd8cb70e9", "comment": "Malware payload (RedLineStealer)", "value": "0488ffd1627582cba0fde387224bd56a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886490, "uuid": "8798dd54-af95-425d-8d9c-4dae38fbe47b", "comment": "Malware payload (RedLineStealer)", "value": "200a437b2d155dd41388b86f7f12d6afdf42d090d34b99a65fbb52e43c491b40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886490, "uuid": "a251a636-b153-4e01-9a13-0be927e711ad", "comment": "Malware payload (RedLineStealer)", "value": "8bdc75cd072a033ae4a60eb65a3544bf6be51fd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886490, "uuid": "24a7c909-daa5-4bbd-a551-bb1858dc1cec", "comment": "Malware payload (RedLineStealer)", "value": "d7593a65fa6bcc575b72c0054a4a0ede2e8cfe8b644bba3ea3a0ca3bf7dbf3a61457592649f715cb4b5f01be46839eab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886490, "uuid": "85beccd8-3197-4e36-8abf-077247f55aed", "value": "T15575332AAD11DECCC14BF5BD1A663A57CA5EF025327DE053A60AE821068815FFBFC0D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886490, "uuid": "c5efc7fb-6f19-4f3f-a8c1-c7306720e10c", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886490, "uuid": "6bac9bd7-0dde-4d07-928b-a6aa25de451e", "value": "24576:WjL8fYlyGM7Lz6o4z49v1HfjoIm/zj5y36JfT2CEkzUrcPclGzOJDcHvPHLkXv1f:ktIzJ4z+0Im/zjG6RokzZclGzOJCH0vd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647886490, "uuid": "190aaf43-54e4-4bea-9695-d2ceb2bbd072", "value": 1560064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647886490, "uuid": "c8c576b4-c225-4949-a407-bad3ebc84454", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886490, "uuid": "25848052-7e90-4d19-9481-48ffcb18c263", "value": "SecuriteInfo.com.MemScan.Trojan.GenericKDZ.85144.21907.17606", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c2054f-a8f1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647851426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851426, "uuid": "54bcc6d6-dd3a-40c9-b916-93472425442b", "comment": "Malware payload", "value": "e114951c5607c67a80be82c980bd720e", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE ISO", "colour": "#AF335F", "exportable": true, "hide_tag": false }, { "name": "EXOTICLILY", "colour": "#D74DC5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851426, "uuid": "e34ede06-e9c1-4dcc-837b-7fbe00637453", "comment": "Malware payload", "value": "201c4d0070552d9dc06b76ee55479fc0a9dfacb6dbec6bbec5265e04644eebc9", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE ISO", "colour": "#AF335F", "exportable": true, "hide_tag": false }, { "name": "EXOTICLILY", "colour": "#D74DC5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851426, "uuid": "2a255710-6b1c-44fb-a192-d53e631c3cc0", "comment": "Malware payload", "value": "7b5a1cddc001844ef446d980813f0653659f850d", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE ISO", "colour": "#AF335F", "exportable": true, "hide_tag": false }, { "name": "EXOTICLILY", "colour": "#D74DC5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851426, "uuid": "f2a52bbf-210b-4c26-9e61-0d2ca553dff5", "comment": "Malware payload", "value": "43947bacfdef2c4da9d38ec72c5566bc66ac1cb5343b5f088de6e4097dfb185ae7429b52550d3f6a0c7be4d13b5342e2", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE ISO", "colour": "#AF335F", "exportable": true, "hide_tag": false }, { "name": "EXOTICLILY", "colour": "#D74DC5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851426, "uuid": "b20805a3-8ac2-4215-a897-8160a0a27249", "value": "T1EFB57C46E3A804E4D9B6C13CC9569607E7F2B81517709BDF0AA84AFA0F237D11EBE744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851426, "uuid": "f277b4e0-e3ed-441f-8589-f90b3c0a5a26", "value": "49152:EaLMh74dfw5MKWe6yXdVgfRY8igxZPqPGETlsE:OsfWltGf5Lxd1ESE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851426, "uuid": "2a359620-8bf7-4b71-ae53-5b7df66fa151", "value": 2306048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851426, "uuid": "d3ebf4ad-443c-463f-bf11-161221579cd6", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851426, "uuid": "f07e62a3-95cd-4688-8fbd-aceecf1894f1", "value": "BUMBLEBEE ISO (5).iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bc45e1c-a8f7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647854116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854116, "uuid": "fd1f1ddc-368e-453a-aaa8-7023c46e1b77", "comment": "Malware payload (Heodo)", "value": "8a8061d3be1c79aec4bb93bc87d9001d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854116, "uuid": "7ef49f6a-a9f3-402d-8c1f-52a94b047d6a", "comment": "Malware payload (Heodo)", "value": "20276a8a0fcec505acbb8add98707a7f295cfd6f809c5c3d405177f80a4ffc3e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854116, "uuid": "5ccb267e-1f1d-43d0-a3fd-a4b2c96b4136", "comment": "Malware payload (Heodo)", "value": "4624c4fcb74cf8693d9a5b3fc2c1e7aac2cb04fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854116, "uuid": "c56e588e-73e6-4c77-be01-9f0691a58ab5", "comment": "Malware payload (Heodo)", "value": "0550f9728482931495a36ba274c2e0969fb41374b50fde224576c815115baed34b0cf214fcbdf54884b4b39a632e1017", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854116, "uuid": "cfe74fca-7931-4b68-a29e-c13104800e6c", "value": "T113056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854116, "uuid": "d70c8409-33f4-428a-b52a-7d73eb7b482a", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854116, "uuid": "dc859bec-5fb1-45de-a234-96b6df5202d0", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/ra5CGNHrH2tZ+d+:gMV/ra5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647854116, "uuid": "f82836e9-813e-4003-b0b2-42880aaad2c7", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647854116, "uuid": "650d2340-a3b2-4703-b596-71a95eaeb700", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854116, "uuid": "43389667-82d0-486f-9ae9-3d4484ff31d8", "value": "8a8061d3be1c79aec4bb93bc87d9001d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb0eb5fa-a942-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647886461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886461, "uuid": "8896b1e0-b612-4bd2-90f6-e2b860bbc5df", "comment": "Malware payload (Formbook)", "value": "c7c54321a4861205970450bd59e92383", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886461, "uuid": "6ebcc135-dce8-48f0-a14a-4d857dc50185", "comment": "Malware payload (Formbook)", "value": "204dffabca2a13098479b2bbe04ffc4ed36e0281cf773ddf139e46d27b40e511", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886461, "uuid": "a82e15c4-b5e9-40fd-9d0b-7de6f071144b", "comment": "Malware payload (Formbook)", "value": "6f138b2d1628f8870bc98b689b724ee72e733efb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886461, "uuid": "fee51f51-a40e-42e7-9c46-4b22bdf50d04", "comment": "Malware payload (Formbook)", "value": "f9ecdb1755ab8724fdfcdb09388e20500bf90359370a5bf67b32e7ebc6ffd295ac4f9d4104073375ae05150690b007e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886461, "uuid": "24a652fb-1c17-46ca-b8e5-a62b07385899", "value": "T16C050D2A38BA100DB271AD6C6BBCB075911EF7F226365CBB0DF7054A11129F0CB9D627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886461, "uuid": "14884afa-464c-44f7-836b-531807896722", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886461, "uuid": "2a5646f0-9e6c-4fb0-9629-7db2cd8e7b20", "value": "12288:Fmh4J9EAXNRFkrYEID7STduSghxtH9Gr0UdSKhbXeU9ouJ91ds6xEkQiwZ7Zk:aIaKhceUJhJKZ7Zk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647886461, "uuid": "4f6dd99d-9ebb-4800-b182-689329ae3b85", "value": 823824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647886461, "uuid": "bdeb9d24-443f-49d9-848c-0b4486d8c91d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886461, "uuid": "4a07d2fb-1638-4d36-acda-24b02eb506e0", "value": "SecuriteInfo.com.Trojan.DownLoader44.46881.19475.2372", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e465084-a90e-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647863944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647863944, "uuid": "1b2418ce-7666-480b-96fc-6cda5e80cadf", "comment": "Malware payload (RedLineStealer)", "value": "0472cb466154aeb9b09fa9610dfc8c5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647863944, "uuid": "183c3cda-aa75-4875-87a9-b66d0cb457f6", "comment": "Malware payload (RedLineStealer)", "value": "20bee068041667d11cb6d455793ea644a7d9cfe9c85f152b5951a74394c847ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647863944, "uuid": "54c22871-5eea-4288-9577-cbce729184d1", "comment": "Malware payload (RedLineStealer)", "value": "a78720b52a15801629308c95a32425443b714c63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647863944, "uuid": "2c00dca9-3a37-4d51-8b3e-da6fcd00d868", "comment": "Malware payload (RedLineStealer)", "value": "b6f98f070115db08ae3a249d87cce4a5802ede0aeb86d75b88a519b3e1e40839a115f5d68dc9ae0d1e11621ba16398a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647863944, "uuid": "b9ec0f72-1c04-40f9-817b-1af4f42207bf", "value": "T1D6A423843B8EF55DF4B41FF2EE6DED4BC5A6214330D1948A96CC3B9A28484747BD418D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647863944, "uuid": "7795db3d-58ac-47dd-926c-8f711298de6b", "value": "bb33ebb01e5d6712ef0952d04547004e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647863944, "uuid": "a0f7ff7a-6a17-4673-91b0-aa35ad081a65", "value": "12288:J2GRsoTrADHtQvGovkIUgXK/lGRgOUqmq9kR6lhKXXB3a9FsqJKB57d8fG:4GRsoT3eovkIVK/cRgOnmq9g6KB36rKJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647863944, "uuid": "66f5e897-f27f-4baa-bb8c-15c32004061c", "value": 455680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647863944, "uuid": "4ca5cd8b-095c-43b8-874f-301ef33e6c78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647863944, "uuid": "b52e99b2-cfaf-4622-b7c9-2eb1740ab8ec", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41764b9c-a919-11ec-9275-42010a9c0029", "comment": "Malware payload (LimeRAT)", "timestamp": 1647868647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647868647, "uuid": "c6b1616d-455a-42b6-b96e-48f9ff337717", "comment": "Malware payload (LimeRAT)", "value": "3d7801d573cab12f3093c219ebfe495c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647868647, "uuid": "e3df1076-f01e-4709-a9a6-547a3e2d11db", "comment": "Malware payload (LimeRAT)", "value": "21b86512de83574c3ad44210d025e93fb28d205cfbd18825da0a64a52063b627", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647868647, "uuid": "5dc23b7e-392c-47bf-b368-06e3df4ba0ee", "comment": "Malware payload (LimeRAT)", "value": "e1ad7be4ba84e44e4ee4339232b984d29c1328d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647868647, "uuid": "48d8a260-525e-4b3c-b0ed-d19161a37a8f", "comment": "Malware payload (LimeRAT)", "value": "569712e55de558ac781df806f748450c025442346aea8ecceb8a09b79f339c9094534347a5d378cd41c3e8f64a45762c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647868647, "uuid": "832e553d-0888-4b73-9201-c2c1b8945322", "value": "T1AFD27F047BE19345D2DC1AB50FB122590F70DB0BE93BFB6D0CC950931A6BED58A94BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647868647, "uuid": "09d6d4f7-770c-4316-9faf-3cbe9a09f0a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647868647, "uuid": "3774d886-9ab9-448b-813a-a3a904ce61d4", "value": "384:cB+Sbj6NKom4r+65xAH6kgvqDc0gpEkvDKNrCeJE3WNgP0bVjeNwsN4jhxUQro3C:6pomn65xw6p0gpEK45N62YNw44VxWij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647868647, "uuid": "04a01552-c195-4482-8e73-0ae7f0ca1226", "value": 29184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647868647, "uuid": "62b941e6-6c36-4667-b046-03fd40365f43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647868647, "uuid": "b83812b3-bac5-4572-a71e-77da4d328a53", "value": "21b86512de83574c3ad44210d025e93fb28d205cfbd18.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f237b709-a8eb-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647849187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849187, "uuid": "af31ca07-d1bd-4924-971e-65dd28dc90b3", "comment": "Malware payload (Formbook)", "value": "d2443a5d72c8b65ce139d9944143ee9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849187, "uuid": "026c1c84-687b-4f31-ba2e-2c377126aa86", "comment": "Malware payload (Formbook)", "value": "2217ef18ea04be3cbd80595523b4a6c615107fd51f10ea20193e523fe4a8f09c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849187, "uuid": "d0994726-9e1f-4f0f-a7f9-1cd0ca17cb9e", "comment": "Malware payload (Formbook)", "value": "fb2e80fcfaa47dfd1cb1064605cfd4835e1ba2ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849187, "uuid": "4e762280-0a9d-47c8-8d37-ba64467f30dc", "comment": "Malware payload (Formbook)", "value": "d94985197f441e2c23c2ba832ea3a97fc7abd25e3bf1715ec130c5ea83e62bf35f8b5dcc92bf6cb465c4b2f8f3480d40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849187, "uuid": "d46f097e-6cae-4fea-b415-d40ae19be331", "value": "T145F418BD715472FFC837C1728A945C64F650A8EB630B4907A4971B9A9D0F4CBEF840BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849187, "uuid": "a55143be-dbdb-485c-bdcc-660821a27553", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849187, "uuid": "7bd30ce9-ea90-40c8-8954-d24239ca9a34", "value": "12288:XwFUc4pY3uFecIEf6zUHXdx1Hu53lzPRHoZTK0864VqnZgxYu8o1LE8pH7J:XlpYXVo2iu8IXpH9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647849187, "uuid": "ae0cd11d-0816-4262-a594-7576688e829b", "value": 780800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647849187, "uuid": "81745cb3-2d10-407e-ae50-593543e31a5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849187, "uuid": "95eabfb8-aff3-43f8-906a-b4873a8f3d05", "value": "MEDUAE670644.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77520ed9-a8c9-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647834378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647834378, "uuid": "52e62e62-fa27-4fd5-91c6-2069aff84851", "comment": "Malware payload (Loki)", "value": "cdfeb611a4f3e0b03d56a0d2e817a0d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647834378, "uuid": "c4d2bcc6-2641-4f62-a0c5-d9c25c417579", "comment": "Malware payload (Loki)", "value": "22807edc148ade343f81ef67ef2c0d19124b038f54474ec083b5f8f7883330e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647834378, "uuid": "ffe7076b-ee58-4d1d-b6a6-8eca20098302", "comment": "Malware payload (Loki)", "value": "c494ac741b979ba551346a1e0ba9990dbd0bb4d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647834378, "uuid": "55995110-59f7-47fa-b895-4c0f1923e9d9", "comment": "Malware payload (Loki)", "value": "5025b80dc2d5234aa721a3dc2b391eb8474e6acd8373e23ad70a1a8242de6a80232e4674e1badabb9f215ff2dc92d395", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647834378, "uuid": "53a80415-d765-43a2-a7c4-d22b6d6517b0", "value": "T19394AE91504040F6FBE23B769BA5DA72874BBCB9A894415F0BD53D93B7BF08304F294A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647834378, "uuid": "7dd9eb3b-e07e-49c3-874b-7a9dc06646d3", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647834378, "uuid": "283ab524-4299-4aac-b25e-db478997922f", "value": "6144:uGi6/j0wZipuGkFylF7jtKms+SFQJaKuBm+Z1JTxsppP:rLNZiYGkUF/stFZKuBXJTad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647834378, "uuid": "38aaf8c9-f3eb-45bc-aab0-fb06aa4c2fd6", "value": 423450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647834378, "uuid": "0e45dbcf-d3a9-4e4b-8ec1-469292cc2e98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647834378, "uuid": "58fe0a59-9b7e-4a4c-aba9-ccb97d9b502d", "value": "order inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "949e70a1-a8b3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647824978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647824978, "uuid": "19994057-758b-4ad1-b023-dab8ace2415e", "comment": "Malware payload (Heodo)", "value": "8ba9af442da8305719a63a6d2e8ad084", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647824978, "uuid": "4fc01db3-24e8-4094-a041-cf4409cbfcbd", "comment": "Malware payload (Heodo)", "value": "22d87204e8cfd7e919d7a7390c38f4c814d2f3b344ab4dd70b0c28b96e31cab1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647824978, "uuid": "ed194e55-abc7-43e3-b814-ca05874d616a", "comment": "Malware payload (Heodo)", "value": "52ca57e7629ad6df050f21e528fce995496a6ce9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647824978, "uuid": "b068ced2-9d73-4b10-9d89-a7afb47eeed7", "comment": "Malware payload (Heodo)", "value": "f89e821f5258e8f2ab16b6fc77b534c839213f971e79edc92135371030e5ed7fcb938cecd39c581a66acec1f0095076a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647824978, "uuid": "4389b2df-e390-4e16-9f73-57529b9eaaf1", "value": "T14BB43A317492B279C2EBD73408A35275B21AEDF157E274E36EE707CC4B366906E72602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647824978, "uuid": "e9b16e80-2fad-4393-8242-cb6975de728e", "value": "55cf9ae1e74cef637eafd17181390202", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647824978, "uuid": "13997216-7be0-4cc6-a889-0d6e0e4a7a51", "value": "12288:7FFCpYDLbBHqKK85H3jh2VlMD4zeSvturG9+:7VDLbQKiVlMDOtv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647824978, "uuid": "9123ff64-6531-44d9-badd-bd39fb69d689", "value": 516096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647824978, "uuid": "3ebc8a42-15bc-4f40-b8c6-91288e52538b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647824978, "uuid": "89217ab5-3d8e-4fcb-a329-e13cb24dd694", "value": "8ba9af442da8305719a63a6d2e8ad084", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d004f516-a8e6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647846982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846982, "uuid": "163cecc2-952e-4ac8-8344-3ce4368844c1", "comment": "Malware payload (Heodo)", "value": "3efeadf3863407f49f3a8f2135ea0743", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846982, "uuid": "78b8e76c-5c73-43f4-be09-ccf4e4c66f2e", "comment": "Malware payload (Heodo)", "value": "230a88cb551c7811a24923830d72c0db4fb93fe7b53cabd532148cd184419d83", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846982, "uuid": "a2b1c64d-1ae5-4115-924e-8227dcc2612e", "comment": "Malware payload (Heodo)", "value": "b103b25753a6f91eb123c6729642a01bc7d0882c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846982, "uuid": "bb07edbe-2134-46a4-87d3-263417692dfd", "comment": "Malware payload (Heodo)", "value": "de941826a063d6e2f7bb739e09e83217d6134be4b6064d054fd197a94d8eeb9b7a4a9f8c5fc9b0219a6d3447876d86a6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846982, "uuid": "ee930744-7491-4f74-bbeb-acd659bd95a0", "value": "T1D903AF30F2928B99E13A947C478CE9F583288B165141BF2C309563AC5F536B67F8E24D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846982, "uuid": "2d59272e-4a87-4cb3-af07-fa281d8a3151", "value": "768:2bdpCR8kjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooFVIyYS:uwDOZZ1ZYpoQ/pMAeVIyYzaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647846982, "uuid": "ab08727f-fcdd-4739-a196-0d5cd193e413", "value": 39713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647846982, "uuid": "7afa75f2-e268-432c-8dad-b7e6843200f8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846982, "uuid": "5c31007c-8a5d-4d7e-a937-50d1f54d2f9f", "value": "1004604111674917939212.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "930739fa-a8c3-11ec-9275-42010a9c0029", "comment": "Malware payload (TrickBot)", "timestamp": 1647831848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647831848, "uuid": "3dc02249-3f18-499a-a681-c2988b8b5780", "comment": "Malware payload (TrickBot)", "value": "e05d85acc62b2795bfb94a681e64e20f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647831848, "uuid": "58ede82f-2044-4fee-bdb1-61676a1e1ad9", "comment": "Malware payload (TrickBot)", "value": "236f4e149402cba69141e6055a113a68f2bd86539365210afb9861f4e2d3ad5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647831848, "uuid": "0eae5251-ff1c-4d1b-8220-58a5e004363b", "comment": "Malware payload (TrickBot)", "value": "7cb195e05a78a39cacb0c0d4d4fa23e4c3366785", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647831848, "uuid": "deb8a54f-932c-4221-9ff5-d7e71ee565e7", "comment": "Malware payload (TrickBot)", "value": "8bfe50bdbc0e728854537a7cb921898c5519774a486c96b146a60d4e15feec7df1e83c23482c7a29637b24556c9d5e8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647831848, "uuid": "6143478d-4fce-4452-9e08-21ef51824c3d", "value": "T1D814021AEFBD04A7F045A57BA02B0A4D887B790247DE2863566B2CFA60713ECC0FD557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647831848, "uuid": "133d03be-01cd-4a11-9f44-2db8dd5b4aea", "value": "cc031e3bfe0d9f81b846819826c1b0a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647831848, "uuid": "d8dcc919-f044-40f9-b8de-ddfd82a5254b", "value": "6144:2LMNe5kFT/RK1WoJg4ouLl2pFUBm5iKsTFxcW3Qt07kjnnnnM:2LMMktpUWoJg4ouLsFUICcYQmkjnnnnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647831848, "uuid": "cc3ee2d0-6cf7-4939-9a2b-de1ea6af2b11", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647831848, "uuid": "98d593b9-9fdf-48a1-a05d-10e38e98e617", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647831848, "uuid": "20f98edc-8f92-47e5-9683-1a144167d0ff", "value": "sample2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25bb1ae1-a8f0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647850992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850992, "uuid": "445d4513-013a-4f4f-ae55-4b51a2a4c650", "comment": "Malware payload (Heodo)", "value": "f9534a04f6032b55cf1a12e7cac35cd3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850992, "uuid": "22cb22a7-75b4-457f-8721-6857d356fbb3", "comment": "Malware payload (Heodo)", "value": "241ef83281bdd368adf5879084b6e8c11c7f3e6c6e07298a1173d8bee72d1287", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850992, "uuid": "6977356b-112a-482f-97c9-bdbfa25afb75", "comment": "Malware payload (Heodo)", "value": "b9375dd954fe0400c8c52ab06cf121ad828f3512", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850992, "uuid": "43b81f5a-d20a-42a5-a13b-343d6417cd59", "comment": "Malware payload (Heodo)", "value": "a650079b72316aa8604c53f5cd4e87dd367283e229678cb863f5111afc50b63790ebd75fb59c446a2c520d539e559da1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850992, "uuid": "da51b393-2522-41c5-a81a-f3933f7ac184", "value": "T15B056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850992, "uuid": "6c34fb8f-624a-4900-bfc3-2257e8c2165c", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850992, "uuid": "6a8f47eb-14c4-49c6-915f-2e542da583e9", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rx5CGNHrH2tZ+d+:gMV/rx5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647850992, "uuid": "5deb0d1f-7d36-40b1-a173-77ed7254ae06", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647850992, "uuid": "16478cb8-9a95-4490-9099-bfdef18230e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850992, "uuid": "34fb3b5c-5030-47d8-a0a7-5f4803aa7b13", "value": "f9534a04f6032b55cf1a12e7cac35cd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08be4fc9-a8ef-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647850513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850513, "uuid": "c28f00f3-ea6f-46ea-90b8-616110fcd47e", "comment": "Malware payload", "value": "eb2f70ab4786e16304719d660e661acc", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850513, "uuid": "8d87777e-e2eb-4207-8532-91a8095820d6", "comment": "Malware payload", "value": "24340ec6d97344ec785f64adff2c14dd20c417aeffaf7e5cbd76ad26d1d2bee2", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850513, "uuid": "790adb56-b73b-44bc-ba2d-573117a8f7bd", "comment": "Malware payload", "value": "5e03059eb57988ccba7e9c59703684112e83de36", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850513, "uuid": "7ef47ecd-f646-41fd-b722-0b33fc486701", "comment": "Malware payload", "value": "e615141b1c2dff25b4bbc8aecffe0e26f8e5b2e3ae9b9629e3b9cf7b9993f8353cae58a8639fa76049a2d1c68f50256a", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850513, "uuid": "3a92f564-1abe-4671-b8c9-4af5a1fa726a", "value": "T169710AA0A9712805FD9511CA4DB2F89402FB75E651EA51A53ACCFED203F1332AE2A489", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850513, "uuid": "200e16a1-0f41-41f3-be06-a9349e32a810", "value": "96:emMtLXlGd+TYDqx5HyC8WA4HN0G3DNfZD:nM1lGUTYDqx5SJC53Zfp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647850513, "uuid": "017873a5-2db4-47fe-868d-2ef5ce513f28", "value": 3504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647850513, "uuid": "5d99eedd-8531-49d6-8681-d0697e69b7e7", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850513, "uuid": "33d4a6d9-8141-49bb-8af5-4f9b7def61ce", "value": "MFEHEAVY OIL113-B-2022 IL - REQUEST FOR QUOTATION FOR REQUIREMENT OF SS TUBE FITTING FOR UN HO SATE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6542cd5c-a930-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647878586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878586, "uuid": "b883cc94-2b31-46ad-ab57-2167b3f0cd54", "comment": "Malware payload (Formbook)", "value": "5fc337cf254ae511d80a7aec1166156b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878586, "uuid": "9b7dd8a2-8c72-4cb3-96a3-6ba96d6314c4", "comment": "Malware payload (Formbook)", "value": "2490739f099721ae8d0aee87124a5e7b8acaf106d1f6c5a330802111d924a409", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878586, "uuid": "6bc8cea2-af0b-424e-9dc1-8936ca20e53c", "comment": "Malware payload (Formbook)", "value": "c04d2b61cead6a151136c5265c6df1831c3ac512", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878586, "uuid": "90cbe0e6-33eb-43cc-8851-353dc3ca797c", "comment": "Malware payload (Formbook)", "value": "325316239389eefbe951046a489707dff778086da68f06cca1db7026ebec036752535e5c77ed92259dea8e33bda2bc78", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878586, "uuid": "1c873fec-56e8-438b-8908-1ebd1725485f", "value": "T1632533C5B85CF6C2F2F11A31D212555875F4CD60256EE982B82A3E94F0E06C7CA2DB9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878586, "uuid": "f695eb28-646f-431e-ade9-ecba6540b666", "value": "24576:NFhzBRM1c4ipCz9PcVfoZ/Alhw8yqUqL/yrcAtAJyKibob:NFhlRMW4ipESaojeJrcAOyob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647878586, "uuid": "09457485-b315-455e-845a-80a9ba82a65d", "value": 993685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647878586, "uuid": "f6d4790c-9a43-4e5d-b0b9-6c4ebee0bd30", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878586, "uuid": "32401a37-c1dc-43c7-a943-7148dea97c7e", "value": "Telex release.r09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04c8159b-a900-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647857808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857808, "uuid": "ca125aad-bc33-4225-b4d8-044b0b23c5f9", "comment": "Malware payload (AgentTesla)", "value": "96667ba436a14642962f0a86cc99b2d8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857808, "uuid": "752a17cd-9b61-4173-9daf-e7fa15da8a8e", "comment": "Malware payload (AgentTesla)", "value": "259d1d763c82d506eae39f171eaff8037ac33e5f329b6a546b667734351f068f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857808, "uuid": "5b0fb0f0-ccab-45fe-863b-5818cf4ed647", "comment": "Malware payload (AgentTesla)", "value": "4614193dd013c1386e39d5211765efd8aa30f664", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857808, "uuid": "47e33ea7-140a-4aaa-95c0-b0409c559387", "comment": "Malware payload (AgentTesla)", "value": "71324c5baaf1d8f40b8f952e8831804a0093bc8e593b3a48a50b8668d3734aef72c555226ebd8341c02d501cf5d18726", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857808, "uuid": "17d32636-cc9f-497b-8a9b-b71d320d124c", "value": "T1E634F94334808598CE7D55F6B2178184339ADDBFD658A60C7BC873A35FF2AA20936B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857808, "uuid": "7d992f93-5b75-4903-9ce0-3b9ab34aad72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857808, "uuid": "ab4b456a-be8b-49e6-8942-2b5b57a6316a", "value": "3072:/jX2qCu5Z6ZWaNlMMdG4UG/A2dedGTJ/7kYmwpWU7/3lLTqKnoBojS+:iq+RHMAIGI2pjkYNJVqKoBo2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647857808, "uuid": "c30849c3-5a30-480c-9df3-2192b6bfc2ca", "value": 241152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647857808, "uuid": "f7ab26bf-9c99-4f41-9d27-b7336ea6670e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857808, "uuid": "dab6eff6-baae-49b2-aaba-59eae3305da4", "value": "TT Payment Form.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88a2961d-a901-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647858459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647858459, "uuid": "67613989-3161-4e2a-9c06-e2acb23b1e34", "comment": "Malware payload (Heodo)", "value": "b6fce583132b27869c849302ba8cdff7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647858459, "uuid": "0e77e23b-c256-409e-95ab-ba08d85e5bde", "comment": "Malware payload (Heodo)", "value": "2658f73fa196637e86b40db85fd224cba389ae6cb6dbe3507d42a7f6ac8c2e87", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647858459, "uuid": "dcaebd36-8453-4429-abaa-87f98f9b269a", "comment": "Malware payload (Heodo)", "value": "e4904cec210ccf4e9f9bee5302fe2cc60e826d0c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647858459, "uuid": "4c6a3c74-c7c1-414d-912c-bf464b8121b5", "comment": "Malware payload (Heodo)", "value": "b271c818871a507a8106b035ad8f300d40b8e2f7f6e7c63b600e8ae7576cf5c2eda4854fef2caf8edb0ed347f45d057f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647858459, "uuid": "c3c7670e-634d-4138-9bf1-799ab657e87f", "value": "T1CF056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647858459, "uuid": "c8db7b8c-da3c-484b-bbb1-b386657804ad", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647858459, "uuid": "d960c1d7-fac4-4e0f-bb7e-03541e789c2e", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rz5CGNHrH2tZ+d+:gMV/rz5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647858459, "uuid": "24fcc0ca-7194-4f54-9aba-9835aa7bd381", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647858459, "uuid": "8aae3507-6896-4518-93d8-affbf446fad1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647858459, "uuid": "b47a5d9a-20a9-44e5-9980-bc21df992a71", "value": "yl1lhSB3EIUdN.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b86a4de3-a947-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647888604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888604, "uuid": "38705c82-f914-4372-ae8f-1b695e830fe0", "comment": "Malware payload (Mirai)", "value": "233dd9c42426194c7a8ebfc5fa503599", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888604, "uuid": "38123a6d-f7c4-4016-a160-10cfad6a7845", "comment": "Malware payload (Mirai)", "value": "2692436237eff89f1c66524b05786300fb065b385460b073ca961a96776ec660", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888604, "uuid": "a320713b-a351-4e6e-af0b-ac866b34734f", "comment": "Malware payload (Mirai)", "value": "651b3d0a689d0ec38a9d24368b5d75b84852c1c9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888604, "uuid": "35c93197-6ac9-4e98-8718-19b2904f8363", "comment": "Malware payload (Mirai)", "value": "4def521f31c040638118dd28bb8c57379749fc25b08b780d51a94f7d1557defbcbc282c3f01247e2cc747769e8e0d8d4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888604, "uuid": "4727c1e8-2b7c-4568-99e7-71e7c19044e2", "value": "T15BB3190CEB505B1BC1E52BBBFA9B424E33278B54B39B331A462857F43FC6B694E21505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888604, "uuid": "c576c0f8-e81f-40ec-a1a4-04e421593a9e", "value": "1536:e9nTIp7PwbcINqDv1WPCEIjyMr2gNlTyli2W4R4Y/U03xGupAzw/9kNDT2U0Rc:SM7DAPCEIjyjW4D/U038uqM/9kFES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647888604, "uuid": "4e278ddd-0e6a-4dea-a0e3-b6dbb3609c2b", "value": 115944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647888604, "uuid": "e2867992-7593-4338-b895-102641df3813", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888604, "uuid": "52ecc882-1b1c-4196-b285-7d2dbcb87c28", "value": "daddyl33t.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8769185-a90f-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647864525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864525, "uuid": "7aa67ea0-c44d-47ce-b767-4252326260a3", "comment": "Malware payload (AgentTesla)", "value": "249d899d46f215b43309a157c7fa4a55", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864525, "uuid": "eb5b1a9c-22ac-47ce-b693-317d1713a5b1", "comment": "Malware payload (AgentTesla)", "value": "26ae428ade2091572a059cfbd71f0388372d6d5ff353dc6378af7f7183f94f80", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864525, "uuid": "f8b276a9-2aba-45e5-84f5-b0a76ba1507e", "comment": "Malware payload (AgentTesla)", "value": "504d933d1b11a8a816e889541dd6083ea4b4fe73", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864525, "uuid": "f2db4d34-454c-41a2-9a48-d7c9bfa75894", "comment": "Malware payload (AgentTesla)", "value": "065db790a7869f35354d9e2295deea650ee19444fe75a7277b1b84842e6ea1c786b0accf5f6c3e9a0635fcd054500c15", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864525, "uuid": "2a968767-7017-470c-930e-c0a01e4b8938", "value": "T14F353310503EAEE29103EC0E5DAC3CB20DCED73ECA8A55546A9D66874FE8BF05D76D40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864525, "uuid": "459ca73e-2345-4692-9dd8-56fae639a763", "value": "24576:MXQs8CSJa5ox2nv+9/xhxLfqYKpkwR+OfNFbKpA3vStKLh04u:WiCSJL24xvLfqYKiwDBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647864525, "uuid": "d4e484b7-bdf6-421e-99a7-94319efac491", "value": 1075388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647864525, "uuid": "3447cdcd-5d59-4654-b919-2c670b96d2d1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864525, "uuid": "5bd8ad62-1abf-4825-beba-59fe8afdec5f", "value": "FEDEX Online Customer Advisory AWB, BL Draft Commercial. Invoice 202005173534231972.pdf.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cd9bd36-a8f3-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1647852480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852480, "uuid": "2831118f-c170-4c17-9880-51c53ece53d4", "comment": "Malware payload (NanoCore)", "value": "d3df0c9afe4380739abe00dccf6ab981", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852480, "uuid": "755911bc-8866-455f-aaca-869448d4cc02", "comment": "Malware payload (NanoCore)", "value": "26f8a7457f1ad915af8cf0f2e5fb746ea6b685dd0e1ef6b63c87a72a0e70632b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852480, "uuid": "7633cf89-5f0f-4588-a235-761741c7e21e", "comment": "Malware payload (NanoCore)", "value": "a5840f9fd001ab1fa59260d24a3e35693c13eb77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852480, "uuid": "35887849-6c13-40c1-9d8a-77f81f0305d4", "comment": "Malware payload (NanoCore)", "value": "54f74eb6925aa41602697c8c22e78ef4b4da9c9a105953330d39d5bbe5ad8daf80139145dc6acb3c2d1ec41ae7ec56f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852480, "uuid": "0e5f3611-18a9-470b-98eb-256170e6b58d", "value": "T14445F1213F84DE11E1A96937CDEF510407F4BC95ACA3E32B79A9336D08213A16D85B9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852480, "uuid": "e04b2c4f-f1df-404a-83b9-6f2b61b5df78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852480, "uuid": "0aa1240c-da3f-42f2-8332-28d0570d3fd0", "value": "24576:JRBhK8TZQt9ce0Q/Z7ASOHDwwqXT0xkgih/F3N0la:JRBhK89QX4Q/pVOHDKakxVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647852480, "uuid": "b8debad1-e1be-420d-af08-24f2e3f20d6e", "value": 1248256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647852480, "uuid": "43ef5570-e89d-4e4a-be80-cd5e8b8ad422", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852480, "uuid": "b4939a1c-29fd-4a82-be81-90f8fe96b4bb", "value": "d3df0c9afe4380739abe00dccf6ab981.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f6794a3-a943-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1647886629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886629, "uuid": "c24afb71-b591-4fe5-ad03-3460d3e60d3b", "comment": "Malware payload (DCRat)", "value": "89e4850d8cbbb52b9504a193b69bdc14", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886629, "uuid": "690c7c06-608a-41ae-9188-f6ed7adcf214", "comment": "Malware payload (DCRat)", "value": "270910ef8db32845dcf2f0059a6c8391f8cfd11feb207438efef55f1b642f802", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886629, "uuid": "512eb1c2-9c2b-41b8-867f-2dd6d4e3b67f", "comment": "Malware payload (DCRat)", "value": "35a374ea494e6e88c9a6aa47eee9d600b59c7bba", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886629, "uuid": "f49c2a69-ec4f-4cfe-9792-e1036b75957b", "comment": "Malware payload (DCRat)", "value": "a0a9381aca056b96247d9d0a0529531ba9fb6e9cada66abd4a22e94b17128d4a2a403a056a93c6d1cd9cd48dc514760c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886629, "uuid": "e6ca1ae9-f196-4834-bc53-a14d2e1e4638", "value": "T152A5332F5C879D81DDCB55B243164609B9493E03B9B3285F3B1FAC729A74242CAB3CD9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886629, "uuid": "f6825e22-2f50-4cef-915f-6431a7940d89", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886629, "uuid": "fc989efd-7aab-4726-b225-3953f855a446", "value": "49152:RBSV4wI++arH+fxU2Eui1LFz1GMl83YvCaKcSBG:eDI++aruxU2EpLB1Gn3YNCBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647886629, "uuid": "4b72ae0f-5cae-41b5-9b17-a52b70263dee", "value": 2107904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647886629, "uuid": "c765fa02-e277-44b6-98d3-ddf73f1ec651", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886629, "uuid": "13295846-54fc-4851-850d-a647f1230a1a", "value": "SecuriteInfo.com.Trojan.PasswordStealer.GenericKDS.39246248.31998.12145", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eef4068e-a8fe-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647857342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857342, "uuid": "563cfda3-ec32-4e9e-811b-daf9c27a9b81", "comment": "Malware payload (SnakeKeylogger)", "value": "7acd3c4a0896d88d262d58e2caf14f1b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857342, "uuid": "56c7ef24-07e1-4690-9238-dba723646fe6", "comment": "Malware payload (SnakeKeylogger)", "value": "2744da869c269bae050887880da11eb8d150bc97ce72f842032a013774beaa61", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857342, "uuid": "946ecab0-1eae-4e99-b8a1-11c01c884978", "comment": "Malware payload (SnakeKeylogger)", "value": "2e335c26d71b5fb2f94dad9611c5ebe0a66737df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857342, "uuid": "2a0ecdbf-3792-4b3c-ac29-bcc204dbd5e3", "comment": "Malware payload (SnakeKeylogger)", "value": "1ab48c747a44b6bf0e4b7d6a295f8048a8467167aab38332b68271d10ac7fe18868580f8171c7d418e9fb6ddc73101e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857342, "uuid": "9bcf1382-3e64-429d-bfbe-f7eb4f12b65b", "value": "T1126533F408AD15A8DED2EBF239B82FEB4E3027F4D60B7595A7AD02DC8D7C9515281831", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857342, "uuid": "5d6ec924-caa2-41c8-b289-ca7ff7454d40", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857342, "uuid": "1a104ed0-d893-4917-870d-e60deca70af8", "value": "24576:AYbucsqPvrE5RBUmnOBZX2xQDHJyesxWLJMrxhG2Ky8yasY8EwldVL4ethiYEb:TrsqPzKpO+QDHJZEUJaxcsFRY8JL49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647857342, "uuid": "81756d24-bf7f-44f5-bff5-5ff6989745db", "value": 1532928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647857342, "uuid": "e261c5d5-22fa-4411-beb8-34f589191258", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857342, "uuid": "8bdece5b-c9ad-45b7-9f19-23fbcde45b90", "value": "7acd3c4a0896d88d262d58e2caf14f1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c835893-a90a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647862331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647862331, "uuid": "11b0ca8c-a0d9-4e75-a102-5400e8b117da", "comment": "Malware payload (Heodo)", "value": "07fe516615d0a52c26d8877787e58b7c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647862331, "uuid": "48206660-991b-4eb9-b309-1c9f95dbac4e", "comment": "Malware payload (Heodo)", "value": "28205a4d8eedf220cc6eb85712f891ed79210f002939feee6f9be51cfcb5a0f4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647862331, "uuid": "1235f42b-46e8-40b1-a17c-bc17207e698a", "comment": "Malware payload (Heodo)", "value": "f9e00605583194391bcb7ab93cea5bca1cf5b9fb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647862331, "uuid": "4634f817-e546-449b-8235-c58b4171a4de", "comment": "Malware payload (Heodo)", "value": "f7a2c1840ec42325d2c05c7a29cba6b99d39b51925b8ecc590598b3e071e387b4b29d83ab18bc74612255c145d8d1b85", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647862331, "uuid": "1f352e9a-b64f-4714-9429-87bbf246cdef", "value": "T195056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647862331, "uuid": "5f7afd13-25e3-472c-ba5e-46562136675f", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647862331, "uuid": "c7b6f1f7-e47e-4614-9057-5b0fd3c75062", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rY5CGNHrH2tZ+d+:gMV/rY5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647862331, "uuid": "f027bf7c-b894-4eee-8c00-d2c0407bda35", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647862331, "uuid": "c0ef3da8-8655-45f5-b59b-bf4c4aca3eb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647862331, "uuid": "7fd60478-cf88-469d-be7e-825769670f4b", "value": "ooy5UNwUK6J.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b2bf0c-a923-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647873059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647873059, "uuid": "6d6eed6f-122c-4bf2-a877-f985032378f7", "comment": "Malware payload (Heodo)", "value": "2e22221b50c1a0ed197224f58ac6bec1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647873059, "uuid": "98fb9e9f-c943-480b-9263-54c822c7c4b2", "comment": "Malware payload (Heodo)", "value": "283a631afb1577a9f72f1f8f5d82c3e081c8c24bd9d1b98e7b4a3699997ad8ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647873059, "uuid": "af8ccf07-5b2c-4dff-b71a-3259049448c5", "comment": "Malware payload (Heodo)", "value": "c2ca85a91d063f18cab022fbf376b69e82e616ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647873059, "uuid": "6bae50e6-6039-4297-ba61-2e38e4ee0501", "comment": "Malware payload (Heodo)", "value": "7d8b1b86e5ea02fa2545ad31202d3183d98e11377e77428b7c4036bede16b4f26454a08638aea3e4ebc49393e82dd5b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647873059, "uuid": "1958a051-4a93-4b02-829f-f8f43d4fe536", "value": "T10E056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647873059, "uuid": "76e546d7-a99b-44cc-88d8-7d37481cfab8", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647873059, "uuid": "e1d57e73-c71d-430c-ac86-c689b9a047f3", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/r25CGNHrH2tZ+d+:gMV/r25tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647873059, "uuid": "09c7f818-0daa-4ad3-b4ab-660af2612d5c", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647873059, "uuid": "8c81a0a9-0465-4486-8b95-736262605d61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647873059, "uuid": "3df3aca9-661e-4608-b831-4d99b05fadb9", "value": "2e22221b50c1a0ed197224f58ac6bec1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdcb10bd-a8e3-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647845771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845771, "uuid": "c06d3d1c-71ea-470a-99bf-9032864408b9", "comment": "Malware payload (RedLineStealer)", "value": "705de172e4412f481ae85622d24290b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845771, "uuid": "e842a60d-e222-4fbf-8e68-2d9b71da4a1b", "comment": "Malware payload (RedLineStealer)", "value": "28902b108407a692e9d7f7dc11ce8097eaf0fa3994dafafacdca382d47f0046d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845771, "uuid": "fa694a1a-84e3-4ec8-893c-9328ec627b85", "comment": "Malware payload (RedLineStealer)", "value": "ef80791967320519eb242971c7137a4b536ecb53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845771, "uuid": "b2b2a3dc-e973-4efd-bfb9-5799cd848d6a", "comment": "Malware payload (RedLineStealer)", "value": "9ff9b5bd31b752dc1b1224c5bfa788bd4935c5b35aeb38a512f10959c9672b7e1fce6a3e3e5292b75c56c65e179301c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845771, "uuid": "df48ca11-2919-41fb-bbd5-fd7a9d9f03ca", "value": "T1E194CF40B7A0D03DF1B712F4797993ADA42E3AA15B6051CF22D62AEF25346E0ECB4357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845771, "uuid": "40ebeb91-06f5-4481-8e50-b6573d81d8cf", "value": "30c85236402d607ec86afd7c1aadbde2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845771, "uuid": "93fbbd5a-788f-4a56-8202-49946e0ac1af", "value": "12288:cygoj1nFmw26eZOt5esPYA0CU0O2tAh4:Fn1Fj2MDl6CAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647845771, "uuid": "55c7da6e-d2f5-46de-9bfa-b8ec97be56c4", "value": 417280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647845771, "uuid": "acb68e13-5625-406e-90b6-1239007fab1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845771, "uuid": "4cfcf2a8-e8eb-4851-9245-6c4cf2276975", "value": "705de172e4412f481ae85622d24290b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d4c047-a8f4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647852970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852970, "uuid": "d6c4dc7c-a839-4360-8e6a-20d284d3b6c7", "comment": "Malware payload (Heodo)", "value": "a4577017f9e898a43ad485de3d24930a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852970, "uuid": "796633a1-9f10-4203-ab88-7b855ad44075", "comment": "Malware payload (Heodo)", "value": "293e32c35deb0282636151de3d654253ee0eaaa62a0d45dc6ae0c5bf8efb5980", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852970, "uuid": "2237f00e-04a2-4cf3-bcc3-422ca5bb53dc", "comment": "Malware payload (Heodo)", "value": "b1c8c49b50a45c576f6dbcb511118f6cd559cc96", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852970, "uuid": "5771ca51-25ad-4ea9-8e2e-fbcfaf3ac8a8", "comment": "Malware payload (Heodo)", "value": "a4271ef91fe242328714e0727a133611c60cd4bc487f4228ccb37c8cee5f5468f6c08c1f0d9dfb40df2cdea5bd4e2c83", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852970, "uuid": "0981a070-b820-4402-ab9b-538efb8a164f", "value": "T15C03AF30F2928B99E13A947C478CE9F583288B165141BF2C309563AC5F536B67F8E24D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852970, "uuid": "2b057322-3f58-44a0-bc74-6509c5fd79a2", "value": "768:GbdpCR8kjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooFVIyYS:ewDOZZ1ZYpoQ/pMAeVIyYzaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647852970, "uuid": "ff66cb21-ba8f-4ffd-9b26-2a5427b97e74", "value": 39713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647852970, "uuid": "335e677b-2a1b-40d8-86dd-69d06b2099e1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852970, "uuid": "95cccd5a-dc8d-40e4-85f9-307853bf4401", "value": "omicsonline.net.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bac52923-a947-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647888608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888608, "uuid": "cc7d2577-4521-4d1c-96e5-2b0239c5d549", "comment": "Malware payload (Mirai)", "value": "08b61c69f29c571abd646abe53cba82c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888608, "uuid": "28c5ddce-2d45-4d51-ac6f-35c705f7e65c", "comment": "Malware payload (Mirai)", "value": "2aa498a8a754a61ed989b8c5054c0166878477140d76844ce2efd5dc8064243b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888608, "uuid": "4540664a-0501-47e1-b827-09339465019b", "comment": "Malware payload (Mirai)", "value": "ca834a943db8956262844b1be024c0c95a4c4334", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888608, "uuid": "68c3269f-361c-44df-8b3d-c4a47c75e344", "comment": "Malware payload (Mirai)", "value": "27fa83cf0b1a149143381f481b156357703d5703cb38e960e7370e6a0f85cf99a9824b845ce5fb874811c56cfbd3e424", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888608, "uuid": "03eacce9-4f64-49da-9f33-97ee73861f53", "value": "T1FAF3852DABE95F3CF6BC413A13770F0C5A183AD91BE1C180D8ACD951397114AB56FBA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888608, "uuid": "eaf46589-942f-443c-9281-65a679acac18", "value": "3072:M3U2XtYKC7/burgdbC9/JmQrY3LVC9Y0uSZAjhqA48WpoFuYM/oW:Mk2dYKC7DWJmQr0C9YeAjhqA48WpoE/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647888608, "uuid": "19a74b68-9a08-4c0e-9638-553d3d05803b", "value": 166992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647888608, "uuid": "99cb5ea4-56cb-43db-bf2c-e44e592b0b3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888608, "uuid": "efce3de3-b38d-4b52-9ff1-881ecbae6af9", "value": "08b61c69f29c571abd646abe53cba82c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f87c9f-a952-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1647893056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647893056, "uuid": "7b3952e6-4129-4b2c-b28e-e197d6e33741", "comment": "Malware payload (AsyncRAT)", "value": "c5beb7af323a8159fb99ca4aa7dfe6ce", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647893056, "uuid": "360cfe95-a108-4ffd-a704-407230c2bab6", "comment": "Malware payload (AsyncRAT)", "value": "2ac301ae03c6043ffd1c46b04a64af067502b599c6bc064190e086ad7f99f2f4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647893056, "uuid": "b489ee1f-7186-4028-83c4-a65b5de0202b", "comment": "Malware payload (AsyncRAT)", "value": "17919be802501f102fc66cb9efce44d34ba1302c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647893056, "uuid": "8ec7ed40-3c8b-4f33-8f6e-bf893683cf3c", "comment": "Malware payload (AsyncRAT)", "value": "2deff4254e47b484c744a3bc4b5b718c69926e6c3560984fb30c8e46d17e897b2853e0e147f049075829fe1704cf4f2a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647893056, "uuid": "dc636d23-782a-4bcf-a2d8-5ba7bcd9ab88", "value": "T1AEF48E13B794E159D61244B19C7696BC1839BC256804DD0BB2C0BF4F2DB6A836DFA32F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647893056, "uuid": "9f353626-0ae3-464c-8d3d-535b3e77f4d1", "value": "c3de719404f185a4985bc04a077b4594", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647893056, "uuid": "64342fea-d749-4841-b6e6-225af5e13962", "value": "12288:RN5KZKIBpm+B8TmayLlFD+l9RI71u1Ub1kF:RN5ymoXayLlFDm3IREUbSF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647893056, "uuid": "a6386ba7-41cd-4b07-ad5d-a777275ef983", "value": 754103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647893056, "uuid": "fb42e724-1a2f-41b3-b19e-0202cd926074", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647893056, "uuid": "73855a82-e3f4-4d9f-8cc1-c5b07176f5a3", "value": "c5beb7af323a8159fb99ca4aa7dfe6ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a2dcbd2-a932-11ec-9275-42010a9c0029", "comment": "Malware payload (Prometheus)", "timestamp": 1647879480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647879480, "uuid": "bec46e7e-74a1-425a-b869-5a26c3e273d8", "comment": "Malware payload (Prometheus)", "value": "46a0ed16f446c9d5c948c0df1913760a", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Prometheus", "colour": "#56DD6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647879480, "uuid": "51f73bfe-8390-4bf4-bf57-aa62341f6d6c", "comment": "Malware payload (Prometheus)", "value": "2ace3b4ea7ecacb6ef8b4da7f5c315a31663523808a685d3600bc57571c1eb83", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Prometheus", "colour": "#56DD6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647879480, "uuid": "a4978840-0330-4ef8-972b-542ce5730bde", "comment": "Malware payload (Prometheus)", "value": "2bda2bb80eb79574eecff90ebcc8579e29f310b9", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Prometheus", "colour": "#56DD6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647879480, "uuid": "125a5592-4298-47ba-b09f-69c8410d7640", "comment": "Malware payload (Prometheus)", "value": "672b94636f4cb1e8faeaea6f970030509f19eec8ec66f6f932d51f1c9c7bf2cc102f3f07a0015134b27400dcee9abdfa", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Prometheus", "colour": "#56DD6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647879480, "uuid": "9898af96-2f39-4a10-9dcd-d6a4c8374fed", "value": "T1C8A4DF475D098E83F469C7A8FF130DA82F56275DF9833AFB10664DCA6B10A221D8D53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647879480, "uuid": "4a14d424-f0d1-402e-973b-61370826767c", "value": "12288:BUzlARf/DK3DsNZX+/ZYXckHfnCoMw0NTF:BV7wDwX+h4Nv5tOTF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647879480, "uuid": "5b030597-9344-4638-bad2-5c64687f832c", "value": 452355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647879480, "uuid": "e027c68b-ca52-4f74-b465-f7740dd40693", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647879480, "uuid": "aadfd2ce-9412-416c-87ca-0091a604e300", "value": "Assignment-Covid-19.docx.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c25db9-a8e6-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1647846668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846668, "uuid": "85ddfb65-0ac1-4672-8455-025e540ea129", "comment": "Malware payload (RemcosRAT)", "value": "c4f0f4daa225480de7f0a47fcdb66436", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846668, "uuid": "c287ca87-757c-43ab-90d2-048a34798ba8", "comment": "Malware payload (RemcosRAT)", "value": "2b0c03ec624b83fbdc97d1b026c8274b13e2aeff02165d4464375518f217ae56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846668, "uuid": "85a78eb0-b31d-44d2-b82a-69946ca20d03", "comment": "Malware payload (RemcosRAT)", "value": "98f3c260eeb136d87f12c448150752b78a0c9646", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846668, "uuid": "95128dbc-ea9a-40eb-b0a9-cc567daaccb5", "comment": "Malware payload (RemcosRAT)", "value": "19cc6bcaf90da5a094d82396419336188425a662b00ebf03423ea2d774722d58567c8578351fcf3a092de4d379c95624", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846668, "uuid": "b23c233d-606d-44a2-8877-6c8367a3a1c8", "value": "T1E0D48EE6FA92C877D0133934AC4E82B8982A7D91FD14AD46F6E83D4C7E3C781751A193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846668, "uuid": "41cad67b-c3a1-47c0-90cc-94101239111b", "value": "8855fa9c9366af3805198d563d544234", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846668, "uuid": "a92adbdc-f65e-4cad-b3f2-8310b68f6e4d", "value": "12288:leGezcWTwVTIdGk7R2A67pdTSJKsAR6NqI6F3HAh:j+kVT1kfINktZqTHAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647846668, "uuid": "212ee1a2-83cb-4817-b577-96fcf5c8e160", "value": 608768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647846668, "uuid": "a4ca1da1-60a0-4264-862c-7fe35f6543ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846668, "uuid": "c399eaba-26e8-4daa-acb4-cd101d7b1d2d", "value": "NEW ORDER CONFIRMATION,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b889fbb-a93a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647882784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882784, "uuid": "641a9bbe-b50d-42a5-b7e0-bb9503f58738", "comment": "Malware payload", "value": "04218b7a404dc6de23f0b2380b9de72c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882784, "uuid": "9d767b32-6953-441f-b25d-7f29d695207b", "comment": "Malware payload", "value": "2b0ec06149fb774d9b380ef811688ba427ed5fe9c44f76627cb06a20091c2c92", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882784, "uuid": "55c2893b-3432-4c4b-9d31-94f0b6abbc63", "comment": "Malware payload", "value": "2788e6be470e7a20f6d4f7f74cf4a9a05074e3e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882784, "uuid": "dda52ef0-c569-449b-a839-f81a9a1185d6", "comment": "Malware payload", "value": "635c34d71b8883e4da67d76b8ceb9e33edfcac00a2c0c837e2f7ec2af90d24633a788de1b6c47beee7e69558222e6c50", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882784, "uuid": "a8556ac9-8ed4-44a6-b9e2-a96e52c64ee9", "value": "T15BB36C1075D1C032D5BE29391574E6718B3EB930DFA09EAB2798063D5F702D09F36E6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882784, "uuid": "05aa715f-bba9-465c-85b6-ad7d92200e88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882784, "uuid": "043b8da1-010e-4d90-932b-fa3a76578994", "value": "3072:fL3vlPkoMOVc/9SR6xkzqZBaGUyHY/Ztwbq6z:fbhDbSlSJzhZt8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647882784, "uuid": "615f5c00-7847-4cbf-a8a6-259f7bf542bd", "value": 116224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647882784, "uuid": "0cc691e4-e531-4110-b607-e3058df3a48e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882784, "uuid": "7a09d77d-ffd1-42f4-85a5-c116fa6cd44a", "value": "04218b7a404dc6de23f0b2380b9de72c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17f5d6a4-a943-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647886617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886617, "uuid": "fc0f6c1a-9b3b-4749-aae2-62c53da933d6", "comment": "Malware payload (RedLineStealer)", "value": "fea7817d438328d32e11df8198578fcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886617, "uuid": "2283c8cf-2c37-434d-aa8a-5b186466a8b9", "comment": "Malware payload (RedLineStealer)", "value": "2ba7d648daceb38d11a0f4a0488d9e1d15a184d81d16fd7d5ea20c888d4e1441", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886617, "uuid": "9b8aac9b-8429-47a2-b025-2659e85944e5", "comment": "Malware payload (RedLineStealer)", "value": "6339705b0134eb3fa9f07d9e1925ac69ae53b2b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886617, "uuid": "9bf630ea-cd8a-4798-b986-269cc02f697c", "comment": "Malware payload (RedLineStealer)", "value": "8a807203133fa4dfbef635d3420f2de3958aa1e4fb96fa80080fc48d6a0a712b19109df8eb992401c9be79ad0b5cb28e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886617, "uuid": "c2bee932-4ada-43d2-ad51-e07379184f30", "value": "T1E3C423D6AA82FD3CC65F00B0FE05785D52E9F61016EA9187E235237E992C0FB2E13756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886617, "uuid": "eb2b9142-b875-44e8-9feb-f641c9acf599", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886617, "uuid": "fa4e2d3f-962c-4da8-ac67-2547872ba04e", "value": "12288:9/s4gBawum4a4xNez+6LedzX+SQS03ULaHNqrxlKIQNoGCrWDkUa:9Zg4jFXOedj7kEaHNYK3/CaPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647886617, "uuid": "2e0cb06d-147c-42ae-872a-11875b7f6825", "value": 564736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647886617, "uuid": "a7bb7bdf-faab-480b-af95-62a6540ecb5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886617, "uuid": "cb642ce6-77e7-431a-a265-9394b55dba8e", "value": "SecuriteInfo.com.Trojan.Siggen17.25672.27964.5019", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbcb1876-a8ed-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647849955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849955, "uuid": "5eb20619-c7b7-4a31-be94-55b20d2cf270", "comment": "Malware payload (RedLineStealer)", "value": "07bec22d6b3d7b18d79c4318227b52be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849955, "uuid": "6f8aca0a-2689-40fe-8676-2e60b53df8d8", "comment": "Malware payload (RedLineStealer)", "value": "2bc22b76ff5e2d1fbab9b20cf3e6a867ccc4ee90dbde27f5ea6348f6250ca00c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849955, "uuid": "c3e52b7f-c169-40a3-bba6-55f4dde59f08", "comment": "Malware payload (RedLineStealer)", "value": "0fd5ad9055818a52b62c34bf7965704fed5a5fdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849955, "uuid": "000d39ac-5821-4df3-9690-f6e476d18f4f", "comment": "Malware payload (RedLineStealer)", "value": "322b768c3747841808ab920e60831448273d8f73cd31e292ea5f02b6a9035355552cd7673454fba09b45d22f6ad50431", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849955, "uuid": "85910d6a-e369-421a-baa2-e698bff90f12", "value": "T15384CF50B7A0D03DE4B312F8797A83AC752E79A15B2455CF22D12BEE56346E0ECB530B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849955, "uuid": "d17a41bf-5ff9-4026-b7b3-070fe5da2236", "value": "31ff0fcf24c663417943c5927af948dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849955, "uuid": "2d501e06-e1b7-4751-a154-3e083fbb2f91", "value": "12288:UO/dgqVJRXztKiCgUU6Mf8sN5v/EBKvjQ0+YJ:LvVHZPU9MffN5vx9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647849955, "uuid": "d2b5ef0b-0b14-4ec1-8f53-533b9eaac8c0", "value": 403968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647849955, "uuid": "1a32f987-5755-418d-92b3-fe0f45cbd2c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849955, "uuid": "0f14643e-7e07-4cf8-bba7-c2fa16a5ed97", "value": "07bec22d6b3d7b18d79c4318227b52be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c039ffc-a8ec-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647849284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849284, "uuid": "1e4c51ed-0c66-4df1-8fda-9bb3a7f38c40", "comment": "Malware payload (Mirai)", "value": "e7851c4594e3b4772c106d8e239fba29", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849284, "uuid": "0fe8621c-33f2-43e7-aaa4-5a099f4b0e50", "comment": "Malware payload (Mirai)", "value": "2c0c6ade26f0768cd99cc7479890d20a1c8f0f8bfb98a7248b56432b0fbc36f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849284, "uuid": "e9d0abed-4360-4d0e-9253-29d493bc60e2", "comment": "Malware payload (Mirai)", "value": "f8fad095093f63c642f0684291261f743a6dc402", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849284, "uuid": "e2923cf7-7f70-41f1-ab89-7dc067fc17e9", "comment": "Malware payload (Mirai)", "value": "55307d08d672a93cd4719b772424935551c4355020fb79cd122e252bd7a3d0c19dc94fb7fbb0be80d784f7d054d3ab63", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849284, "uuid": "b9393c2d-b239-4fb6-ae41-75133f8b75c5", "value": "T1C6B30805FC404B27C7D26BBBF79A428E773666586BD7330166296EF02BC179C2E39160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849284, "uuid": "a0acf29c-0217-4990-a0c1-69d24c58dab2", "value": "3072:N9DMjalFQEnohudZslBDa6A845hsiMbkI4ce7HoDQHDVpZAlvm:ilBu6Z45hs3be7HoDQHDVpZAlvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647849284, "uuid": "2e45f123-640c-4c43-baf9-df1d080a7bf1", "value": 109502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647849284, "uuid": "a3589bdf-6359-425d-89e1-2470052074c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849284, "uuid": "539e3bbd-124c-4dfb-a651-01c686960bf0", "value": "e7851c4594e3b4772c106d8e239fba29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e631517-a965-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647901445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647901445, "uuid": "34a84c3c-2263-4660-a31f-42eec4e85d75", "comment": "Malware payload (Heodo)", "value": "91f1e8050a70397bc3074be43d4888c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647901445, "uuid": "ad0b55b9-4f4f-4abe-b3a1-455c2ab7bde8", "comment": "Malware payload (Heodo)", "value": "2c39858ddfb0fe408abc8042645411721d614a49eb6ff23502d2b95b0c496fbb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647901445, "uuid": "5a42d3c3-9739-43a8-a40f-a41ff3a5f563", "comment": "Malware payload (Heodo)", "value": "90cad7430248719c9f0ee90231268aaf0ed5859c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647901445, "uuid": "c42246a4-ac56-491b-a885-8479c0ae38dd", "comment": "Malware payload (Heodo)", "value": "7073306a47a9e5954cc5c62e80e9eb17ab7ca2e259f914374c1076bad50a42e39909735bcdf8342421bca8c831b21801", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647901445, "uuid": "70d231b7-531f-443d-9841-a993ffe76599", "value": "T103B43A11BC916832C36FAC7456073262588EE7F0DBD1F26FA3E0495C9A7C5E36624BC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647901445, "uuid": "9334d5ae-99ca-469e-bc6f-878e227f663b", "value": "14e6ae8d1400b6271725b3f01025b85e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647901445, "uuid": "e6356076-5e8e-4b07-924f-1b5bba1fa8ae", "value": "6144:VikzyaB9eoCyx/mEhHB5RYSJ/xn+qiCjzQNPj79GkqbscgCG5qH6scI:VNnCGmyHB5SSJpa0zQN39GkUGQSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647901445, "uuid": "c235933a-2b1f-46ba-ab4b-dfa520dece07", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647901445, "uuid": "79685df5-c035-496a-bf96-ea02a67cc75c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647901445, "uuid": "0b4ba2ae-7c0b-4aa8-8e81-33a0631417ba", "value": "91f1e8050a70397bc3074be43d4888c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f956c2-a931-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1647879211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647879211, "uuid": "53d0d9bd-6d05-4797-89e9-494dc9be1e97", "comment": "Malware payload (RaccoonStealer)", "value": "59dfd57e8aa866bdfc8afed1864bae6f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647879211, "uuid": "aa391a4c-f302-40eb-926c-89c1bfcbf4b9", "comment": "Malware payload (RaccoonStealer)", "value": "2cd47825cf3ef955e1d947e5a4a3099ec20829cb3fa8768865097eb182d44e59", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647879211, "uuid": "e0efe4fa-bd1c-418c-91cd-91dd352d9d39", "comment": "Malware payload (RaccoonStealer)", "value": "7f77e95fcbdffb7e10239c073d181849a2c9e7e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647879211, "uuid": "f8fe0686-d475-4240-b79f-dda3b3536b23", "comment": "Malware payload (RaccoonStealer)", "value": "587f60ab0eb477947ea884e04893d4f033d019ee63043a9f56e81abae73d608064074bf0788ee456edf2bd41172dfbcd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647879211, "uuid": "8873f194-7377-4a65-9d26-3f685e86c2f5", "value": "T14AF423D624A636D7F91820BBD07308537E98903D5D824A8E7537EC0BAEBD3890F9D45E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647879211, "uuid": "c75c9a9c-f1de-4035-8657-6624ca66a609", "value": "03ba1a75255b38f13bf610190a860fe5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647879211, "uuid": "3ec0f70e-c71e-4d9d-a112-a160b7950109", "value": "12288:IKXF4z3hutaTDKevLl4ZAQA1h6LTRbrtZcnHaKbuc34rxcBSjE7BYpCp:tX+zhy8XDl4ZAX1sJfty1l34VcNYIp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647879211, "uuid": "c18ef175-c52f-43a2-aeb8-da81d9f3c5c3", "value": 736616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647879211, "uuid": "1d50263a-7254-495f-a774-885cb481e890", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647879211, "uuid": "9d276c3b-d0bb-4344-bc39-b35feecd33fb", "value": "59dfd57e8aa866bdfc8afed1864bae6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed159f47-a8fb-11ec-9275-42010a9c0029", "comment": "Malware payload (Neshta)", "timestamp": 1647856050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647856050, "uuid": "887d2d98-b3da-44b7-899d-a390f383cd5f", "comment": "Malware payload (Neshta)", "value": "818928122bdad2a266129589c141c0d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647856050, "uuid": "a1a999c5-d46d-4837-b024-a0f531a1bf58", "comment": "Malware payload (Neshta)", "value": "2cf1affaddac715171d5be89d0c2bfaa3470608efdc12940967fc22fcffde54f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647856050, "uuid": "18a3bb25-ed7e-4ebb-a854-43468d7532b0", "comment": "Malware payload (Neshta)", "value": "6a5a0977c9d0922abef6c67c3d612b44e08e55cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647856050, "uuid": "9815d662-d68e-4aa1-a858-359dc079f1a7", "comment": "Malware payload (Neshta)", "value": "02410f5ff474534943aa7e8d945534f76b294d847e381f6e7d772c86a2327f62299d1c92012767da835558e2fdf8fee4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647856050, "uuid": "3676a0a5-d7f5-4018-ba53-e02b8bb21a1b", "value": "T1FA6418B2FA51D235C8151E74C51786F84A239D61FE20A8AF7A9F3F2A3B323C6502515B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647856050, "uuid": "dd6fe3b8-bd7a-4fa1-b298-ef03a0479662", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647856050, "uuid": "c94d9d46-6cac-44bc-b572-cca266c45793", "value": "3072:sr85CX6JcWUg3HxfMZTSjajSk9AEoDf4z17cFmX4U:k9X6JthflW1ATu1o24U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647856050, "uuid": "2696e29d-1eb8-4cf8-bccb-1ecb007a514d", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647856050, "uuid": "d1f28fdf-9c0e-42f3-ba28-216dc69320a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647856050, "uuid": "ca8896f3-315f-4898-b560-4dc238698d56", "value": "818928122bdad2a266129589c141c0d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acec4e7f-a92a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647876129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876129, "uuid": "c807ebf9-133e-4679-b6f6-8bb2bc8fdb3f", "comment": "Malware payload (Heodo)", "value": "484b10e6d0fad5629343668f7306cd83", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876129, "uuid": "bb428fff-9690-4300-9b89-91fb1b28f826", "comment": "Malware payload (Heodo)", "value": "2d612f40536a4c2f343bf5325d297fbc08e049a8a28892ce9b9db706e99200fd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876129, "uuid": "7f3df99a-b0be-4478-be84-1132be680645", "comment": "Malware payload (Heodo)", "value": "16c35b0e33739a6f57f99a1061045cc50a335350", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876129, "uuid": "f621db51-8d86-46f6-b023-fd464a0b9e78", "comment": "Malware payload (Heodo)", "value": "e33da9e8dea0d0fe8511ec974aeb6346da4c0087d2c586e869bd4f88c5e713dbad1a0291be0c0521f16e931c785895d4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876129, "uuid": "93d131c8-cf4b-4c77-a860-a033f70fac68", "value": "T10E353951B04FD1BDC08F04BD596AA37EB29C9E100B7544EB329C3BDEAB389E545B2D06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876129, "uuid": "48e37a58-ebb4-4efc-9509-23202574a418", "value": "570e13786e13464ca954b67524d1cbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876129, "uuid": "b2358fb2-f346-4e6f-99ef-c95cab2d0b57", "value": "12288:NLyWPZ3mtGkQoQK/1mqXXpvoCpN8ARRZR1EPq9vsOwDu3kQybR:0KWtGkXQgDXloA1ZlytX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647876129, "uuid": "be60c9d8-fbb8-4b79-9b7e-3bea47a07d29", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647876129, "uuid": "0083363b-861e-4fd3-bc61-41995a5577f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876129, "uuid": "ac1c3832-301a-4390-b58d-da899eb514b9", "value": "emotet_exe_e5_2d612f40536a4c2f343bf5325d297fbc08e049a8a28892ce9b9db706e99200fd_2022-03-21__152159.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b76c5f-a8f2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647852045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852045, "uuid": "4fa6a1b8-7946-414d-b733-d45ed923f3e1", "comment": "Malware payload", "value": "93a3598b38cb62ea544ce7a8ee4e0141", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852045, "uuid": "17b6e233-7295-4823-bf1e-c5b88d209dc6", "comment": "Malware payload", "value": "2d94fd6ffb4d714e7f941050ada91b1b0473171a7afef2e9fedbff1a296f5b94", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852045, "uuid": "0872b855-39e8-442d-8145-52cc2d52eb2a", "comment": "Malware payload", "value": "cb435c38a37faf4de034761becafa904865b5f64", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852045, "uuid": "e2e76027-33a1-4d13-a2e9-02c202b1bc4c", "comment": "Malware payload", "value": "536714ec563629d26397d087fd4937987d0d27cd4a07e61c68cb4d7b75850bfbc303167e444e0645cb3da21bfaa7c63a", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852045, "uuid": "6fe968ac-f509-49e6-95f9-91a071b73462", "value": "T15D065B32B24C653BC4AECA365537A258993BBB732B128C1B57F4094C8F365436B3E647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852045, "uuid": "668e3e03-ff90-43dc-ae97-3642daaefe17", "value": "49152:w6n1ypaHt/B2SRiC/yEBs7j6tIzjKT3B1GFtbGYS3A:PypqDUjBzjq1QtbGYOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647852045, "uuid": "553e5f5b-9184-4b41-b004-d578d7a228e2", "value": 3976704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647852045, "uuid": "4754f54c-70c7-438f-b667-6eff01625bce", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852045, "uuid": "3c9a0319-624c-4b6a-b723-886dbc85af2d", "value": "__^xdugj.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c72332c8-a947-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647888629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888629, "uuid": "7d99d2b8-ead4-4e7f-86f8-89130815b86d", "comment": "Malware payload (Mirai)", "value": "45ddddc8b933455bf030172599f972fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888629, "uuid": "e62b7fca-5e79-4086-859f-49ac8cc65080", "comment": "Malware payload (Mirai)", "value": "2e216273f0a6ffca43c8fa7c53acb1ba5b08fe848723e6b4aa01fc17cd47d35b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888629, "uuid": "aee4f22f-bf09-4b51-af13-f747c8c13fce", "comment": "Malware payload (Mirai)", "value": "4d31fb0134fa85b75224399e75f1e633270e34af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888629, "uuid": "4b8870e2-4ae0-438b-a19f-68d0ff5352e5", "comment": "Malware payload (Mirai)", "value": "4157f632ed24f4a0da0aab137d16a9675a9dea29f069f05b8ede2d7e73cc95ad0d5544b8d8fec5203efd875648539559", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888629, "uuid": "2884d5da-7c48-41b1-a845-60a6fad408be", "value": "T1F8F34ADDA8914947C5C9D1B27A3D504D334363F8C3CF72678D206AB467EE81E2DBA829", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888629, "uuid": "3165cf23-0546-4fd5-a80d-bc20c418bbcb", "value": "3072:jaf19ulFQGZ3J1tLqbs3iGl7NmhwIe8yXPO5W5yEVb6h5pWfx3b8DLhxH/9:jaf7ucGZ3J1tLL3iGlAwIjyWkDI6f1b4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647888629, "uuid": "072dc41a-6be9-4c53-9195-e1cc9fe2c767", "value": 161880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647888629, "uuid": "daa74b94-5990-44a3-a839-5183434e0d80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888629, "uuid": "e680681d-4f12-4270-8c1c-686dff628918", "value": "45ddddc8b933455bf030172599f972fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6b27292-a947-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647888655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888655, "uuid": "c6d1cc5c-b2fd-4bdb-92d2-4907e0d780d4", "comment": "Malware payload (Heodo)", "value": "80c3f6413a0ed38b3ff1491058d17830", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888655, "uuid": "1a2d732b-9aae-4138-9159-10a4707eb4f9", "comment": "Malware payload (Heodo)", "value": "2e848a446721996a174cfb1c75d811fd0eebaf7874ca32975cf5872d45e30812", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888655, "uuid": "b18336c3-26d9-42ac-845a-1b46da7fa626", "comment": "Malware payload (Heodo)", "value": "32aecae452de44eb5918c0348b620396d2276cfc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888655, "uuid": "d190a061-e6a6-4067-90e8-52b66270ff01", "comment": "Malware payload (Heodo)", "value": "6c0475990d97d93c67cb64c79eec5fd864cafc88fdfb75e3b214e0c6788d0793ec3105e369dc1ff0af2b375a71f3430c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888655, "uuid": "577913c1-08bf-40a0-bd03-71df901d2f98", "value": "T138B43A11BC916832C36FAC7456073262588EE7F0DBD1F26FA3E0495C9A7C5E36624BC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888655, "uuid": "6c196ff0-8871-4c1b-8df4-1021c257e59d", "value": "14e6ae8d1400b6271725b3f01025b85e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888655, "uuid": "c75320bb-f495-4fb4-a35c-9ce8933aa2a7", "value": "6144:VikzyaB9eoCyx/mEhHB5RYSJ/xZ+qiCjzQNPj79GkqbscgCG5qH6scI:VNnCGmyHB5SSJpE0zQN39GkUGQSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647888655, "uuid": "34057400-f529-473e-9c6e-d6c518536ad2", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647888655, "uuid": "8bf58979-efc6-4778-8ee5-00f4ac4123d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888655, "uuid": "e99c1611-1a74-43f4-9390-4f986399db42", "value": "emotet_exe_e5_2e848a446721996a174cfb1c75d811fd0eebaf7874ca32975cf5872d45e30812_2022-03-21__185045.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e39dff-a90a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647862271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647862271, "uuid": "4024291a-0a14-4e85-99c7-0dea6552e88c", "comment": "Malware payload (Heodo)", "value": "b1bc53d6463371098be290ac3fd64b7d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647862271, "uuid": "3a66cdc7-1a62-491f-9cc3-5e694697b682", "comment": "Malware payload (Heodo)", "value": "2ecc2a48fa4eadb80367f69799277c54a0fe6dd2220a6a2dd7b81cfba328ed19", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647862271, "uuid": "6d4d62f8-90a5-4c21-9358-737e56f43edc", "comment": "Malware payload (Heodo)", "value": "dfbbacb008f827580633155e63779dfedca795c6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647862271, "uuid": "88aee953-9422-4c42-8c1c-c086bc0880dc", "comment": "Malware payload (Heodo)", "value": "f04f53bfd9011c97918233ad350e43f72fa59d03b2be64ac18980912b708ce1b69c841a81f6b63180c3a387b73911156", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647862271, "uuid": "bdb3280e-77fb-4abf-8790-af942472c2f1", "value": "T1B0F2A031F2E29B59E477583C478CCAF8D77DDA2246067E2C308A13BC5F123566A4E24D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647862271, "uuid": "09dd1456-9e58-4bd1-b7d7-e6c36da4b305", "value": "768:Qhtqi5eiNlAjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooood7O:QhtqigGUOZZ1ZYpoQ/pMA8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647862271, "uuid": "c323ceb0-7285-40f3-b6bf-f5a102a36b86", "value": 36475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647862271, "uuid": "d36b3067-a2c7-4811-971b-9f86f1650021", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647862271, "uuid": "8803f10f-cc79-422a-91bb-4e0759e1aec9", "value": "DOC_76.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abd3fec8-a914-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647866678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866678, "uuid": "3f11f890-8405-4a6a-9b26-c93510e58202", "comment": "Malware payload (Formbook)", "value": "c075fce32a46633cb26db53a8ec40a2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866678, "uuid": "c795e873-8e87-4458-b02b-ae00f55d86af", "comment": "Malware payload (Formbook)", "value": "2f074417e5e2975b0e9b07065b34d28ddc4e41af663d41eb96b12b3d3407c9aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866678, "uuid": "a9a2194b-cb97-4a78-ae5d-f267918ea9d2", "comment": "Malware payload (Formbook)", "value": "89ed367b89fff8933023fc8b892da8666f40c357", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866678, "uuid": "5a609ba8-831c-4a05-a62e-9a7d9f31198a", "comment": "Malware payload (Formbook)", "value": "580edf6f0719500f4e0da894a5e2955cd1d5ca4056a638d21c2bb970dc35dc5db59b04b2229565f3cb961d3bdfa6dec1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866678, "uuid": "40e7c78d-622e-4d81-984d-cd868278a4a0", "value": "T1EF6412A766E188D7F897137014B7994903F2EEEBD8C966178BC73E9258732C3061B907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866678, "uuid": "a8a5a006-42a0-46c9-8139-eb580d20791b", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866678, "uuid": "666a9afd-7771-46f3-a052-ad0e36fd2034", "value": "6144:jGiKhRbZJOMnkQIYwdONTtfMYi1QJmBws2rzVsjTcAaCnRz/gjYr7:ERvOMnHIXOhVVrAP2rzVsjIAa8gYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647866678, "uuid": "c07ef011-3bfc-4e26-8c50-7f3c1d9ca462", "value": 325367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647866678, "uuid": "6272731c-fc5e-4703-a3a8-db754450d8f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866678, "uuid": "1e1736d3-ad1b-48ae-814e-6dcd3867bcd2", "value": "220126575.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4885bc44-a8f0-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1647851050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851050, "uuid": "dd65e861-be11-4ed8-bfd5-7528f8b6565a", "comment": "Malware payload (AveMariaRAT)", "value": "a560bf97e15dbd4e75cc441f16779bda", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851050, "uuid": "86c4721f-3359-41da-a3a3-2734c2ba85e7", "comment": "Malware payload (AveMariaRAT)", "value": "2f19557d699d9d0adb92a1b41fd27bc4acad1e36056a78da9c76975cca79f074", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851050, "uuid": "9c530f1e-ab52-482e-b6fd-2216479ef202", "comment": "Malware payload (AveMariaRAT)", "value": "b704747ea875b7f8b6fe2ace004f8620f79927e5", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851050, "uuid": "4f5f7d75-7eea-449b-b255-b34baf017544", "comment": "Malware payload (AveMariaRAT)", "value": "8aa373ed745c704fc078210ceaa15701e0dbcb596b95ac52c6583127e8e6c84fc56e43fd3e77abdbff509d20e06f6075", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851050, "uuid": "345c4d40-8281-4579-bd54-ea498861d5b5", "value": "T1620412E5ED5DD923D94308FA9F7BAD8A41BADC2B3AF1C282A440325C47F2294D4BD01D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851050, "uuid": "5a876959-28c1-4beb-a964-e5a9d2c0f5bc", "value": "3072:f1pAeUEg0XPl4a55LwU0Cg+ihkd+T37AplsE6wQ5pJgsws/wfSmUJpl912:6EfNfwqg+iS0Al+pJeSTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851050, "uuid": "3c767c07-f328-4398-a577-1e8ff3535907", "value": 190264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851050, "uuid": "055f09a7-dae7-4988-8d04-bc4f2dfeec48", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851050, "uuid": "59e7b53c-efa9-4f76-a2a7-456095d1c238", "value": "PO03-21-2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83efd012-a95f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647898824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647898824, "uuid": "305ff3fc-7c72-45d9-83d9-165e264270bc", "comment": "Malware payload (Heodo)", "value": "545e17e57c1f010737550849b6264cb0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647898824, "uuid": "0b1b5aae-5ceb-4dff-8f24-5d3adb2192d2", "comment": "Malware payload (Heodo)", "value": "2f1bcfe75c36017bcf173e6a0bbc06455bb37aa53d80ccf713b681d1f6cadb05", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647898824, "uuid": "6b3fd87c-c1af-4328-ac73-4b73857687a4", "comment": "Malware payload (Heodo)", "value": "59503ba043c9c4229f737843ebf22f32462904f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647898824, "uuid": "f2f0a73a-3a59-45cc-a81f-f4ffa98adbed", "comment": "Malware payload (Heodo)", "value": "fde539c674a457573161d041c201c4dc94973ca92359338ed4ee58420c9fe87038fe2036df35020d5b0212e9ca32c34e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647898824, "uuid": "dd9c56d2-a4c8-4954-9051-3b31a65e3371", "value": "T109B43A11BC916832C36FAC7456073262588EE7F0DBD1F26FA3E0495C9A7C5E36624BC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647898824, "uuid": "4ae33f2e-c40c-41d7-b986-9cabf90e3b7e", "value": "14e6ae8d1400b6271725b3f01025b85e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647898824, "uuid": "87c2f9f3-31f6-47c2-b14e-fc7e77f8171d", "value": "6144:VikzyaB9eoCyx/mEhHB5RYSJ/xk+qiCjzQNPj79GkqbscgCG5qH6scI:VNnCGmyHB5SSJpn0zQN39GkUGQSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647898824, "uuid": "7813e456-0be1-4c5a-9852-bfcf8d531e84", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647898824, "uuid": "5a49e8c6-1e0f-41b9-be8c-9e5dfc75681e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647898824, "uuid": "fe0571c9-9bbd-4d90-854d-f0b3e4c4496c", "value": "545e17e57c1f010737550849b6264cb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7324fea-a8d1-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647837975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647837975, "uuid": "a8a2c19c-c1ff-4dd2-9313-829614650984", "comment": "Malware payload (RedLineStealer)", "value": "ef5ab0d2ffedf54fdf3e1a24542b6361", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647837975, "uuid": "49fa5e6c-325e-42a8-9cef-2fafffcc0946", "comment": "Malware payload (RedLineStealer)", "value": "2f7c261dd0a4f7f00b34b09fc1a35e729596a38bc80c6c54467de0dedb3c23db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647837975, "uuid": "7dfc50d5-e893-42c0-807a-96f5fccbbcb6", "comment": "Malware payload (RedLineStealer)", "value": "935e4e64357c5ad8e693c8e05fd8bd4928bf975f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647837975, "uuid": "987f423a-e093-4298-93cb-9b791a6de190", "comment": "Malware payload (RedLineStealer)", "value": "1b125e90f43cca1f44690a8d7846796b03153fd0e9dc2af8f5bb2b6de51a55d99f523eeccefdc3beaf7921363361b4d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647837975, "uuid": "3c056e04-488d-41ca-a059-0d2f0a2111df", "value": "T18194CF40BBA0C03DE1B712F8B97A93AC752D79A15B2195CF22D56BEE16346D0ECB1307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647837975, "uuid": "34643df5-b611-4e8d-ae29-0cea14fc65b2", "value": "cbe2a3d9f5bb4fa7c1fbeb2b00df447c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647837975, "uuid": "db0a62bf-174f-4dd2-b76e-4d3c9c1a5c17", "value": "6144:fq/uotz/o11KrehRasSOWFbQCkDss/lid/wqs1rkRO19xA2rUJDEOJzo1:C3tz/o10ePnYZxkDv/6xsNmqxfODXS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647837975, "uuid": "3cf86f49-160b-4c34-8b7d-42baca5b3774", "value": 412672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647837975, "uuid": "6a1878cb-ddaf-4a80-bdd3-dee349c48c9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647837975, "uuid": "ee42083b-416c-42d3-a297-75372ddae0a3", "value": "ef5ab0d2ffedf54fdf3e1a24542b6361.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9be8b44-a904-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1647859910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647859910, "uuid": "76c337c9-1710-4a9f-b36e-a69dd46c1731", "comment": "Malware payload (NanoCore)", "value": "6bb6530bd5ab8692409aba5330694d2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647859910, "uuid": "c3e3c408-e841-4b76-946b-14ea49e5e0dc", "comment": "Malware payload (NanoCore)", "value": "2fe59b175fef625c43466255b140704aaa581b8e79e0017472e3d8d788995211", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647859910, "uuid": "cf18c9ee-6a17-464a-a9be-0baf24a3d7bf", "comment": "Malware payload (NanoCore)", "value": "3a82bc662cb02e5808040be6de40f16446d930ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647859910, "uuid": "47d21165-77d1-42a4-afa3-aabfb6fc9235", "comment": "Malware payload (NanoCore)", "value": "144b9648a48c4698f0bdff1c98ae4475dcf48c26e1096305579153710be6d2e8ac0d490e84f6b19827a483eb81e03501", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647859910, "uuid": "1fc11323-bff0-49f1-aa07-ee914065667e", "value": "T1B235235A3B72C216C59D237314E2F5A007B2B7DA7A03DF0534D1136D6A4B7856B82B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647859910, "uuid": "6b9885cf-da5a-4ef1-8856-aeb598032deb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647859910, "uuid": "d1545063-45a9-44eb-9180-7a326764a1e6", "value": "24576:tO99tppdGuiN4V3K9wTq3ffNXRBRiRCMTaH8MMmCGG:tqHltlWNcRCyaH3CGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647859910, "uuid": "15b19f0f-31e4-405e-8960-7bd9c8c250ae", "value": 1103360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647859910, "uuid": "c6212937-4125-46c7-865b-7cb1b2d6c4be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647859910, "uuid": "913ca6e7-9254-42e7-beae-30388b1c2e61", "value": "6bb6530bd5ab8692409aba5330694d2a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "320b777a-a8f7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647854019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854019, "uuid": "aaed5b23-6135-44e0-8e19-66734d957118", "comment": "Malware payload (Heodo)", "value": "7111f3565c5552c97d1991ec5b724a0c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854019, "uuid": "15b3a94c-1730-4cdc-9f11-27496b7b2367", "comment": "Malware payload (Heodo)", "value": "305702929880d12a03975655b9d3d5793bd9cf77f22d1a63790752398113be4c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854019, "uuid": "c5a5c5e9-a692-4597-b5ec-dd3589b02064", "comment": "Malware payload (Heodo)", "value": "838ed884cd5ee1639b63d945b9302fddc635aa4f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854019, "uuid": "d35cb5fe-d0fc-4827-86f5-835f90fee5de", "comment": "Malware payload (Heodo)", "value": "e55439b59f6bfbabae97a251932139b6c7d7b26d1f274d5f6db98959e20435d454690010f8ca6c67db181d94cf589e34", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854019, "uuid": "acd0f13c-b270-4eda-8d4c-daf3e3713362", "value": "T1F4056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854019, "uuid": "541cbd33-b04e-442a-b626-19c5f8f1542b", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854019, "uuid": "08554526-3fb9-4a09-aa0c-5eb1f4ee2da5", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rG5CGNHrH2tZ+d+:gMV/rG5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647854019, "uuid": "818e3d8b-5a4c-43dc-a9a1-b6efc422d16c", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647854019, "uuid": "0301f124-0092-4b8c-93e3-4572372a4407", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854019, "uuid": "17e8059f-09a7-46a9-81b7-a5b49721ff7e", "value": "7111f3565c5552c97d1991ec5b724a0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cb1e34b-a8ed-11ec-9275-42010a9c0029", "comment": "Malware payload (Matiex)", "timestamp": 1647849768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849768, "uuid": "292aab28-1384-498c-bf07-5811e2b0ee2f", "comment": "Malware payload (Matiex)", "value": "b577138111c80cdcde338683038c04be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849768, "uuid": "7a4a1b1c-6e7a-497f-ad4f-5f4f1a2ba872", "comment": "Malware payload (Matiex)", "value": "31211fd1239d9e0de50a1af9ad1e71a55be0dac1e55e06444d2537caa96bd0c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849768, "uuid": "8823225e-a660-4906-9fe2-f9f151654b13", "comment": "Malware payload (Matiex)", "value": "d4a9804675c85b1a7ac28858e6fb8cdd92018e23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849768, "uuid": "06180786-7862-4ca1-aadc-cda76404f45b", "comment": "Malware payload (Matiex)", "value": "1d9b68fb66bf49cbc0954bba678152ed244168da4796e2b9f8330d0602f64e9c1deb5c228f8aa0ab30fd7093fb70b5c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849768, "uuid": "85898ecb-7c95-4a98-a69c-9d629dd9b5d4", "value": "T1B4856B2167E844C9F9F75B72887BA451BAB6B8656F31C6CF0560014E0F72FC88E76326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849768, "uuid": "efe1b07f-68bb-4bc8-8ca3-e4ff2f8c641f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849768, "uuid": "3a12da7c-9200-4cbe-9308-8c6ab178305a", "value": "49152:MKmt3GQdlNkEJNWRXurCuO18fYB7vEs1yN:MKu/dliEauW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647849768, "uuid": "aba41825-3933-434d-bee2-455923b9f3ee", "value": 1788928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647849768, "uuid": "bd87bcc9-9a1b-4844-a983-fd3b64c962a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849768, "uuid": "eeeafbb9-bc29-4180-bb29-1379c9099d15", "value": "b577138111c80cdcde338683038c04be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75db9ddb-a8e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647848119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848119, "uuid": "04b99a4c-6e66-4eca-b90d-47a71017e7ac", "comment": "Malware payload (Mirai)", "value": "7cd52d7ddc6163f12d734c71d80719d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848119, "uuid": "2cbbfa7b-8c5a-49cd-98c4-127e15935a36", "comment": "Malware payload (Mirai)", "value": "314006566ff6f349c02204a47edece3c6dce83f752fa70306a75c9febeb01330", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848119, "uuid": "0d9121ef-30eb-4645-98b3-9549331184bd", "comment": "Malware payload (Mirai)", "value": "a497b30437b62a5ac29fac3d5cda26e2a243b5e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848119, "uuid": "7902db2a-2a65-4988-beef-280a84e628cd", "comment": "Malware payload (Mirai)", "value": "8a0ca12d2575db9a8bde0040a3c37751650e007c4fea09767e8b339ab869129f5a51522d6e76649b88c97581462d3fe8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647848119, "uuid": "d5bfa224-50ed-4aaa-b855-a61a5dec06f6", "value": "T1A4933A0748615FB7C0456DB126EB59340B67BD224F4F1E9A792C9AF40B4B8CEB40EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647848119, "uuid": "0a452847-2673-43b4-8dca-8044321361d2", "value": "1536:PsQs0o3oUUT43pfKH//g1hqNqooGL5PCc5hsluczGJMnhR090jUeQfXm:nioCZCHsqNqkPZ5hslsMhR090QeQfXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647848119, "uuid": "3b25b61c-3be4-4025-8332-c32e38a2b3eb", "value": 95921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647848119, "uuid": "55366895-65fa-4c4f-8745-ee867b984cd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647848119, "uuid": "0660844e-2c51-4653-abc9-321fb4cf7f7e", "value": "7cd52d7ddc6163f12d734c71d80719d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79841396-a901-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647858434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647858434, "uuid": "4ad4dde7-5849-4203-9569-14b5f3395a2b", "comment": "Malware payload (Heodo)", "value": "ac3ffdd9a8d372d37ce2f56e8e675c4b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647858434, "uuid": "cd7dcb57-f90b-430b-8b2e-0826cd7caeed", "comment": "Malware payload (Heodo)", "value": "31b56da1bbc2d19241528d58ac177f88d28a7cb4de49446c7c4a042ee06f7a46", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647858434, "uuid": "b49ef1da-ecf8-466d-aa49-2f5432fbdb44", "comment": "Malware payload (Heodo)", "value": "9485b73905caf18999687f410edb8d72b90d8204", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647858434, "uuid": "10fb4cba-c7d5-4ec0-a86e-cb5b67f88a4d", "comment": "Malware payload (Heodo)", "value": "93e160088aa3e1cdd24cf1e809aac0ac45a1f7b0d847757979817ded24c113df4f055a7038d2f4548e88624c88b1480a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647858434, "uuid": "deb7a519-d8e2-4953-88d3-59cc85026270", "value": "T136F2A031F2E29B59E477583C478CCAF8D77DDA2246067E2C308A13BC5F123566A4E24D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647858434, "uuid": "0c478a20-41ed-48d4-8c58-775b4ae4a429", "value": "768:chtqi5eiNlAjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooood7O:chtqigGUOZZ1ZYpoQ/pMA8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647858434, "uuid": "8f4964de-ed25-4858-b486-47b2c9df43c8", "value": 36475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647858434, "uuid": "8cf51d2a-1fd2-465d-8494-f30220b98009", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647858434, "uuid": "e876636e-fb19-4423-a2b5-a224907dad8c", "value": "adjuntos_7846522.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7987cc66-a94c-11ec-9275-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1647890646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647890646, "uuid": "3794b3dc-e11d-42c8-a8fd-dc1ce8a142e6", "comment": "Malware payload (IcedID)", "value": "7ef96e1719f04054139233d59f3376d9", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647890646, "uuid": "18b7d102-8b23-430d-be7c-2ea3fb7aeead", "comment": "Malware payload (IcedID)", "value": "31dde4fbe6f38f5bb725258a88d6d043db03517be3538b66eb94ad87c108345e", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647890646, "uuid": "49834b4d-ed88-4d0c-89ca-f88a39bbe1bb", "comment": "Malware payload (IcedID)", "value": "86ed8de3fcceafe66e2d4a2a878e4ed65f93d0ff", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647890646, "uuid": "0a8ef351-c2e5-4dc7-8af3-9ee239bc7d69", "comment": "Malware payload (IcedID)", "value": "81a991ff0bd86677492e00aa1e96cc12583d0be20b80027def6b2274f32b6ae838e037ac9300b8a6ca8ef8f978372143", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647890646, "uuid": "ef52d8f4-4b0a-48e4-80b4-c41d64e14d86", "value": "T1BA831271CF48D921C60BC01926326E2CA3E6C8BC5516FF623E38B6456277DC7EB10953", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647890646, "uuid": "117b4302-ebf2-417a-97bf-8b64891c87e2", "value": "1536:uWpcFIG+pxkowgRGyG1W37ntDtuFSVeO0fnbFpymgIw4dzW32ER/OiLBg4PK:uPFZowgRxmWPAO0zTymk4031R/zLBlS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647890646, "uuid": "62af490e-9a5d-4cf9-b939-34e93a35bac8", "value": 85795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647890646, "uuid": "83a7f1e3-464c-4dd1-a821-99a8f8070098", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647890646, "uuid": "441aa9bc-7ba2-4751-86ba-4dd3771c5861", "value": "a9b0640b857155f63b5f026861277d2d28bd16f40715433543d1fd145ded5a42.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "211470e3-a943-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647886632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886632, "uuid": "e777f32b-c569-437d-8872-40282b849f0e", "comment": "Malware payload (RedLineStealer)", "value": "eb85f025ef295b80cb99525ed699ec5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886632, "uuid": "6c7370ea-10b1-46ca-8171-87289edc8bc8", "comment": "Malware payload (RedLineStealer)", "value": "31f8156162db5df7668eb2105713327c7919a0d597612a7c4c135e2be3f6618d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886632, "uuid": "38e082a6-7d2e-406f-8ae1-8850edfa3854", "comment": "Malware payload (RedLineStealer)", "value": "2c38f5e4e9085f0df872569fc3bbce71489097bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886632, "uuid": "d581f2b3-8145-4874-b3d3-bf49b0b6a721", "comment": "Malware payload (RedLineStealer)", "value": "27921472617b60e11cacf3581af813f19df6ea989256e967fdd94d9e439850ec61e6890266b5fd1ed9ba587009f20958", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886632, "uuid": "d2efc8fd-81d2-49d6-9c9d-46bd9bfa106f", "value": "T12F5533FB66E0EC8CED0262F501277A6F539ED9C6E1C55A9F7395219228D009DEBC2092", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886632, "uuid": "9b539237-6d7f-4806-a911-f97be58be7b6", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886632, "uuid": "ab9773db-9e81-4076-874d-1d4cd068ee38", "value": "24576:gYnFm5EfrCZZoqBBGvTAmJofu7LLlQvlsZKN/zj+9kvckEaHNYK30t/iBnBB:gYFw/GqBBO8yP7NQv+MN/zjTvcNaUil", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647886632, "uuid": "bee6b776-5fe7-417d-9cd1-6b85e3ba9d63", "value": 1328128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647886632, "uuid": "fc3f21e2-d4b5-4744-bb45-f098e7ec6c8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886632, "uuid": "f86a5391-5f23-4531-ba0a-44bacab15e34", "value": "SecuriteInfo.com.MemScan.Trojan.GenericKDZ.85144.22409.26610", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdbaad42-a916-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647867567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647867567, "uuid": "52b91629-23dc-40a0-b118-a11bf9b94372", "comment": "Malware payload (Heodo)", "value": "8a69f81f02df1eb2c91c9d68639d9e4f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647867567, "uuid": "fccf5279-4f9f-4f10-8ed6-e5d4fbe071c0", "comment": "Malware payload (Heodo)", "value": "32078199b7bc556ee43c99c3a025730acfeb9c939906aee3ff189097c4dfd505", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647867567, "uuid": "ea41a7e1-a18c-4627-8765-e19635ea0ff1", "comment": "Malware payload (Heodo)", "value": "e8787af94f62c836a2a98d0b9b6c2660df4248c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647867567, "uuid": "2a52f099-4f62-488e-88d5-6caf0d88e398", "comment": "Malware payload (Heodo)", "value": "770849436c0d3a85ee7164aebfe6427a4ae79fe3a931d8d7f0e66c09af48ae19558229551fd877db205e0de2eba69957", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647867567, "uuid": "73b00abb-0811-4065-83b5-6acc043901fe", "value": "T13F056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647867567, "uuid": "068aae21-5de0-44cb-a19f-4c3016ef1d2c", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647867567, "uuid": "e674cb50-cf41-4f91-9a8d-c869ae8dfa34", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rK5CGNHrH2tZ+d+:gMV/rK5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647867567, "uuid": "2c29777a-2c75-435f-8d02-fec7add3a13d", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647867567, "uuid": "8de3ba42-d298-42d9-92f0-4e6d2ffa1dba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647867567, "uuid": "a523d05b-19dc-4a6c-98a5-cce3a12deb94", "value": "8a69f81f02df1eb2c91c9d68639d9e4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5f71734-a92b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647876601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876601, "uuid": "5cd469af-d150-47f2-b3b6-66ffa38a3c2e", "comment": "Malware payload (Heodo)", "value": "79bcaee112177891602d7ed17f11d977", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876601, "uuid": "37524d31-60c4-4bb0-965b-db75cec22136", "comment": "Malware payload (Heodo)", "value": "32399a672bdfb3ac57a61054c68c05c17349fe714a5155c786293e92e45e1dab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876601, "uuid": "64e0a5cd-2788-4745-92c1-66b4c634a5ac", "comment": "Malware payload (Heodo)", "value": "cf2ecc415d61839482e947d2bf8e40d1a163c76a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876601, "uuid": "9e002e07-7f16-490f-a1e9-b7569f52ed92", "comment": "Malware payload (Heodo)", "value": "3118cc71b484119105e1a729a4ac8a525456bd6e3e6827ae52851675ffd9a9e1e9ee6740114410f572db6be693dce761", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876601, "uuid": "674a3505-c88d-4c29-a83d-83eb0438089b", "value": "T1ED056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876601, "uuid": "b426b778-8670-4e29-b0ef-f483f06cca30", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876601, "uuid": "a1b3dada-5e48-45b2-ad1b-1ae30d6aecb3", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rC5CGNHrH2tZ+d+:gMV/rC5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647876601, "uuid": "8d23c2b5-9c84-44b8-9717-d509cd47f1ea", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647876601, "uuid": "d739c6d1-bf67-4477-b798-4747e8b9e6d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876601, "uuid": "1d4fb7e8-63d5-4ffe-a71d-56dabc9a2321", "value": "79bcaee112177891602d7ed17f11d977", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5146119f-a8e0-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647844193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844193, "uuid": "13140e3d-50ad-4c7b-9e37-5a18e6a7bc3a", "comment": "Malware payload (RedLineStealer)", "value": "a7385dafffacde3d5a1199de58af0183", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844193, "uuid": "17ac5c68-9504-467b-bb40-8c09ee003a1d", "comment": "Malware payload (RedLineStealer)", "value": "3288417b1129ba4204284daa9ac3139add3b063d465ebbbe76c47c0a4f1de9bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844193, "uuid": "13c1f40a-b87e-4417-9093-3ff300b21273", "comment": "Malware payload (RedLineStealer)", "value": "776a72e9782532a59fb1b6905d191648ba4ee965", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844193, "uuid": "d12974c2-567c-4a6c-b37b-b55dce7b7e73", "comment": "Malware payload (RedLineStealer)", "value": "0be5e322389000e7c9db00e1c7e842ebd06590436c54adf2246a2cd11ad8aaac47bfd37344bd4c2c45c8ac84398f60a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844193, "uuid": "874b42df-f63e-4f08-a5d6-a82ae38e3f20", "value": "T10D16338B774BDDEECBB81CF925403FEA9720C6E681CA613A01B5C7187D50D5BE1720A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844193, "uuid": "535be662-7b9f-443e-adc5-a2ba3c1fdd56", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844193, "uuid": "c21521c2-efa6-407b-9972-e50d16d5db6c", "value": "98304:fD1zLMeE/8/PhGlTdWCcscIX57M+4Lj94fcggP:fD1zLm8/PcICZco5M+G9O5S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647844193, "uuid": "6605a5d9-b6c9-4e62-8515-11dfe9397226", "value": 4120728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647844193, "uuid": "668bbc05-b538-4bdd-a7b8-a109c1a69629", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844193, "uuid": "c28e545b-af5c-432c-b64a-93a3c0e0a18a", "value": "36053707.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be6e989a-a942-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647886466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886466, "uuid": "79b6152d-e823-4d0a-8464-1c768b0b4e42", "comment": "Malware payload (RedLineStealer)", "value": "c0c9e9f46188886555479979980c56b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886466, "uuid": "8da28139-0758-4a3d-95fe-8c323d5ab303", "comment": "Malware payload (RedLineStealer)", "value": "33aa911e5bb98ff8e1bf00f95d2106e043beae64a6fc8321ccae03bcf0969515", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886466, "uuid": "7e6e6179-9f0e-4b79-b1ae-76a4b9b638eb", "comment": "Malware payload (RedLineStealer)", "value": "e083b506042b2a2886d8e102d969d164b229ad11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886466, "uuid": "80c2532d-2bbe-4bc3-a3b6-492df8b938d8", "comment": "Malware payload (RedLineStealer)", "value": "579c1f50a8a93d00e50226dece7eb6eae86da8f1868b4542ad809f3f8235b662a00bb22bedbc214a4fb0cbdcda3b603f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886466, "uuid": "f7223d08-95d7-49c1-809f-7c94a7ca9801", "value": "T188C423CBFF85ED9DD2CF89FED0253A45925BFA16E5E8705BE0AEA7C31B290929100054", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886466, "uuid": "5954a9e6-bede-48e5-b2ba-7dc9c791f855", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886466, "uuid": "fc6ec610-5d31-4144-9076-14d8a65809eb", "value": "12288:2EryAvpFnMrSbXXL8ledc0pxZ9ThQS03ULaHNqrxlKIQNoQfdHcmTpLhb:/y2pFnMObXX319ThkEaHNYK3hcmTFhb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647886466, "uuid": "987cf04b-9f7f-4402-82af-b7a0c590f2ad", "value": 567808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647886466, "uuid": "43c57524-83ad-4b80-be04-5168ea0e8d26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886466, "uuid": "c444df26-e84a-4646-9d87-73212deb5222", "value": "SecuriteInfo.com.Trojan.PWS.Siggen3.13005.23738.22414", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d0a2bab-a94d-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647890920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647890920, "uuid": "ca69a3ac-e48f-4813-975f-453f6bb2f783", "comment": "Malware payload (Loki)", "value": "23ae31e7fac453c70dac1aa1b7dd4378", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647890920, "uuid": "ad1ee3ec-77a9-46d2-91aa-0d46cf8c4299", "comment": "Malware payload (Loki)", "value": "33c363f03ce7dd3c750c1efc07c01bb7ec17a27324db252e7cbbb199ecd646c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647890920, "uuid": "8810c258-2ec5-4d1e-92c7-759893aba2e9", "comment": "Malware payload (Loki)", "value": "2b5e801941717914eeb1ac7a6691993d86035dcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647890920, "uuid": "03f6166b-c9b2-4243-be30-a1d2caf9df79", "comment": "Malware payload (Loki)", "value": "38d83c2b061538fef87559a8cfc8b008b4a1a57172b935ed392abe3760814dce3d6e1320fc6e00e915d27db6ca9487c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647890920, "uuid": "c2d9bcf2-601b-4928-95ca-4ca7ea19a70c", "value": "T14D64121EB9C2D56BCD800D3419FAE1B6A3FFDED82D8435479F9879492F33A341122962", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647890920, "uuid": "cc62e064-9a98-4cf2-862a-df130e2a3639", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647890920, "uuid": "85e1e31e-9a1e-425f-9bb7-328c72302dc5", "value": "6144:FGiJetcpExoeN0NwJWlt561xGtBI1jUtD4+S6eGKUQ4w3lxF3:beCpMHYl+GtAwtU+Q4qJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647890920, "uuid": "6122836d-1a92-4f17-98a4-dbdaf3fab55c", "value": 308463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647890920, "uuid": "7ba0598e-ecfa-4f19-a246-cf056ab40b34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647890920, "uuid": "335c05fd-69df-4223-b51d-a647fff69d21", "value": "23ae31e7fac453c70dac1aa1b7dd4378.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f092a03f-a929-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647875813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647875813, "uuid": "ab8eb35a-195f-4e6e-be9f-0e72dd7e9958", "comment": "Malware payload (Heodo)", "value": "4e18bcb28ffa2620b0030cfcb2f23ee4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647875813, "uuid": "bca2f3c5-2f72-4fbe-ac11-a3cf353cf435", "comment": "Malware payload (Heodo)", "value": "342fbbda8e71c4cabbff0b1aed747c726983651bdec718b115c8771acd4c09a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647875813, "uuid": "23e9186f-66dc-402e-a77e-43ee7a110443", "comment": "Malware payload (Heodo)", "value": "0eefb63d0706e927e4d47acf61a032422b0b361f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647875813, "uuid": "66df4a1f-7198-4182-8ee9-a7bc3a31735f", "comment": "Malware payload (Heodo)", "value": "b88e26309218501a9103a565987b3c4d7cc8b9f5dc269412fce44b2487146adacecc4f59693f52eacccafc87c97f44f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647875813, "uuid": "07cd6553-814d-4fb8-85ba-8cba5f5458d5", "value": "T1A4056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647875813, "uuid": "915205d8-7d4f-453b-86a0-80cd3c24c1b9", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647875813, "uuid": "12b765f5-b39e-4ebf-9623-407609e0a48a", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rc5CGNHrH2tZ+d+:gMV/rc5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647875813, "uuid": "936e79d0-933e-405b-a77c-2aec2c560f22", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647875813, "uuid": "962d09ed-0cfd-41b1-b9a6-b99588549d64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647875813, "uuid": "d5269674-1e5d-40b5-931e-044e3fcd9630", "value": "4e18bcb28ffa2620b0030cfcb2f23ee4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d7dda0-a8da-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647841675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647841675, "uuid": "1a2ec98a-5ca5-4120-a089-5794bed0c833", "comment": "Malware payload (Formbook)", "value": "e9334d8985f6e84c292cdc25bcde2996", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647841675, "uuid": "c5dc1aa0-61ca-4b22-b7e9-7b333dd21688", "comment": "Malware payload (Formbook)", "value": "344306cf602e182ab36367fbd4f16e9371392548f7905691c4329d3ee21094b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647841675, "uuid": "24da40da-2500-400d-8baf-9e8f69ec54d5", "comment": "Malware payload (Formbook)", "value": "982d9192b9541fd24e035d2db5fa1ed5fe1b3864", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647841675, "uuid": "ad4cb687-76f7-4aef-a63b-d2d7bc01d8a4", "comment": "Malware payload (Formbook)", "value": "dc50da8bd280c2e0e43eea81dc17d5e4f0562955d423cb2169f40ef171c4671f27425f8207136db12dd986a88e3478f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647841675, "uuid": "905b6544-39bc-4c5b-b6f6-cfcd9bda7e03", "value": "T174946E0321C79BBBC405F232C5B759A601D21CE929B2F53E1D553AFA6F31EB7BA42109", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647841675, "uuid": "dd806c54-fbfe-4b1f-8c40-4d7223aa2c90", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647841675, "uuid": "bb12c915-ce45-4f52-8710-602431d1fac0", "value": "12288:o2t8Ag88888A88Z+TIpNwetKF2hPWUia/+IadYhC:vEp2sKFyv/+IaGC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647841675, "uuid": "81612ea5-8547-40c7-a127-537341ea8466", "value": 434827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647841675, "uuid": "76b30f9f-34c6-497b-97bb-5f6e0a7001cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647841675, "uuid": "b72e6b8a-d5da-4505-b337-e26be016714d", "value": "SecuriteInfo.com.W32.AIDetect.malware2.19569.9787", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f05bbb-a937-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647881431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647881431, "uuid": "2fad0015-ef1d-4635-af53-d63d3d711bce", "comment": "Malware payload (Mirai)", "value": "31853eebedb9e9da11be5130907b2422", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647881431, "uuid": "3014830a-a585-46c9-82e9-260320dab23f", "comment": "Malware payload (Mirai)", "value": "3476a95bd2eb110f3fc6a9ea347891fb3970ac692c2998157b12ca12c08c2043", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647881431, "uuid": "cde7bec9-2fe3-4749-9ab8-b09a60f18edf", "comment": "Malware payload (Mirai)", "value": "4bf6a9c890c7704ccf031dc7dfa73423a46b8666", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647881431, "uuid": "d3d7d06e-73b7-4046-8537-d90086befc18", "comment": "Malware payload (Mirai)", "value": "34259eb5d3c343190b2ee84b3a8d1fd7eee3c58ae2c4f784544f6aed519890a197b6c4f6047ee75bbc271cd2bfa78ac1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647881431, "uuid": "befdf426-9d02-436c-ab92-a8f5f3003f44", "value": "T11CD2E190E30DE272D3F48C38A9774205525A36B5D4BA355051E7A3AE8CCA017EAEC83F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647881431, "uuid": "f5f90686-23c4-448d-98e0-5b727f8b06af", "value": "384:pWqqjnKJOzfL9A4pWEiK37x6RgEY2UY/v9VTAItdcw1J7/M7VRUWrCqmdGU5EeCb:iKwLS4pWALyoYn3TrdP+VCWrCq3UISg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647881431, "uuid": "4ebef389-ea6c-4515-8d13-16ae569295d4", "value": 28592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647881431, "uuid": "a1bba8d5-93f8-4de2-9f35-2bf5434ca498", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647881431, "uuid": "16c40b85-7e72-4f81-98e1-9c56d1a7c3ac", "value": "31853eebedb9e9da11be5130907b2422", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4bf9859-a94c-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647890853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647890853, "uuid": "343c054e-56e9-4bd7-99c3-5400efdd50af", "comment": "Malware payload (RedLineStealer)", "value": "abf8c69853829f6abc0afb0f340a730f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647890853, "uuid": "ae23fc44-9e19-4468-9a22-747b9c5b07d2", "comment": "Malware payload (RedLineStealer)", "value": "3479e0e85341c979b8a6dde00cfa7de49f21e9941a993f2569201fc57e792029", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647890853, "uuid": "262af3db-eceb-4637-9584-2df408c1b808", "comment": "Malware payload (RedLineStealer)", "value": "4f0e5631e4de1914baf7fda4780473812421e658", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647890853, "uuid": "8eb559d9-6ced-40eb-b18c-c7e639f0bc98", "comment": "Malware payload (RedLineStealer)", "value": "e8efe8362bbd7dee5b0035823a9168bdc50f4a34c68f4da8187ef0e2e426d38e68e6c3d5e49ab418c99a757e4fc9254a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647890853, "uuid": "8c3440aa-1d1f-41a7-a936-a6051a1213a7", "value": "T1CA84C000BB90C035E5B712F8497A93AD793E7AA15B31A0CF62D51BDB56366E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647890853, "uuid": "3a327235-88df-4231-9c42-cd0ac0a9d257", "value": "7288d715a9ee18d7dad5b71be8ad934b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647890853, "uuid": "7fc92e54-391a-49fb-9536-e527af484797", "value": "6144:bxB2frCIAhQVgfEqEuKvC3AyLGU6PZQq3+baoFUAGjPSm+wlgBJo:bifrCIMQVxjKoxaq3omjPSFB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647890853, "uuid": "ee5aecc5-907a-4666-8307-ecc8cf6f7431", "value": 379904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647890853, "uuid": "653e47fe-e458-4e75-b019-b2678a8a037e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647890853, "uuid": "b0558c83-a366-48b3-b93a-955918185996", "value": "abf8c69853829f6abc0afb0f340a730f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4a6137b-a951-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1647892973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647892973, "uuid": "399fc912-5707-4e99-b1b7-8c6df43134e8", "comment": "Malware payload (Gafgyt)", "value": "07dc3b97ef9b68619c50e241941d045a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647892973, "uuid": "9d24ca90-8ac6-4dd6-a0bc-66436ebcd0c5", "comment": "Malware payload (Gafgyt)", "value": "34c772bd7a9b20d0a5cc0ff4276a5bdcd6a3105ca2ae4cee13a0bcb1aa638f27", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647892973, "uuid": "141d1c95-8f8e-469a-bb84-c3a53199c41c", "comment": "Malware payload (Gafgyt)", "value": "b1a447ac9c795c601b0a439f2bf5b7949f66845a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647892973, "uuid": "6a69a3cc-a4ff-4934-a4be-94d7389fea7e", "comment": "Malware payload (Gafgyt)", "value": "bed2f22d8654fb77d37b8597385daa0ad7151e26752d4bd930881e3f4dae4e5fb9ed4db3fd5e75c12fcbe1b529a0b9b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647892973, "uuid": "7e2e1403-1b58-4ff5-ae9d-52f932c75864", "value": "T1F5E31925E454471BC2D323BAE68E425E3F221FE793DB33115A34BEB41BE179D1E29920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647892973, "uuid": "1ff56dba-316e-42d7-9402-2c7b091b552b", "value": "3072:K+0DxEwTga8V5+gOszZpeHPtiCFzzvf/9HdmhVQVovSUNu:UXca25+3HPtik/9HdmhVQVovSUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647892973, "uuid": "594b8412-b175-437f-9d15-ab792e0e8a56", "value": 147638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647892973, "uuid": "e40c7e68-ef55-4f57-b9dd-24519b4884fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647892973, "uuid": "341a6b16-f79f-481c-89c6-5aacfe4f1f1a", "value": "07dc3b97ef9b68619c50e241941d045a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18b7d56d-a943-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647886618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886618, "uuid": "a68221f4-b300-486b-b4ac-e14948f7f709", "comment": "Malware payload (RedLineStealer)", "value": "49c4ed70c704b973c65100d2dd7ca22b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886618, "uuid": "130873fd-9f0d-4123-98c0-5999170bf090", "comment": "Malware payload (RedLineStealer)", "value": "35455e459baa47322e815c09a609dac0877dbe7132b7fbfe291aeb579b2c3631", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886618, "uuid": "1dcb70d4-22ac-434a-8d2b-9cc66059f4f4", "comment": "Malware payload (RedLineStealer)", "value": "3e15366904384466f5fb26ab09b80b30a1cb0cdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886618, "uuid": "839ecb3e-04ee-44e3-a2bc-a359114022a0", "comment": "Malware payload (RedLineStealer)", "value": "eed535a4c79433d31d2e6d5f735c88ea115dea19ed0d93b056097b6db52f6e914bf803f29ddb83e6df9537ea91df1a42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886618, "uuid": "f27608c6-601b-4d84-b19b-4d6c88a7ae19", "value": "T1EAC4236E3255791DC39DEBF4A336BF4903D1826D64E2B183D71629C788B88B2C91C4ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886618, "uuid": "efa78179-40cb-443c-9c24-617e072bf0f9", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886618, "uuid": "a378d990-145e-40a8-a3e4-f8a334c91362", "value": "12288:WzKHg/sdI0007/uHNxpkQS03ULaHNqrxlKIQNo7EqolY3NVzrEem:uKAEy000gikEaHNYK3s7oy3NVzLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647886618, "uuid": "d74b6299-4d68-4d3a-a885-0540b85b4084", "value": 568320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647886618, "uuid": "69e2afe0-0c8b-408f-8763-52a17a7b8cd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886618, "uuid": "9d333896-f215-436f-b455-5aef431d8220", "value": "SecuriteInfo.com.Trojan.GenericKD.48638662.25701.15795", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eca25fc-a930-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647878548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878548, "uuid": "5e8b2d30-54b9-4fe1-ac32-1d73fb923c49", "comment": "Malware payload", "value": "eb5f3795ffb3a1192e437511562ddde5", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878548, "uuid": "d12e9e8b-54cc-4811-8888-72f070c475aa", "comment": "Malware payload", "value": "3567b522721c439702fef1bdaa439a314739491a04cb78666b5febad930a32f3", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878548, "uuid": "1e4d114d-1455-4ab4-8285-fed93821b9fb", "comment": "Malware payload", "value": "2bd189e90f2b3562084d5a162afec4249241addd", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878548, "uuid": "656d5be0-98c0-4e83-a628-1766692b0064", "comment": "Malware payload", "value": "5f0c90576981ce229ae11b1340725155840f4eae6abce9f62cfc79b2ef931edf70572a95fc2d767ffde8fc1d97822dd6", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878548, "uuid": "39b15789-3cf8-44e8-a532-628099367982", "value": "T1E8F36BB1F4E33CBB62D69C932078E6646EF06C5B874F6A14C171BBD049C1A605BF8D1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878548, "uuid": "e4a33cb1-be1e-49ff-9a3e-79525f43d6ca", "value": "3072:VQe/IoyOB3pzGLLgp3PpmGEpjjynD80zLZceeS7wfY3b+CNElegjzZjTnUMks6kU:V1/DF1pzGLLg1PYFjguS8Y3brNgJ/nUP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647878548, "uuid": "714b7720-4cb8-4210-9b09-3dc6c8e041f2", "value": 160781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647878548, "uuid": "d92e5194-978a-4dc4-a173-0da9e8ceb60c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878548, "uuid": "1fa885e5-a23e-4753-860e-4e3ca5fe72bf", "value": "css.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7354a26e-a8e8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647847686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647847686, "uuid": "8e715fbf-ec6b-4998-8cdb-e841b0b216d2", "comment": "Malware payload (AgentTesla)", "value": "ba9c807ba1ef35055af5a4443bacd20b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647847686, "uuid": "8821d328-a32e-4428-b7f5-1fc6ff42793f", "comment": "Malware payload (AgentTesla)", "value": "35745f99399f9d2a3cddb1ea463dcfbc8793ad471cb5913354d9a8fcf201c817", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647847686, "uuid": "97a328bd-781b-4057-a0c3-6d1bb5e6c844", "comment": "Malware payload (AgentTesla)", "value": "40f3736780a7d02a5d7edf18a982e4d5ff48d8db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647847686, "uuid": "a96e832e-cd05-463d-b408-46fd77baf5e0", "comment": "Malware payload (AgentTesla)", "value": "36036fc5acdf4a800b8d630621c8ee09c99199dae75865d853b87b0e33986d36530fba23bc8e64231fd13037f4075e97", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647847686, "uuid": "57041a09-aabd-46d8-9f48-428adb759fd2", "value": "T1EAF419BD715472AFC837C1728A945C64F650A8FB630B4A17E4931B9A9D0F4C7EF840BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647847686, "uuid": "d481fe14-3880-4717-a000-ba4dfda54ea7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647847686, "uuid": "31e079b5-135f-4329-98bc-5536fc83c2ca", "value": "12288:h39PvaeRL7WE3P00c+IpFjsE5e0lZtwQY6hUr36out1QAYe3t6Yuf+afo0QE7T8C:htPy/1QfK6Yufrtj46dP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647847686, "uuid": "a76ac9b6-7f12-46d8-9d5b-ae8c3f7d1d86", "value": 783872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647847686, "uuid": "07d81d74-af15-440f-8757-f36aed7b908d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647847686, "uuid": "dcf15746-2a96-4959-b2e0-e958a6536263", "value": "BL 216238068 DOCS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dd52a32-a943-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1647886627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886627, "uuid": "2017dd79-652d-450d-8d38-a95498c5f0a1", "comment": "Malware payload (ArkeiStealer)", "value": "ae1dd14e2ac195bb26b89b0c423bf8a2", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886627, "uuid": "bbc411a3-dc4d-4ee9-9cd3-e5800d835b35", "comment": "Malware payload (ArkeiStealer)", "value": "3606b946c1cf65fc08eabd4ed5b1cd48725660df302b96d662c13594f93e0621", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886627, "uuid": "de931b44-439c-4644-a5a5-7f2683b49269", "comment": "Malware payload (ArkeiStealer)", "value": "198a0ef67f8f58ef8b89668f689870f3cf3ec31f", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886627, "uuid": "e17ec4aa-07ea-46d1-bbc8-f24603a4fe33", "comment": "Malware payload (ArkeiStealer)", "value": "f61b10a309aaaa432ee0cac50d2340b41d8a131dcf650fbcb5916b1ad3acfb40ae6fb543fc32091b1c0af1c146b3f600", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886627, "uuid": "82c362a8-5eae-4c59-83cc-8c17201ccf3a", "value": "T1ED2623B3129925D8F4E1CC39D9B7FE9571F2136ADA81683CB4DB67C22252CF4E222543", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886627, "uuid": "adad04ee-058b-498c-bf64-f3133707dfd6", "value": "5abf78008992725916c98a59495f7ff2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886627, "uuid": "2e25c295-199e-4097-9ab5-935faf22aa9e", "value": "98304:9/3vpeZuPBILQM4gr+/Y69hjjqreTCuAcPwkjZ0O1Cl1l3iTjkA1sX+IUj+Hs:9/3UmiLQqC/xhjWreT37ljZepiTjFqzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647886627, "uuid": "4f291c9a-cf5b-4b34-b175-50207e8ba071", "value": 4797440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647886627, "uuid": "dbc36e31-804b-4610-aac3-97f98eae0cd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886627, "uuid": "e7981149-c2e1-496f-acaf-6558a12551b9", "value": "SecuriteInfo.com.Trojan.GenericKD.48638725.19327.11758", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83b6aa7d-a90f-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647864464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864464, "uuid": "11567593-ec8e-4a59-b927-46c0b665ee0d", "comment": "Malware payload (Formbook)", "value": "713a93bddd12a2ea76b8d97f01e25ff7", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864464, "uuid": "2adf734a-d16b-4ddc-bc4e-1959ae2ca787", "comment": "Malware payload (Formbook)", "value": "3621aded8ecef2d269382fa26ea42d634a89f6d31de2529207da8024dec74226", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864464, "uuid": "fd1a9226-e9c2-4b38-abcc-875158259835", "comment": "Malware payload (Formbook)", "value": "d9ae3a7ba43948a0689101f46348a4b31429491c", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864464, "uuid": "8f14bdb2-4f8f-409f-816b-b5f110c4a4fe", "comment": "Malware payload (Formbook)", "value": "a7d955bfd1ccc2a4571066b153ac8243d8c7e7dfd6ec6dfd21e420772c23a7d63f1442e922916639d8f24a21de4bc574", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864464, "uuid": "2c29ffc1-d23f-427e-857a-afe1b63d7190", "value": "T10725234A73EBD270D69E7271C0F7AA400BF4EB527953D709A8C0B2090743B9A59166FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864464, "uuid": "e4c16726-5010-4d44-a147-792917b12f54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864464, "uuid": "685939d0-ed1d-439c-b5c0-27a904efffcd", "value": "24576:jh9MVuJi+5DpEZJ28s1gpScGAxpdaKpSvzB+Oe:jTMciO8s1gpScVnMKEvNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647864464, "uuid": "9ce9b2c7-22b2-403b-b917-d6fe97f37609", "value": 1037824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647864464, "uuid": "8892795b-e106-4585-b0b1-70fe34ef4194", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864464, "uuid": "1345d9cf-527b-438f-9a8e-1241e915095a", "value": "DHL SHIPMENT NOTIFICATION 284748395PD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d340a427-a90b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647862879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647862879, "uuid": "1f7d41a4-b1c9-46c7-9c77-b33bbadb0b98", "comment": "Malware payload (Heodo)", "value": "c327a9f8fb36c056e558cf95d9c406d2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647862879, "uuid": "548560b4-40e1-47f9-83ec-6e1cf64a31d6", "comment": "Malware payload (Heodo)", "value": "36b23450a24b9b5b2eb690417106134d4b544ea5f0d7171cf8a8cb23150819a1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647862879, "uuid": "a28b5d12-7158-4df6-85e9-905f52c468b5", "comment": "Malware payload (Heodo)", "value": "f4892bae70f315252f98bab6262769d5573c61ce", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647862879, "uuid": "095aca34-2878-443f-af2e-ea4799dde164", "comment": "Malware payload (Heodo)", "value": "b0555ef98e87823507012604406604e8f794a89a4d8fb42893c748095ea946c6720105c74d32e5470c1b562bc42ccd31", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647862879, "uuid": "337a5bcb-33e0-4e58-960a-d1d2b2faefbe", "value": "T150F2AF31F2E28F55E436587C4A8CDAF4D73DDA2242067E2C309A53BC5F633566A4E24D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647862879, "uuid": "104324d2-1795-46ce-abf8-73f9e0b062fe", "value": "768:q0t+5eEAjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooaDx:q0t+gEUOZZ1ZYpoQ/pMA39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647862879, "uuid": "a3528744-2065-4bfc-ac0b-c2f7f81d4da3", "value": 36456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647862879, "uuid": "b5583dc0-3800-496d-a724-7a045f21cf12", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647862879, "uuid": "aa5114c3-bc27-4e49-a9e1-953d34264ff5", "value": "DATEN-0.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "110ae2a4-a93e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647884458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647884458, "uuid": "96d23319-54a7-4da5-8372-87cca358c413", "comment": "Malware payload (Heodo)", "value": "493eae284cc8a33adb2eaae15dfa491b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647884458, "uuid": "46f6a27f-06e3-49f5-9a8b-efebb653bfa2", "comment": "Malware payload (Heodo)", "value": "36ce1ae5233625c5bd8a4974827325a7ff9d70c9976835dd3e39f503cf8fe06c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647884458, "uuid": "f1e73b44-aff6-4079-a9d0-235fa8770628", "comment": "Malware payload (Heodo)", "value": "49f4d77bad29374748adaf1c66de9d88d1ce755a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647884458, "uuid": "2beeba2a-e770-4db8-9e66-86d2233e4aab", "comment": "Malware payload (Heodo)", "value": "00dab8b609002a041c6b58f5e8e13083dd5dc20eef87cdbf2195a463bee9f93e005944fa6536d31c0ef11de1048fab61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647884458, "uuid": "6108580c-c09b-42c0-8116-dad7a13bf95c", "value": "T15A056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647884458, "uuid": "04e2a301-6769-4e54-9930-190140b5b29a", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647884458, "uuid": "03497086-3adb-4739-b39b-c36af2e59ec4", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rK5CGNHrH2tZ+d+:gMV/rK5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647884458, "uuid": "99ee3226-f089-4e9b-beb5-648c4d407684", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647884458, "uuid": "ce0a233e-cbab-40c5-a76f-f85350a74a3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647884458, "uuid": "05decd1e-8234-4bc2-a295-ae2a2866876f", "value": "493eae284cc8a33adb2eaae15dfa491b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "837d0c35-a94e-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647891522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647891522, "uuid": "8f69648f-65b5-46aa-801e-1e5515b158b7", "comment": "Malware payload (RedLineStealer)", "value": "4b5b199371e7d6d6167ff5513f15e065", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647891522, "uuid": "6d075c59-9fb3-4999-9e12-e30b77c5674d", "comment": "Malware payload (RedLineStealer)", "value": "36ed7e4e8dfce10773b1b1f1b7302e80d38bfd75d7c35bc5da2abf9a8a0b99e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647891522, "uuid": "356297f5-0031-4d80-b371-b2ee31e0b460", "comment": "Malware payload (RedLineStealer)", "value": "3e2d561dd48744b9d53858850777aec6ffb9e385", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647891522, "uuid": "3b1e0b39-1ffb-4510-908f-0356f1ba4de1", "comment": "Malware payload (RedLineStealer)", "value": "278945d51baae388def9320a0c14aa484625d2c2530ef1a513bea20a7b2b6f65d269a34b24e17c262aa650126fe8de46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647891522, "uuid": "1b56f3bd-2ff6-4cd7-ab4b-dc6390afc021", "value": "T1EAA423CE1F416D09C28D47B019826F1E61DF5A2ABEE4F197391F0E478AAC427EA1D0E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647891522, "uuid": "112bcfc6-1fbb-4b8b-a289-2f260fa49030", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647891522, "uuid": "cd318045-90af-436c-8752-1c910e561ab8", "value": "12288:+mvI3MUlwev6S/+AnlQS03ULaHNqrxlKIQNoBI1mcOeOvql2r:xI315tnlkEaHNYK3V1ZOeQq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647891522, "uuid": "4e2b3446-ca40-4baf-88b2-85656649c612", "value": 480224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647891522, "uuid": "77dc2ccd-11d8-4cdb-9f7c-2acd05c058c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647891522, "uuid": "f1511fb0-fc86-4032-9683-7526c37c7ff9", "value": "4b5b199371e7d6d6167ff5513f15e065.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "481d1db9-a94f-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1647891851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647891851, "uuid": "afb7b25e-35f9-4662-9a28-cde73cf4e4f3", "comment": "Malware payload (AsyncRAT)", "value": "7a2549033df0feb0535ab3be6a4593a9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647891851, "uuid": "f0773777-d948-4572-bee0-a9daf4436b61", "comment": "Malware payload (AsyncRAT)", "value": "36faf1dd2bbb89ee96ccf5f92b272af3014c673701b3f39a2cf47ee245b3f735", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647891851, "uuid": "3a40751d-c8b3-4e82-ad7c-8ee8f37c59ba", "comment": "Malware payload (AsyncRAT)", "value": "a743d30b05eaf22811b567a9e0e6411e4e0334ed", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647891851, "uuid": "f1af1594-77a8-43f0-a54e-cdf69db158fc", "comment": "Malware payload (AsyncRAT)", "value": "b74f01152a9290d80605a3f284557a07678057084db6f91305e178d6a254cf7e35c02ee1fb7263405d23a0b0cecfb6b9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647891851, "uuid": "73b58f53-e58e-48a4-91ad-e007971634c4", "value": "T1CF232B003BE8812BF6BE4F746DF32245467AB6676603DA5E1CC441DB4723FC29A425FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647891851, "uuid": "f7beeb9c-e0c4-48b8-8ba0-8b43a6cad7f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647891851, "uuid": "08f1cf0a-a3cf-4181-8e2a-d4c329e550e2", "value": "768:au/6ZTgoiziWUUM9rmo2qrmCeDmLOsPILEQ9/TYT/Ei70bXubIGpD5FG79hse0Pu:au/6ZTgle2BsOLE0ETctbebIynG7sGGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647891851, "uuid": "aea05f51-f77a-44c2-a28e-ffbd905cc075", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647891851, "uuid": "f6ee2d2e-ac8b-4bc2-b2f7-b814713696e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647891851, "uuid": "7756437e-3faf-4087-864a-7f282a3a8a4d", "value": "7a2549033df0feb0535ab3be6a4593a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cf8991e-a8e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647848078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848078, "uuid": "a83fbf13-5f9c-4ffc-98c9-8b528c47afd3", "comment": "Malware payload (Mirai)", "value": "cd9b564346ce98d66726a781c4f556c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848078, "uuid": "209bc53d-28bf-4b50-9681-d1f002ca84fd", "comment": "Malware payload (Mirai)", "value": "36fe0f82d9107c1328c9fc827cbacf70199d4905f562d1e25e76ecc7282eb4f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848078, "uuid": "cd860f5d-f2fd-4ddc-801a-d0a71ab0a2b6", "comment": "Malware payload (Mirai)", "value": "27cc0e5f6931fe1aa86eba12fe806b7028aca421", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848078, "uuid": "27e62a38-dc69-44ce-aec2-0fe2b984669c", "comment": "Malware payload (Mirai)", "value": "8ae7dcdcd54bc6f929331f7efabcffc8154081e687f4ffde657d6677812eeeb81932532cd05d337129878c838512ad90", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647848078, "uuid": "a9336f80-7cb6-496c-94d6-00f15c9c21eb", "value": "T16FD3C71B6B518FB3D81FDD3706DA460220CDE55A12E87B6BB6B4C95CE74A84F08E3D84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647848078, "uuid": "88cec414-9ef0-4597-9fe9-0db24a8ef272", "value": "1536:ww4LeT9cL2PyuFieWhyfZTiqkWbnbvmo7CrYZM5hmSO7iXUnNF3xuhmqY1fqjBme:w5L2YheZbm+JM5hmS0F3xemqY1fuBmvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647848078, "uuid": "8f3c96bf-f742-4c42-a250-8344538f5146", "value": 137917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647848078, "uuid": "7a893681-62ca-4e79-89ef-4405b34580eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647848078, "uuid": "e2ee1f09-bbdb-43f5-ba96-2b25fc146118", "value": "cd9b564346ce98d66726a781c4f556c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3534397d-a930-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647878505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878505, "uuid": "68e82167-8715-416e-840d-ce481d3d367b", "comment": "Malware payload (Formbook)", "value": "942d29def788160fa47b0326b1385034", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878505, "uuid": "93f41138-0b94-4e2c-b49f-dc97285982b7", "comment": "Malware payload (Formbook)", "value": "372aa193e388209de027e3c63d898f3df4c4abf76023feaee4c99cca2d2daa0a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878505, "uuid": "4223371e-c019-477d-b0a6-89d435a368e5", "comment": "Malware payload (Formbook)", "value": "3da9bb05a47b87342ac8024be6fdefabdf57b885", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878505, "uuid": "0122c3c9-87dd-4086-be28-13c73185637d", "comment": "Malware payload (Formbook)", "value": "2d0be46cd1f480ea55a989b9e46cd37e900f40058f7f7f8cb81b1f19e7c2f16edc1877bf9aebd8da96f1d8e1f2fee236", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878505, "uuid": "9a96971c-cff0-4b08-9c0a-1a205ed7ae23", "value": "T1CF542398F42604D97EFCFF0CA109EBF9EE8FD230F595405E1566DEA5B21580B1326127", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878505, "uuid": "7f02b72a-2392-47ea-9a89-f0ed2ecbd330", "value": "6144:gom0UWS9J7AocXvt6ZVRyrtKVIogRPmKQGd8srHENF2rwwIszzx:fmoS9VA9/t6ZV/VZq0STwCwIx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647878505, "uuid": "37203888-2c3a-4b19-8f82-b5d73c952439", "value": 305033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647878505, "uuid": "e0d0ba53-5b0c-426b-849d-f7b369591abe", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878505, "uuid": "22013468-e965-4dc0-b454-ce229e66130b", "value": "Order Details_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ddcdb23-a8db-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647842013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647842013, "uuid": "8964a512-a2bd-4132-9205-6ea601807a77", "comment": "Malware payload (Loki)", "value": "1cdba79a0e2d573e2fca7fdf22d659f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647842013, "uuid": "8627a2e8-fbc9-477a-a905-039de655f657", "comment": "Malware payload (Loki)", "value": "3751aad3fe0a65a33296b3042e8ed1956d9881f33b97ea18976589bab4802111", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647842013, "uuid": "8dba9be7-780c-474f-afeb-47b313561445", "comment": "Malware payload (Loki)", "value": "ca76dae89bc0f203a42b4f085af268b5a4476411", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647842013, "uuid": "993f2a1a-745d-4898-8e8b-233e89402de2", "comment": "Malware payload (Loki)", "value": "37f9e657143ed0f47df0b3899bad18827bfba63d4abb2781fabf8e9ba849a3226ba4a8641312e22039213b11e4677dd5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647842013, "uuid": "4ac57777-aa9d-4e48-9846-a797d33f63a3", "value": "T11C946CC0E295F8D9D038407659B9E521261BA77DF8B8093F395A7519B4BB38320BBD0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647842013, "uuid": "34dd285e-c63b-4bcb-8deb-10540420da6d", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647842013, "uuid": "287cd3b2-762d-4346-beb0-cbfb147deb64", "value": "6144:KGidyWwxC1jZZZqwoXKC6Z/YKM68kefPonR0bIkI1z6d5fz1OKup0w3mO3lvM:Mo6C6PCOnR0MHz6XfupX3DvM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647842013, "uuid": "531c4302-d4aa-4f25-80a1-c0a4247949d2", "value": 427332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647842013, "uuid": "e48f679f-6c69-4265-aeaa-4da9ff4c5773", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647842013, "uuid": "64e539c8-32bf-40ba-a378-95668c44407b", "value": "1cdba79a0e2d573e2fca7fdf22d659f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99c3a01e-a953-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1647893706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647893706, "uuid": "4989c5bc-7dcc-40cb-a970-a4df3132a773", "comment": "Malware payload (Gafgyt)", "value": "2eebb2e0441b699371aefc07aa323f6c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647893706, "uuid": "b87848b4-7699-4953-928a-7e6b632885cc", "comment": "Malware payload (Gafgyt)", "value": "37d6341884ddf6edcf45ba68b22c857461649a92169ac15cb6545f0a3b44eac1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647893706, "uuid": "c9671efe-8c63-4b61-b342-f2594fa5ac00", "comment": "Malware payload (Gafgyt)", "value": "1c7e9c30f9877a6af530006d9018327397f7b55a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647893706, "uuid": "303d152e-c7e2-4121-b40f-88241217b0c1", "comment": "Malware payload (Gafgyt)", "value": "50c9daa3dc5f4fd91a173f39f0cf8aec768a5ad8fb2109c0dd611645db4d75ade7abde2001017c866b646ea346b666d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647893706, "uuid": "3565dfce-685a-40ad-b9fa-fd94c69d4c3a", "value": "T1FCD3E665F904471BC2D327BAE78A438D3F361E9797D733115938BEB02BE17982E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647893706, "uuid": "4b03c00c-8ab9-4519-9de1-138b4cf3e66a", "value": "3072:V7ZUQ4nuGKnhyTI96tO2OOgytd4kSwZmP4maQ3f0liHmNb:cQzG4y8ItO2AImP4maQ3f0liHmNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647893706, "uuid": "b5d3855a-5762-4dcb-9cec-b6c26a703efc", "value": 135153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647893706, "uuid": "7e54fe9f-6b16-4c97-9f1d-fc993e503c4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647893706, "uuid": "27a3c4a9-8055-490e-91d2-a903459ebbbd", "value": "2eebb2e0441b699371aefc07aa323f6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9d9e18f-a95a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647896820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896820, "uuid": "adaecc9f-72cc-47ad-88b4-fabfdf00f5b9", "comment": "Malware payload", "value": "869777e2d1cc0bbd277ec8a93e0de33a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896820, "uuid": "4a4cd5c1-f78c-4d2f-be22-db786baaa312", "comment": "Malware payload", "value": "37e76411c2e51d5a19372808e2d3272c63e1898ea0100fe2838277aeced5bfd4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896820, "uuid": "64e3ee23-be25-4d3e-9bfb-95806a7311ed", "comment": "Malware payload", "value": "9b8c2acbe7f09d41e82814fa2a72c8dbf64098e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896820, "uuid": "b9bcdb9b-a275-4872-88ac-00aedb0987b3", "comment": "Malware payload", "value": "eca56a94509a5e553b675f5d7662994bc920c85777c52f9ed3514bf5b728893b1b1ad4e80c7046f2ecf4a0573334808e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896820, "uuid": "95d11dae-696e-4942-abb1-b7012bb99828", "value": "T14154BF00BB90D035F1B701F849BA93ADB93E79A15B2594CB62D52BEB52357E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896820, "uuid": "a922a15b-3271-40e9-8546-39a6cf3130ab", "value": "7288d715a9ee18d7dad5b71be8ad934b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896820, "uuid": "3c3a82b6-4cee-4d8d-9b72-b15ec20683bf", "value": "6144:bBTHo2Y/khJQMqpYmiYWixWvzEiQUizo:bJo2Y/khFiYbyazmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647896820, "uuid": "6c20d7f7-7387-4227-8875-6351cf5d75ef", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647896820, "uuid": "649c9681-d452-48bf-bb03-8d70adf1388d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896820, "uuid": "c9e9484f-ee8d-44c3-adb1-87d7be69c23e", "value": "869777e2d1cc0bbd277ec8a93e0de33a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a485839-a92c-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647876769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876769, "uuid": "5dfe2357-3ee1-47a2-8fac-fa1c156fdd13", "comment": "Malware payload (RedLineStealer)", "value": "465a7f47545fee604dc5594a99162573", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876769, "uuid": "03a8110a-1498-4ccd-86de-4749059fc563", "comment": "Malware payload (RedLineStealer)", "value": "38562a68bf295ab07b0a11521d3ed8d89eef1d95bb70f4274f494fe134dd7033", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876769, "uuid": "b9672cac-6820-4622-99ba-550497cad145", "comment": "Malware payload (RedLineStealer)", "value": "e9f66fe1b93195f285518a7618678953b1d5a8d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876769, "uuid": "c05b9957-34b9-4ae1-aa6b-c22165647222", "comment": "Malware payload (RedLineStealer)", "value": "48b78052b7fc057b2b704ee8ae2212dbc789e78718122eae3a6440ef1e342876cc551dde1872d011f4a9c688c4572722", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876769, "uuid": "cadb2aba-c56c-4e45-98d9-4153afc9bf29", "value": "T108A35D6973DC4B25E5FE8EB478B1515143F0E1A25C02E79E4FC5E0A90E26B84EB12BF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876769, "uuid": "99a473cd-2989-4542-be46-11a1d250a975", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876769, "uuid": "87795398-9c6c-4026-a9e6-ab82074da0fe", "value": "1536:Z0DUkCrnG2IdANcZFR86yl3R0Sp2pnZI8kLdbuTxWrsvU8L0:ZACrnGmy45CS0sxwvd4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647876769, "uuid": "f1ad7e34-1681-44c2-b698-3fee3c54319b", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647876769, "uuid": "9ccede48-3a8e-4f60-9295-ae5280165684", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876769, "uuid": "f7a26c4f-1789-42a0-8706-5ded27833690", "value": "465a7f47545fee604dc5594a99162573.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e20a6dd-a8f0-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647851167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851167, "uuid": "8fa3caa5-195f-4a9b-991c-fd2a750e7673", "comment": "Malware payload (Formbook)", "value": "56cb0e541d9478d0bf3008cd3e474d89", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851167, "uuid": "018d888f-47f2-49ec-bbce-cb97e2a3c189", "comment": "Malware payload (Formbook)", "value": "38692054cdc0215f44e46c2b8c88ca566971a94c99298d0b51994b1e9b4d8e19", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851167, "uuid": "6fd7f24a-8757-4f50-a0df-077621bd2402", "comment": "Malware payload (Formbook)", "value": "9a81755a0d3b97c691df1fb32b300128c24ef7da", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851167, "uuid": "58c97910-573f-4d47-a209-9b99c85e468f", "comment": "Malware payload (Formbook)", "value": "62f238bd77702116fd60ebf991fd6dcdb71b64ff32cb9a0cfd4534258821407f59e72a050bafa454d5e8210da9180b76", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851167, "uuid": "2f9848a4-c3af-4022-a882-835e6f59e2d9", "value": "T179041208FEF5BBD4EDC16BF6B512AA580964ACDDC03B7C425476BE3CA930D078A09523", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851167, "uuid": "77449097-9437-4a3b-b548-59b5930b2de4", "value": "3072:HA1unJgCA4TQWEgR/C6qJvxlugo2APtTvSfX30BPWCXUH529hBMtUYUEsN:DJgiTDcJvxlU2DfXEJWwUHYjBnYn8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851167, "uuid": "7af70e5d-37ce-4766-8210-db6ab4f6096d", "value": 186456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851167, "uuid": "1769909b-bc9b-4605-848d-fb69fbf0113d", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851167, "uuid": "bd2062b2-dfd9-4572-a876-a7c64ad9f972", "value": "SOA87594094.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "444299ff-a919-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647868652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647868652, "uuid": "199d257e-e927-45ff-8c19-5fd76bd24373", "comment": "Malware payload (RedLineStealer)", "value": "e0f1022c3b042a5eff062405b9e5d116", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647868652, "uuid": "90ba5bf6-4c0e-4594-9d28-9636843a8fd5", "comment": "Malware payload (RedLineStealer)", "value": "389b1ddd25c9fa562c81bd7df3e68cedcf337f75e1cdff8f44ae6bbd5aaacb51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647868652, "uuid": "92d2b81a-abe3-41a7-b360-e4282932b287", "comment": "Malware payload (RedLineStealer)", "value": "79a62d275702d22dc2f39fbfb9631c190c437be8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647868652, "uuid": "53ac18b3-81b7-4f51-8bc0-6a1fd6e70dbe", "comment": "Malware payload (RedLineStealer)", "value": "4fc2dfc6020a4abb7f4bc8373cc089b8ea95915abf6f6398fe16b1bf2df9b1fd6f79bedf1df600c6f1122cd38d6cf6b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647868652, "uuid": "19a2b86e-953e-457c-9afd-375c890d46f1", "value": "T16794DF40B6A0C03DF1B312F8B87AD369652EB9A15B2055CF62D62BDF16346E4ECB1317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647868652, "uuid": "930dfe1b-7723-46e7-aada-e1561bd7e231", "value": "5761b9d43ffb6d646c886cb4b6f3b2d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647868652, "uuid": "209925cf-bdb3-48fb-8cd3-8cd97a31f124", "value": "6144:qRdF6mOwj1fKJWGBw1QFobP2qNoXE/P0TIoJWOMqxzf9/Jo:EimOwj1iJHBTSbPZkBQIx7p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647868652, "uuid": "31b4b884-6974-4329-80d6-f4bf769fef54", "value": 408576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647868652, "uuid": "8939aa00-222c-453c-a2bc-37ca39094ac2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647868652, "uuid": "7abd3123-0d0c-46d4-8dc2-a420df1ee79a", "value": "389b1ddd25c9fa562c81bd7df3e68cedcf337f75e1cdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2364b3c2-a91f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647871174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647871174, "uuid": "75346517-c06a-451a-912b-381e3a659588", "comment": "Malware payload (Heodo)", "value": "8f57ac360403ef9a9f2bb294d431d7f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647871174, "uuid": "0b2c85ab-da68-4c91-9205-4e5abdac9b08", "comment": "Malware payload (Heodo)", "value": "38f1f970b6f30ef915b37bf42c9b9fae414774b3b7f80266e4cab9af09789e87", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647871174, "uuid": "1d4e4c9b-5341-4c13-8ca4-2a653fadbb68", "comment": "Malware payload (Heodo)", "value": "55fe3620abda664795e440e70f82fc09226e2630", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647871174, "uuid": "0cf9012a-b410-4c70-9421-4f0f53187427", "comment": "Malware payload (Heodo)", "value": "e9d4bd130a71e53be73d8b7bc5336ea722f2ed78f8a0e3ebe520e27959663631e6f01f53da2e2453400221048948896b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647871174, "uuid": "ad63d339-74d4-4d10-998f-60a6c7ebd57b", "value": "T167056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647871174, "uuid": "6e11bf13-228e-45f0-a446-1ca9b2d525ce", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647871174, "uuid": "acc719b0-1f03-4329-aaf0-42e4fab6f0ee", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/r75CGNHrH2tZ+d+:gMV/r75tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647871174, "uuid": "b6a9365c-5da6-49d5-9191-f2759316b3a6", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647871174, "uuid": "d0c2fd21-e467-4d68-a6f4-efd3858d3c3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647871174, "uuid": "2cb556f5-1171-4597-8256-4de0c3e0ab8a", "value": "8f57ac360403ef9a9f2bb294d431d7f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6642ae4-a8df-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647843986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647843986, "uuid": "11a9dac2-0427-42dd-b3c7-1bfff86ac20d", "comment": "Malware payload (RedLineStealer)", "value": "64568bc8f1894d0b16e18bb59d1a4aa6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647843986, "uuid": "b6a06e5a-ffe8-4032-a6d3-6a3f5ab0c58e", "comment": "Malware payload (RedLineStealer)", "value": "38f6f1df2319c55af8641ac1aace82d874832d8d8806fc3fe033b7bc9c8041c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647843986, "uuid": "b6570150-d236-4980-8749-ff2227228ea5", "comment": "Malware payload (RedLineStealer)", "value": "5bb0b804e251517cf20cb8c5b5183247c9ead500", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647843986, "uuid": "4a6e3679-95c8-4605-99a5-6cabe7a01e80", "comment": "Malware payload (RedLineStealer)", "value": "4a10a3c771733517b510d9f5dc7f6d66136936b0e6ac1a2d88ab61c9439b8283b915bcd884c8ea6a6d0debeffba18892", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647843986, "uuid": "a5264575-b62c-4241-aefa-7a7043548162", "value": "T1B136335ABB10BD2EC00EB9BE1AB73516CE5551D71EA82803F89CCA475C0383F759B936", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647843986, "uuid": "8609f8b6-33a2-4655-9441-8de72e704ffa", "value": "dfec469ff9e19f9df882decc3c09398f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647843986, "uuid": "6c7683ac-4f67-403a-8dbc-8a9753cc84d2", "value": "98304:pzsNc1cjFyzO7kcOAAb25Nf8te+7cnh8Xqm04fvcJm65Nes0:pINc6pyi7kcOAAor0cnGX0Jm6ep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647843986, "uuid": "5419f4d9-9113-478f-862e-cc750a387d31", "value": 4864664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647843986, "uuid": "f724ad73-af35-49af-8ba7-fcdd7dcf6bb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647843986, "uuid": "832c2f8d-67a3-49f5-bc38-19c927a8337d", "value": "33895278.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c03c0b16-a942-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647886469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886469, "uuid": "aa05d456-0b44-4ed8-99a9-1f32164feffa", "comment": "Malware payload", "value": "6109d3eb95379d204c6e43d9c5603da4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886469, "uuid": "a8c8969d-8ee0-4593-b1c9-15574fa71712", "comment": "Malware payload", "value": "392d92c5987f4aeea5e9988e126bd19798c3a63e60917445f67df835c15d598b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886469, "uuid": "188304cc-6929-4558-997c-2b8e133279d7", "comment": "Malware payload", "value": "c0b95c1f6de9bbf2a52fcd8c9863a671ac46fb5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886469, "uuid": "10d3ddb6-949e-48a8-b15e-489bd3521294", "comment": "Malware payload", "value": "ef8ceb7386723cb360ba8a952d8b1f1ab5847aec3fbf0d9d53812630470d8c2adf437952daac33be5f10a1f9685cca8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886469, "uuid": "d537659e-58e6-41a8-acdc-e03ab36614f1", "value": "T11234469D726072EFC867D472DEA82DA8EA5074BB931F4203902715ADEE4D897DF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886469, "uuid": "8d0acfd2-984d-4424-834e-4f44fedd8e3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886469, "uuid": "0efd36dc-a51b-4de2-be36-c693e07dac53", "value": "6144:mchW+kj10s/e4AcbDpWGdOgaqB0mDk8eff1+i05hI7yZB14mM0+9lHPDv:m+6TbDpzOgaqB0mDkzff1+i05hI7yZBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647886469, "uuid": "83f8d4c0-3670-4e88-a198-f8812591e815", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647886469, "uuid": "62225433-3df6-4f8e-aa31-f2ce9dc36e02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886469, "uuid": "b896de57-792f-49f9-a494-920dbdf5b53d", "value": "SecuriteInfo.com.Trojan.GenericKD.39253528.22153.22248", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30c8bf39-a959-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647896107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896107, "uuid": "0ae9209d-2763-4afa-b978-d66e41becd0b", "comment": "Malware payload", "value": "5ccf39d48c469852c8a8d82e5c4a1942", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896107, "uuid": "7a111fd8-ce00-4e3a-afc2-ee0c3dfc549a", "comment": "Malware payload", "value": "3a1a8fb165a7589d743d09cc887c53c9d77805aff0a3395d6c9c8e52b2eb1efb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896107, "uuid": "26c450aa-26d0-4f94-b039-f10d3cecba55", "comment": "Malware payload", "value": "4d1f7601fa44d39bdda69f2edfcfd321aa37d634", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896107, "uuid": "d8d5581b-d57c-4700-ba51-cd2d5770aad4", "comment": "Malware payload", "value": "754f876f9ae991df4de92297a2782e2a9614fac99005012d89fb7fbb8bec3f8e12d9ca2da3179a231c1df4af7f121332", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896107, "uuid": "be5bd4ef-c0d1-4168-9ae9-68064c8151c4", "value": "T19CC5331057B7FA30E59315318693FC317D53E776F32C29B28230794E6E92F5A2E6A046", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896107, "uuid": "6185d87c-79be-4b42-bca2-caacad22a445", "value": "7013cc22a255d39b6ab069fe72175bd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896107, "uuid": "d4e9a030-70c3-44a9-a98a-811ece9e5834", "value": "49152:ZHlFNB72IsDuzLaZn/IvDsh9sfHmEPFSkFm/ZBJPK+uTa/caB:ZbH7QuXaZ/I7shYG8FVgRBNKBT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647896107, "uuid": "4307a1e9-196d-4f81-987f-8dce5fc8af77", "value": 2503872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647896107, "uuid": "a9155e62-74f1-4d50-ad9f-e717e5639c01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896107, "uuid": "f9194734-b130-440b-9eae-2c0e57ea27ef", "value": "5ccf39d48c469852c8a8d82e5c4a1942", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e0daebf-a936-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647881124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647881124, "uuid": "468d2154-7ee6-4be3-ab48-6d1a05277d9b", "comment": "Malware payload", "value": "f994697106f7c6cef2f394a9429d9e67", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647881124, "uuid": "227ba822-cc13-4d6d-83ea-0bc1ba58d893", "comment": "Malware payload", "value": "3a2a1eff040a79d603b1ac2609a423ad8beb46d2876aa959f60dc98477707c0f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647881124, "uuid": "04570d99-288a-4df2-ae0a-5b9ce405c93a", "comment": "Malware payload", "value": "15252272f8d6911731eef807a49f045ff97a8a46", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647881124, "uuid": "57e0ff91-62cb-4588-95c1-6120ff32c33f", "comment": "Malware payload", "value": "6e608c09fc88d3d7034cfcd37c0764e2d09df985dc8e9a112a5ddd5ff31b20437b11392f7d9c47e770533a22f0f90a32", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647881124, "uuid": "fd6b529d-a647-4495-9d4c-a2c282dd069b", "value": "T12A252346FEC29F63E26B9974A9D7C56E622CFC496E96C007B3657B0C7078BB051E200D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647881124, "uuid": "1f646be7-643c-45a8-8bd4-1ce58a251b75", "value": "24576:IFW1KECuoOpbodVYnRI50bl1n19X6cpALHKeZBdQm1Xbd:YECuoQb8Vf5ynfAzpT1Ld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647881124, "uuid": "8a2b7481-6d3a-437a-af26-6c24245bbced", "value": 965632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647881124, "uuid": "bcab86ea-8894-4b45-ae54-e58cf6e6b9bf", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647881124, "uuid": "5f80221d-cd97-47a3-97c1-70243085853f", "value": "something.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0372e121-a92f-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1647877992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877992, "uuid": "4d8f58d0-9d0c-4cf8-830c-eef71d9da073", "comment": "Malware payload (DCRat)", "value": "1aeea640109bda15a75a82d6ee945b66", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877992, "uuid": "178be957-bb2a-44df-b9a4-023b24117ef1", "comment": "Malware payload (DCRat)", "value": "3a713f613b16c0b5424671e3c643af5cdc60193cfcb0aa73b9743f69b5b1fad1", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877992, "uuid": "1bbd9de3-4149-4692-8647-97a82f38dbbd", "comment": "Malware payload (DCRat)", "value": "fd993b03047ba0faee3d9356eb18313832c5fdcf", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877992, "uuid": "6a326b38-a291-4e89-9f63-40a6387bb686", "comment": "Malware payload (DCRat)", "value": "2997b169194c44cb90747911166458c12c3ebf466e93035e850212840237f462a80bd416083c59a375adafae7fe2d5c2", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877992, "uuid": "b88925d4-dfdf-476a-bc77-d1dafe9b5adb", "value": "T1E185619D766072DFC857C972CAA81C64EB5074BB931F9203A46316ED9A0D99BCF180F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877992, "uuid": "1240417f-2551-4abf-853e-67d055d270b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877992, "uuid": "762eb4f1-ef58-4583-8f93-d587cc5ebe85", "value": "24576:UCMxEE4Qwe+PJ00YKIMrMkiHpXx7MmhjVK3UjXDZbUwX6Vy8pc1I:Ace+P/MCMkiL7JjQ3UwMrI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647877992, "uuid": "24650fea-4d16-44ae-8548-cebde42ee10f", "value": 1723904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647877992, "uuid": "119c3641-2596-4305-b9d8-fba198b5ae16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877992, "uuid": "da619b71-6d4f-4b41-801a-941ef7a3f874", "value": "1aeea640109bda15a75a82d6ee945b66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1008f70d-a8f0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647850955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850955, "uuid": "a34af35b-3ed3-4b54-ab82-57f2f178506c", "comment": "Malware payload (Heodo)", "value": "622b303f4321bcdfcf4aae01b0b2646e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850955, "uuid": "0903fa63-8dbc-47e2-a099-cca869965bf2", "comment": "Malware payload (Heodo)", "value": "3b4961e0e729dab6658d51d6e2c2461c7c61c8ba0a3822e63637a029eb3c3aee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850955, "uuid": "1a0b22b3-e77c-4a39-ae05-dcf9e72f3ec0", "comment": "Malware payload (Heodo)", "value": "cdc6de0fcf3b25809f2ac39e351a999db80e1131", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850955, "uuid": "59b61a67-ff04-48ca-bb72-da37b67cee61", "comment": "Malware payload (Heodo)", "value": "a72247bb8c0b4ed8fc28a393544eef2894e44578ffe235b4fcf696d98c0d7ebb73a8dfa6cfb6c90e1f7272d8046bf6b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850955, "uuid": "789c39f6-3486-454e-a45c-61c31c87b7e3", "value": "T1D7056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850955, "uuid": "765cc923-874f-45b9-b53f-6044165ba43a", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850955, "uuid": "00b057e0-9960-4ac5-9969-ee712b8152b7", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rN5CGNHrH2tZ+d+:gMV/rN5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647850955, "uuid": "4910a48e-8407-4806-a4cf-1e596a532a88", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647850955, "uuid": "50f5323b-61fd-4ad7-8cb0-6c25d4fef43e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850955, "uuid": "e54b5443-8253-44c6-9b41-57200eb621c7", "value": "622b303f4321bcdfcf4aae01b0b2646e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72f3e959-a942-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647886340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886340, "uuid": "83dc074d-e358-44e3-bb81-8b5e062c1769", "comment": "Malware payload (RedLineStealer)", "value": "dab3cf7a5515e2206cf59cc9cd5a538e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886340, "uuid": "28d2533d-bd00-4915-a3ce-ee52885e38e0", "comment": "Malware payload (RedLineStealer)", "value": "3b6e06a6b50babda243c9e6c44a71633eac893d9a43064f58e118743af13d95e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886340, "uuid": "956503aa-c249-40bb-bbb1-9b7c6f38426f", "comment": "Malware payload (RedLineStealer)", "value": "4f198fb0151e9a0fc2f87096218d548ea531257f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886340, "uuid": "b80a2e63-dfb8-4b40-9ef9-d27a95be176a", "comment": "Malware payload (RedLineStealer)", "value": "87eced3ae6df0000998ca41ef918635c853aafb6b4549c622194fb35e586a8525e05fc9d0f9cc7579f2e38e711bd190b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886340, "uuid": "9fc0551c-2ed5-4245-aa6b-78c26157037b", "value": "T1E084C000BBA0C035F1B711F949BAD3AD792E7AA06B2555CB22D41BEB56347E1EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886340, "uuid": "a17c5578-2d0e-4d85-81a2-ebc96f821fe1", "value": "7288d715a9ee18d7dad5b71be8ad934b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886340, "uuid": "215cba8f-d050-4174-aae9-bec32d169d5f", "value": "6144:xYYIuUe8M5myue8qgI1aNXG4iHF4UbN7+sfTnbarVO69HIoY:x8uUe8M5myyDgaBiHCO7+Ey9H4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647886340, "uuid": "5388fc54-e5ef-4b95-b4b9-3b6c8658eac2", "value": 380416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647886340, "uuid": "30a1f99e-aabd-449f-8088-5fa7f220be8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886340, "uuid": "1030a6f0-e306-4ae6-a7b5-4f4a32789471", "value": "dab3cf7a5515e2206cf59cc9cd5a538e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d61b23ef-a947-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647888654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888654, "uuid": "0fa45299-7d03-4689-a0af-a830bad117c4", "comment": "Malware payload (Heodo)", "value": "910742de2acd76a9def13631f57a7a8c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888654, "uuid": "a24743ae-a294-49a2-8bf7-457284bb34f7", "comment": "Malware payload (Heodo)", "value": "3bbe460696d3f4fe45ace7c76f29be07633f9626687e214553597e780faf978c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888654, "uuid": "78873147-ee4e-416a-b5ad-3886a4811e9f", "comment": "Malware payload (Heodo)", "value": "faebd62dcc8284f437261e6c867320b35e1ab378", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888654, "uuid": "8c2262c5-c1b3-4e50-8d21-19e72d7a7aea", "comment": "Malware payload (Heodo)", "value": "bc6f1d10f6fd2c5121b9a85eaddf1d6f0e7ce502118451567c71589efc04ca623a0d05e07307f74701b0deb4c23ba926", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888654, "uuid": "929ea5c0-bd63-4f0d-8e7b-3ba2242567ca", "value": "T1D3B43A11BC916832C36FAC7456073262588EE7F0DBD1F26FA3E0495C9A7C5E36624BC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888654, "uuid": "6954e755-ec26-4fb8-a91b-122d5f6cd421", "value": "14e6ae8d1400b6271725b3f01025b85e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888654, "uuid": "020d63f6-4471-4157-aba3-dc5960e18bae", "value": "6144:VikzyaB9eoCyx/mEhHB5RYSJ/xi+qiCjzQNPj79GkqbscgCG5qH6scI:VNnCGmyHB5SSJpl0zQN39GkUGQSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647888654, "uuid": "e76999f2-352b-4434-b5bb-c70cbd880d52", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647888654, "uuid": "80ccb10a-58bb-404c-aaac-7f495259f0b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888654, "uuid": "bd48cc1b-0871-47e3-ad8c-91262c62d035", "value": "emotet_exe_e5_3bbe460696d3f4fe45ace7c76f29be07633f9626687e214553597e780faf978c_2022-03-21__185046.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba4df29b-a942-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647886460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886460, "uuid": "1c7d25ed-891e-4e14-9d4c-6c1aa7b09e28", "comment": "Malware payload (RedLineStealer)", "value": "f00a9f9aeb46d0a7e005023ffa001a46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886460, "uuid": "bb71da3b-0b10-4d73-ac4d-61e8bc47ff86", "comment": "Malware payload (RedLineStealer)", "value": "3bd5ac1c10856687c6744794dbc4c0892d6769c9f6a6b73c70caa78c18f66be2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886460, "uuid": "40aa280f-d000-41e0-8ea6-71715968c738", "comment": "Malware payload (RedLineStealer)", "value": "8f8275281341683d80e5fe1d0a07427a8da6d91a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886460, "uuid": "04a6dba2-347b-42cb-a140-7fd078893a50", "comment": "Malware payload (RedLineStealer)", "value": "5924b4a44e525a9366236b1cc996bccc566647fabafc28bcc971c504b3d3a15551478eed5df4d717bfbc90336aa25ac7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886460, "uuid": "d38dc21c-4eaa-4946-82e4-763941052162", "value": "T1BA16338EFBC74997C2291BB494334A97C4943C75BFAB3EDB000045EA376B952B3924D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886460, "uuid": "1fe4f9ae-763a-4699-a473-24bbb3b6ba8b", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886460, "uuid": "44cd6c4c-61a9-4597-91f9-0eedbea941bf", "value": "98304:WLen25tF/JPiW1/AP/+zBBJ8wLxyDxubpggzQ+kliiPQN:spHxRiM/AuzB4D+U+kciPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647886460, "uuid": "523b2ce2-9013-4b41-844d-92c1dd4d200b", "value": 4210176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647886460, "uuid": "618a9451-d887-4c8e-8c3b-76a4f5e1ea0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886460, "uuid": "f91dd339-0d9c-4093-a189-51c24ef62734", "value": "SecuriteInfo.com.Variant.Fragtor.66835.840.5082", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c35e84c0-a915-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647867147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647867147, "uuid": "19e36931-b53b-49a8-b056-a1d7ed9206ba", "comment": "Malware payload (Loki)", "value": "68f58dc20998285a9a6144e9077e168d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647867147, "uuid": "2319399a-8db2-445c-82af-e319d710ddeb", "comment": "Malware payload (Loki)", "value": "3c2bc9cdbfa19ea447882b31c4212591b3734813069b48e2052945dd0b781439", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647867147, "uuid": "9a179542-aac4-40e8-af01-8194511bd0c2", "comment": "Malware payload (Loki)", "value": "5fcb6f0c001c6d62150d607ce7765a524e055ed7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647867147, "uuid": "3d60ad14-ce35-4058-9cc9-99277ad1b9ce", "comment": "Malware payload (Loki)", "value": "615eb62c469f227a22b1ab048a4623435f1f5afacc088ccdd278d7cc30a15ffacc99090413acb90702d1b4dbd2460365", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647867147, "uuid": "a91aa76d-e01a-49ec-89e3-edcbed018a4a", "value": "T14673C021BF0B9902C63A57B086EAC5802B3053C75513C92F29DE9148AF677CAEB51F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647867147, "uuid": "c7c7f379-ac7f-4dcd-a93d-3c5ce0261b61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647867147, "uuid": "3086d8d8-124e-403f-bbaa-1bb2637ca975", "value": "1536:Q8zWUC7znVEgYGCSXKzNwFsFIJp3LKLqekn9F+Pszo:QaWzz2gucdaFSKdkn9o0M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647867147, "uuid": "c668ea62-9630-4ef7-b875-12cd7564ad28", "value": 78600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647867147, "uuid": "05f5b946-55bf-487e-ad74-d53a3aad4ea6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647867147, "uuid": "61e7bc95-3d34-436f-a17b-a5bc9913942c", "value": "RFQ-ref. No. MS-DGP-2201378.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c085d1d6-a8e6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647846956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846956, "uuid": "52532f1f-bb6c-40c6-b5eb-e13b8deaba1c", "comment": "Malware payload (Heodo)", "value": "91d473775f0b885f76527e979b592a7c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846956, "uuid": "a093b370-06bc-4cc3-a53a-bffa3cc63117", "comment": "Malware payload (Heodo)", "value": "3d48e8ea0f0365174a7f08f99fd7af2e10ba49e538af6125e007325504d5444d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846956, "uuid": "48b8c05e-6425-47ea-9494-4add6021bd94", "comment": "Malware payload (Heodo)", "value": "d9f05b3cce7f52bbf331bbe1648d51df21adfcae", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846956, "uuid": "140dfc8f-05ff-4719-92ae-a3d86d1bdc85", "comment": "Malware payload (Heodo)", "value": "ea79a643599a61412a9750c2cb9b6c5151a8852bc3190ce608bf3fe701b1164b7c9c44d7efdb6a3968044767b3b6d611", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846956, "uuid": "2801a301-7a79-4938-bf76-e0cf2d1fa362", "value": "T1A203AF30F2928B99E13A947C478CE9F583288B165141BF2C309563AC5F536B67F8E24D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846956, "uuid": "1023247f-8324-421b-8628-250801f81ee5", "value": "768:ybdpCR8kjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooFVIyYS:SwDOZZ1ZYpoQ/pMAeVIyYzaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647846956, "uuid": "226246cf-b75e-44f6-b561-2ca974cd773a", "value": 39713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647846956, "uuid": "5f0b02bc-6e0a-422c-a6e9-41ebb1f6eb26", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846956, "uuid": "9a803fcb-dccf-4658-85ba-bd8fd8b48506", "value": "UntitledX2,XUS.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "754940b8-a8e0-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1647844253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844253, "uuid": "c4c5893e-2ed8-4055-b846-edb548858eed", "comment": "Malware payload (ArkeiStealer)", "value": "b62c70ef8e9208d8d06e091a96fbeebd", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844253, "uuid": "1ad0e27e-00d2-4625-83d4-fd453e14a691", "comment": "Malware payload (ArkeiStealer)", "value": "3e475684ccd3b4daaa452f9311f9e440873ef6fde739da818296888a44cbbf98", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844253, "uuid": "2fe4deb4-73ac-4dc0-a473-8d746729ef6e", "comment": "Malware payload (ArkeiStealer)", "value": "9b6951f2351695809438825411d43986f53b2c45", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844253, "uuid": "07ae5b3c-80f1-4f62-b565-940fced8447f", "comment": "Malware payload (ArkeiStealer)", "value": "4cb2e412aaefd01a989a0609ef5223820d97de4d645a0f0fa1ab39e9d5ea92147636290d87342c906dd9a59df2069a4c", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844253, "uuid": "432102fd-4c40-443f-810c-db61f0da26a2", "value": "T1DCE4BF26F2D2D436E0332131DA5A6B228AB6FA3254319487F7D40B565FA11D2BF3E713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844253, "uuid": "7af8de27-8a09-4fea-bad1-f9be2766f995", "value": "764f2c8a1402bd58514309fa518ccb90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844253, "uuid": "3df86df5-a4c3-41de-8a56-3e36ffc38353", "value": "12288:Nvcv7hQrw/VWllasL3g8gNEWk8G3QsuPkld/I4zzhIn4E8J2BcEASjF+24y9QheV:tauqtsx5lGxjI/IUWRhUXNdFZI4Ulk3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647844253, "uuid": "0feb8418-e44a-4186-9de7-64649ebb75b6", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647844253, "uuid": "9e1511fc-37df-4a4a-927c-3f51be5b8c2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844253, "uuid": "b973b258-5434-48d9-8594-d1c20852b4c6", "value": "36366495.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe98580-a936-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647881416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647881416, "uuid": "79838c0b-09c7-4276-ad32-5330ad142086", "comment": "Malware payload (RedLineStealer)", "value": "b7f23fd57af824f83a17f0c9aa43d707", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647881416, "uuid": "20b5b52b-1b57-4da4-9a99-2d052b536500", "comment": "Malware payload (RedLineStealer)", "value": "3e5dd9fed58f02a638261c1d0f0430167e063d9b34c1a49539248fb4d21c0d93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647881416, "uuid": "9599274b-a538-497a-9651-55e00966352c", "comment": "Malware payload (RedLineStealer)", "value": "7b24b2a5da6c9ea50eed5ba8031f67e0cf2616d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647881416, "uuid": "8cd2a095-3bd7-4f5d-9252-9497b07011d0", "comment": "Malware payload (RedLineStealer)", "value": "5cfd3a26600c3f19c166b7695e4f5c5eaff0414cd38a7421333c5d7c424e4c55ee99f6ba8ea0316cb8246f4d0d84a59b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647881416, "uuid": "117971b0-6a02-4412-9dc2-91f57df72b42", "value": "T148645B3439FA5029B173EFA58BE4B5D68AAFB7733707945D1051038B4B23A81DEC253A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647881416, "uuid": "537db4b7-5802-46a1-9194-fd9c62d890f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647881416, "uuid": "2d0f31b0-6646-465e-a222-70e38cd365d1", "value": "6144:TVDh0IKJva0In232HU7rkH+33s65Y5LamRWHjd1llDTm:TVDhohxIn232HU7+2s656aeWHjd1llDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647881416, "uuid": "42df149d-7ef2-47fa-a2ed-9d98d80adfaa", "value": 312832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647881416, "uuid": "92032459-7717-4e9f-9ab5-8940466c4c96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647881416, "uuid": "4608de19-f502-4173-9836-776959e48c63", "value": "b7f23fd57af824f83a17f0c9aa43d707", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "699d3a1e-a8e3-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647845522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845522, "uuid": "bf016ab0-091a-493b-9420-a9babae5994a", "comment": "Malware payload (AgentTesla)", "value": "de407810eccb3e8d0c199a7c83d9cfb4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845522, "uuid": "78e9f425-4df5-40b6-8a91-6cd842d30050", "comment": "Malware payload (AgentTesla)", "value": "3ea240b4d65cca66f12b646a774fb5fd010781b6329d862de44bf4915938e77f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845522, "uuid": "9bc90317-b153-41ff-ac4f-8a36ab980482", "comment": "Malware payload (AgentTesla)", "value": "e1667da846044e9ce1ec44e8d0c91b2bff0d2f12", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845522, "uuid": "27dd59c2-1271-4c20-9ffe-e283329be5be", "comment": "Malware payload (AgentTesla)", "value": "f636e9573c2718d10b692fd4c0dd1e72156bc5e75e3f311262ba221a08cc042fbfb775f263de60eb5fe737ea8c216c1b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845522, "uuid": "99bfd8fc-e35b-4884-94d5-f719e7efaaba", "value": "T1DF25239837BD9334CA74BB79C4F5A070277205EE9502E748EA9A20981F2370D9A2577F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845522, "uuid": "eaf10c56-d6ae-4cf6-8a34-9799d861fab8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845522, "uuid": "23433a4c-09a6-4659-85a6-36a4321f6ee3", "value": "24576:/fdQl93uJ2quAN5KMV3J8aAJZg/uzgagjjwp5jB1:XdOQ2c13GaAJZg/uzk8V1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647845522, "uuid": "9d385279-0468-4e47-bbe8-638d7ab1348d", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647845522, "uuid": "92f5bf82-0388-499e-9e9f-595957bfe53b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845522, "uuid": "4a32478d-3d18-443a-a00a-5d8343918d17", "value": "NEW INQUIRY 2022.03.21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bbf6f23-a90f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647864343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864343, "uuid": "aaa232d6-2dbd-4431-b4a0-b10bbd0ccec9", "comment": "Malware payload (Heodo)", "value": "0ffb0a3ec5392f630e0ba3de7dc88f56", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864343, "uuid": "b32d75b4-019e-4e87-97fe-9651db00405b", "comment": "Malware payload (Heodo)", "value": "3eaea03b998a45260526e620d94670eae996ff5b51ff35b4ca4b1b4dc080db0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864343, "uuid": "1283a78d-832f-4a9a-918a-df9fd81a1760", "comment": "Malware payload (Heodo)", "value": "a222712f9e7aa88d68126f74525561a9caf58362", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864343, "uuid": "d24eabce-003a-4244-bbb5-82da65b325c3", "comment": "Malware payload (Heodo)", "value": "b5bb7446afd05d3b8455b2bd5c87324d82dad4c1f1cc0e7683d7275eb75668d3a7eacdbd7868635c606a17290ff1d9d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864343, "uuid": "2c55b572-d85a-41e7-accb-5c0d42e29ec2", "value": "T12DF46B936BC2C077E41F0279860A6228725BD5327756E6DF37C1D79FC9387A2AB38142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864343, "uuid": "bbcf9ea6-1864-46e2-b59e-bbe9a4813e1f", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864343, "uuid": "bf9aa764-9b60-470f-8826-00b47557817c", "value": "12288:wGOAWAyzLzHKwJrCf9dJJjI1rMpUsN+JinUqqOYJpOD7ZjAjKL7mYYlgV0p:w5aYJpwPHmngyp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647864343, "uuid": "6470cc0f-2df5-4723-bb2c-300a9bd3042f", "value": 782336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647864343, "uuid": "5dc6ade7-23fc-441d-80c5-955717a911b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864343, "uuid": "10560633-a6a2-4dc7-93b0-a164d0e2b5d9", "value": "0ffb0a3ec5392f630e0ba3de7dc88f56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f8bbc3d-a913-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647866040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866040, "uuid": "f602ff7a-4c35-4073-9430-044e61f62a66", "comment": "Malware payload (Formbook)", "value": "5e9b9a141c59f0fef128863aaea0a004", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866040, "uuid": "d6edb0c5-5d46-4c1c-a9db-dc459482263f", "comment": "Malware payload (Formbook)", "value": "400ac913ddb6af0581c51c13e102c2a8787e4f623d069b4a9fc6d272a250c351", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866040, "uuid": "a5da759f-76c7-487a-b6e0-f7197b8b891d", "comment": "Malware payload (Formbook)", "value": "a9a356594d15219c5b433319937e33f5662a6172", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866040, "uuid": "1ae66e21-4d72-4869-9c30-380734379753", "comment": "Malware payload (Formbook)", "value": "f6289badfcfcdaffdd01e4e5a63e8a4c75643ca05eb38185ef4268a83deb001d990da9e1528288b97c792c2c03d57767", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866040, "uuid": "0d91ba8f-59f2-43c3-83f3-6a733440b1eb", "value": "T11C3512C6FA106974CC2C83316172ED3016237C7EA531AA1CA9CA7D673FBF362542596B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866040, "uuid": "b6eb9a2f-c42d-42ac-98d8-5789a2159e37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866040, "uuid": "384a0c73-fcc6-4e22-b8d8-eb653d93c7dc", "value": "24576:J+2l9GHAXIRC5nofZ+hxU1cFRO8dg5ldatnzxTqF2JzV:J+QGgX8gnofkhC1SM8d8dazwF2Jz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647866040, "uuid": "888a6db9-e7f3-4831-8220-3f5c0e338866", "value": 1074176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647866040, "uuid": "bdefa280-0b6c-4ec2-9219-cac65956ae95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866040, "uuid": "fb72601d-d9fa-445e-a488-d8bda39549b4", "value": "DHL Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3af1a8c-a92c-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647877080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877080, "uuid": "42b28273-6235-4a31-96f9-dece2988c706", "comment": "Malware payload (RedLineStealer)", "value": "53114fa67a83b428b35632902a7afc08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877080, "uuid": "bcc447de-f058-4b29-b4ca-7903228eaf82", "comment": "Malware payload (RedLineStealer)", "value": "400d2f2c07290d604d963e1b84a65b8b02635d09fd4d79fb0381610efb0224dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877080, "uuid": "72d4e101-899c-4377-96c1-980ea77688fa", "comment": "Malware payload (RedLineStealer)", "value": "1e2d24939eb204e54eeac686ba0afc5d7f095900", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877080, "uuid": "c000bc98-6566-48c5-82b1-8de19879fc84", "comment": "Malware payload (RedLineStealer)", "value": "525aefee7bf5981217c84d7d01d6e049d252441ad309a66a7aa9e70123de6fc9feefb23f9025453a44ed4309b626bab3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877080, "uuid": "81d1ae0f-bc0a-4bfe-8313-34b2b62507dd", "value": "T143A35D2067AC9F19EAFD1B75B4B2012043F0E48A9091FB4B4DC164E61FA7B865917FF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877080, "uuid": "6c63bb46-252b-4d34-bd0a-0485ecf04a71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877080, "uuid": "b4c7c6af-882e-4428-b1a0-46b2c15d9bba", "value": "1536:Bqs8FRcqWClbG6jejoigI743Ywzi0Zb78ivombfexv0ujXyyed2ntmulgS6pUl:v8RclyY7+zi0ZbYe1g0ujyzdfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647877080, "uuid": "b49a835c-dddb-4219-90b4-9cb9b9ca8f4a", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647877080, "uuid": "9ce9a765-d226-4715-9c71-d0efcddf8d02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877080, "uuid": "85d88adb-2375-4b1c-8830-1f4dbb6c7b9f", "value": "53114fa67a83b428b35632902a7afc08.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7021e53f-a953-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1647893637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647893637, "uuid": "fd875513-ce3b-41a7-a3e0-505034157cd8", "comment": "Malware payload (Gafgyt)", "value": "8a99d2e536092bebb377fc782676f533", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647893637, "uuid": "e3ebb1b4-9d5a-4945-8467-b4e3d956944e", "comment": "Malware payload (Gafgyt)", "value": "4057c93cf17614bf37f870d86cde81e5a4f9bfceee183efa0d813909d3b9a026", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647893637, "uuid": "857f2314-75ef-4097-b7e1-9aaff5ab8ca1", "comment": "Malware payload (Gafgyt)", "value": "ec80be2172f173461514f652cc4df59785e67489", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647893637, "uuid": "7b1cfeef-692e-4bce-95ec-c566673a8768", "comment": "Malware payload (Gafgyt)", "value": "3a366fa96a9c817d009f608b8cbcfb0ba5acb72b055d929fa6612a9e1bdd4b47bc239a4ba53c9f9671d845e17e95925d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647893637, "uuid": "24381265-7811-4dda-801c-7a84e3cbac87", "value": "T1DED3F861F944471BC2C227BAE78E438D3F361E9797D733165A387DB02BE17882E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647893637, "uuid": "14ffef39-98b3-4678-8466-693b9b3a69b1", "value": "3072:8zZUQicUptZYjGVJc2oNKLlm7/57QpvDGiLCNb:tQMtijeJc2Zlm7/57QpvDGiLCNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647893637, "uuid": "c9d669e3-ae4c-40c4-9191-f4013b41d91c", "value": 130207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647893637, "uuid": "2683f7dc-3a16-4d7f-b79f-fc5d581aaad0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647893637, "uuid": "e6e1a51d-edbd-41b8-bf53-cc702f1d7d6a", "value": "8a99d2e536092bebb377fc782676f533", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdee293e-a92e-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647877983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877983, "uuid": "2691253a-435d-4a8a-b26c-f542585e08af", "comment": "Malware payload (RedLineStealer)", "value": "918b01d43d87dbddcb16cdc0877da15a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877983, "uuid": "67b1275b-83b1-4ec9-ac3b-3064ef8a7888", "comment": "Malware payload (RedLineStealer)", "value": "40ba87394996c8595a31da998cc0b88033ea8f7f988f769bc55a354a13fcd6f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877983, "uuid": "0add2260-dccb-44aa-9aee-dfacfec305dd", "comment": "Malware payload (RedLineStealer)", "value": "ca1ca2982f1b99b17077f6b1f87d35c403acd05a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877983, "uuid": "0e736c13-225b-4013-b992-3fdeea910540", "comment": "Malware payload (RedLineStealer)", "value": "84bdf1155f58c4b6fdc08375b4a4cc777670c5d9eba9288210d2a1da9fb1b7738008c47ba596fea4e433c27f19fa66a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877983, "uuid": "1d811caf-f6c2-4b0b-a62a-1797d3b03405", "value": "T1C684F122F7A0C032C45911F06D36C6A1567FBC329675CA87BB840B7E1F317E1AB76296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877983, "uuid": "349f41a7-072e-441c-90ea-83ecdb36f8c2", "value": "1e62aa7945f8620e15dc8eb729a6ef74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877983, "uuid": "f2e44595-c595-43f9-8efd-14b2882b5027", "value": "6144:gQrl2LaA7ovSiTWpLxGb3WQN8HjxSycjRNf47Oq0pxXKYX0DI:gGl2GfKcWpLQ7WQN8tgjRG70pxDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647877983, "uuid": "35bf873e-9b55-4f73-b985-f68ed632735f", "value": 386048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647877983, "uuid": "88468aa7-26cb-4b4e-a28a-8a2baced4947", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877983, "uuid": "5992c5e2-7f0a-4e58-ab41-a84b1972dcf5", "value": "918b01d43d87dbddcb16cdc0877da15a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46346d24-a94f-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647891848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647891848, "uuid": "686f44d5-240f-4c29-98db-cb0d5995ca3b", "comment": "Malware payload (RedLineStealer)", "value": "c7e950a9ef6ad47e7ab52c0c4708f627", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647891848, "uuid": "0295aa3d-4ead-4a75-8fbd-038c393add39", "comment": "Malware payload (RedLineStealer)", "value": "40f980ba0d6670399e23a86fb617649836cfa748958d9c75179663f359c2b479", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647891848, "uuid": "e2740a68-d13b-4e44-92ff-3d4df3ac21de", "comment": "Malware payload (RedLineStealer)", "value": "09396a49ea162b9fcc7edb231fa4993c7fed6b02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647891848, "uuid": "6ab89855-38ed-4776-99a6-322bdd31629d", "comment": "Malware payload (RedLineStealer)", "value": "65630f4f5729403ebb0d9803c1b97cb66535ccd27e0ddc32e5207f3dacfc04d3e56c7a2a6638c738b3c0699f82f4f164", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647891848, "uuid": "6d5d3a61-7000-4db5-8c63-984b4cbaf744", "value": "T136942389A049F39EE4DF66B71D16FE8F0969301BE0D344CEC6C971AD54BC928BE8409D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647891848, "uuid": "4aba3ea9-a2ee-4a40-9d3a-17b7845ffcf3", "value": "a0d013975d87a727cb4cd35f5a4b2ff1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647891848, "uuid": "b36c1b46-c9f7-471b-ad86-78ad18770022", "value": "12288:VR42OwK/lGRgOUqmq9kR6lhKX+mpUNMYAmiI:VRtOwK/cRgOnmq9g6RmpOMYAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647891848, "uuid": "2e286949-42a4-4d6a-9289-add9f5706854", "value": 432128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647891848, "uuid": "393ea3cf-9f8e-4d90-b6fd-636ed90130e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647891848, "uuid": "7851eae5-0566-4dd9-ac64-ffa173fb8b54", "value": "40f980ba0d6670399e23a86fb617649836cfa748958d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9aad7fa-a8ee-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1647850434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850434, "uuid": "0808224c-e4dc-4301-ad63-995c9531e469", "comment": "Malware payload (Gozi)", "value": "6f7e051c916e7a39da695fc2a859ffab", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850434, "uuid": "5fbb6a07-065c-4a4e-89dc-0e7fc97a9981", "comment": "Malware payload (Gozi)", "value": "41025bfa31bf8234f7029fdb03a5f9cacfc6991452cfa645b76f0440b20ae91f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850434, "uuid": "d96275b2-f7a2-410f-af1a-dca0032d0dd7", "comment": "Malware payload (Gozi)", "value": "e1cc5a152936adc65465c37013af52e37db1c3fb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850434, "uuid": "ea9e50d0-4ee0-4e81-a347-9b1cc3cb245e", "comment": "Malware payload (Gozi)", "value": "9b8c979eeaba5921a2630d7be6f07179200a3a48215248b2ee138e17ba35747b76ad94e4b3a7fd6177b20b604c4fd288", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850434, "uuid": "3bebed78-1a3d-4c85-89b1-3d2d1733ad45", "value": "T1FB8733AD72C11ECCF1E6387C7A5463E90F869FB10E3EA172640338CA56718B95D22B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850434, "uuid": "aafb2468-73b9-4d27-8c23-78cdc64556c4", "value": "a2c4c1cc45cf157e67048505a3f85c3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850434, "uuid": "be76565d-31a5-49ce-bc34-348956744e8e", "value": "786432:7qa8HIvNUVx/DxI/99j0RPKUE5C6Xs7VUNjOr26pXUuQb5:7qa8o1UVhD6/fgoUuZ8RUNSr26pG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647850434, "uuid": "97f290d2-8e38-403f-a8e7-c4cf725967d2", "value": 37626880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647850434, "uuid": "72fdd69a-323c-4c54-b08f-88677db2948b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850434, "uuid": "0dcc0fb0-3299-40d9-9241-bc55e0b7c03e", "value": "41025bfa31bf8234f7029fdb03a5f9cacfc6991452cfa645b76f0440b20ae91f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c47a43e2-a8f2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647852117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852117, "uuid": "a9493ef0-825c-4529-920d-bf6347beefae", "comment": "Malware payload (Heodo)", "value": "4a6c97338093076421b1523977e250f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852117, "uuid": "bfa619a5-0708-4e50-86c0-9d0de54215ab", "comment": "Malware payload (Heodo)", "value": "422fee18bce2138ebc17166aa8762fab7818b7bd7f1acd12202ef1c3bb61b2c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852117, "uuid": "ba8f2fd9-4652-4a82-817a-892109bc3b47", "comment": "Malware payload (Heodo)", "value": "a0edfc1993768b4b88fc362d0bbe04a0500b0bf5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852117, "uuid": "a7be9ede-bf28-4d08-842b-b41f6ef81e3b", "comment": "Malware payload (Heodo)", "value": "4cf26136085262c9b534496e20381bc51c746039a032646edb79aeac8e8e8b914e59323fe4a4cdb8873b1df486314207", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852117, "uuid": "cdde2ddc-ad82-4201-b1fb-01d26d5a6056", "value": "T132056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852117, "uuid": "362ad474-99af-478a-84b6-705d6322b991", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852117, "uuid": "abe91313-f88c-4e62-b4f5-5d192425007b", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/ri5CGNHrH2tZ+d+:gMV/ri5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647852117, "uuid": "d6fef1b4-93be-4e03-ac84-d1f9e38d7f73", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647852117, "uuid": "04bbcd28-daa1-493e-a3c8-75642bb7cf56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852117, "uuid": "968048e9-4eee-454b-b71c-47d78b974841", "value": "4a6c97338093076421b1523977e250f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7cf064a-a965-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647901541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647901541, "uuid": "9f4e4d1e-d568-41b0-838a-ec1b37469a88", "comment": "Malware payload (Heodo)", "value": "0d279ffe9d8e8678f1d13ab7cc85f682", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647901541, "uuid": "2611b259-01b9-4f0d-8e5f-29c92b7cc3b7", "comment": "Malware payload (Heodo)", "value": "426fb994ee9dd5f20e03f88748f3a0e31764c0abdf4acd9542be1a03ac09eab4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647901541, "uuid": "9c30a8c0-15b3-4f56-999e-c19191da1ac7", "comment": "Malware payload (Heodo)", "value": "66f1b8d2b91b48ce9c3e07c3b80b10a5e264e163", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647901541, "uuid": "00c7c8b7-fffd-450b-b020-cbf97e88c7cd", "comment": "Malware payload (Heodo)", "value": "9589bb66e7f3f21ae692ccd99be9b8b5897e553cc1596561034aa8bdf956c312ca5558d8aaf88c9374489224e4c886e2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647901541, "uuid": "337753ec-64dc-44a1-a707-e64b1089641f", "value": "T1C7E427137CC34030C89F0875891AF20A6995EF04DB99B33AEBB5BE8D65355979D38B0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647901541, "uuid": "4c9381e9-1c7b-4046-aa2b-631cdbfffae5", "value": "b39d2fd2d18c2cfe493a1e089561b46e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647901541, "uuid": "dd4d13e9-19a0-4396-87da-a167798abd5b", "value": "6144:EiH1vXSjOsl8UG2fde2VwS7D8dwDFYAcAf6UrUfNKLgM1xIhg3teXE3XsuTWKi7T:X14GEdtVlnqYF0ArrUQgM1xou/iA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647901541, "uuid": "88ccff17-a52e-46c3-b02a-ebea264dca3d", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647901541, "uuid": "828842d8-018d-474d-9139-7753eafecfce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647901541, "uuid": "d81bb1f2-f4ba-47aa-975e-0665b06bffc5", "value": "emotet_exe_e5_426fb994ee9dd5f20e03f88748f3a0e31764c0abdf4acd9542be1a03ac09eab4_2022-03-21__222533.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "342192d2-a944-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647887093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647887093, "uuid": "95066e01-554d-40b5-a889-13fc24341325", "comment": "Malware payload (Heodo)", "value": "2e61f58b842d5b6950ba6b71ad37d08f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647887093, "uuid": "904a15ee-2584-4722-bbbb-b177ef2287e4", "comment": "Malware payload (Heodo)", "value": "4310f9399f1b110423fcdc0d66a09d8db81173f053ce677429d67fbf93243e5b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647887093, "uuid": "83061f6f-5faa-425e-adb5-d9e12f310154", "comment": "Malware payload (Heodo)", "value": "b62f8590649da783e17c42032ef51cc462f0e831", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647887093, "uuid": "0c3a6fd1-2b49-4201-a3b7-5b248e5831e7", "comment": "Malware payload (Heodo)", "value": "73e93499abfccc9092d96227c3681e3c51c089090a261fd2d5a294947b5c00139ef94f85bae40b68f86bba228c5768ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647887093, "uuid": "d168cec0-a2b1-4b0a-8a56-5c94c44a198a", "value": "T19E056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647887093, "uuid": "eb31f193-6884-47ad-b740-1ca56c85a9d3", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647887093, "uuid": "6d85887f-09a8-46e6-8591-32c492a6ee25", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rF5CGNHrH2tZ+d+:gMV/rF5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647887093, "uuid": "4dd46373-ca19-493c-a4a2-84a7a86e2cb5", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647887093, "uuid": "3540cd48-84e8-4315-a6bd-dd2423747694", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647887093, "uuid": "ae804cc3-e98a-433d-bfcd-338a2c81a866", "value": "2e61f58b842d5b6950ba6b71ad37d08f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "156f013d-a94d-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1647890907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647890907, "uuid": "6cf48fe1-218c-4498-9f57-d55094c321dd", "comment": "Malware payload (njrat)", "value": "08e4e6f897a31e6bfd9a1438affceddc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647890907, "uuid": "73cb05c9-d78e-477b-ac4b-4d579b3f2ac9", "comment": "Malware payload (njrat)", "value": "44033d64e192af7474f696ffc8aacbb999c055179c4aab2e1182d2cd35eaddc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647890907, "uuid": "a05b48da-3e6b-40fa-b2c7-30a57ce152b6", "comment": "Malware payload (njrat)", "value": "45bc9b195427903bb77abc5dea4b6f57aee545d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647890907, "uuid": "de18120e-ef80-4302-83f3-fd5da0c10e89", "comment": "Malware payload (njrat)", "value": "72e485f53fe1c74c4cfed9fef9cc56eff8b34170d19041d77bc21a77b8fa143360d55954fbe2dd30a70179f0619cd0b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647890907, "uuid": "dbdfbd8f-f330-4318-817a-b84e6690e764", "value": "T13C032A4D7FE18168C4FD1A7B05B2D412077AE04B6E23D90E8EF564AA37636C18B54AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647890907, "uuid": "3b1b6d88-bf88-4bb9-8aad-d764b4749df8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647890907, "uuid": "4d2893ff-9541-461c-a71c-3db76d174f7b", "value": "384:tfB++w7BeAaXaEiVPzdmB0O4yUvpWxgp+Z2n/1Yd/U4uF6rAF+rMRTyN/0L+Eco9:9w+w75POTUvplQPuArM+rMRa8Nun0t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647890907, "uuid": "3371ebbd-b9bb-479d-af7a-038fa5801edf", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647890907, "uuid": "b3cda4cb-bba6-4fb9-a32c-10a9d0b39d71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647890907, "uuid": "6d1cb93e-5c71-437e-a866-e53c4a2cba0d", "value": "08e4e6f897a31e6bfd9a1438affceddc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4568eb5-a965-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647901455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647901455, "uuid": "fe907bed-8133-4cbf-915d-3795047acd05", "comment": "Malware payload (Heodo)", "value": "86b75423d6179ddc8f897854e4dd0e1a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647901455, "uuid": "0d5e650b-cf35-44a8-a296-bee583e1b188", "comment": "Malware payload (Heodo)", "value": "441a085aaf08b92e5f0cfce5868e891c31c06c8848d5709e479a7964bd842f77", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647901455, "uuid": "bbd4fcb4-4624-43aa-b9bd-96501a6e2967", "comment": "Malware payload (Heodo)", "value": "6039076fee78500302bf4eaf7b3c7fcf34716a69", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647901455, "uuid": "ef35e8f9-b8de-4106-9a90-be35dcf52251", "comment": "Malware payload (Heodo)", "value": "538bd08d843f842bb3b91dcad26873fcf846678c0a91564818d5aa89450b8937bd740aa69771c101257a338936a01de3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647901455, "uuid": "dd27fdfb-9d6b-41fe-977a-3db9afe74f4c", "value": "T14EB43A11BC916832C36FAC7456073262588EE7F0DBD1F26FA3E0495C9A7C5E36624BC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647901455, "uuid": "a446da53-e315-45d1-a6e2-70f48cbd11be", "value": "14e6ae8d1400b6271725b3f01025b85e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647901455, "uuid": "e8bc2307-fff3-4e1d-9461-d8e56e03d9ee", "value": "6144:VikzyaB9eoCyx/mEhHB5RYSJ/xE+qiCjzQNPj79GkqbscgCG5qH6scI:VNnCGmyHB5SSJpH0zQN39GkUGQSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647901455, "uuid": "3a2ad07e-9c17-4ed6-8563-ce6d2220435e", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647901455, "uuid": "03fd7050-a7d7-4d4f-bb36-e72aa2d4e80b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647901455, "uuid": "2c97333c-30d3-4544-8fe4-c77ad2828c00", "value": "86b75423d6179ddc8f897854e4dd0e1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e9a6ec-a930-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647878424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878424, "uuid": "6b678ed3-3cee-4e40-add5-37274a2940c3", "comment": "Malware payload", "value": "7e3e73ae38b2947d9e7ae8360a5ae9a3", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878424, "uuid": "e210555b-d421-49c6-ab71-a69ea4698ba8", "comment": "Malware payload", "value": "444359b80cfd929f194778587d326117c42eb586617de4fdfc6d5c8cabe927b0", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878424, "uuid": "bfa09914-7786-4519-bc9c-078c68ffa59a", "comment": "Malware payload", "value": "c38015ceeb8fafdf4a83236094b427405da26175", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878424, "uuid": "b820f2e5-d1ad-438a-b113-d5d3a5355eef", "comment": "Malware payload", "value": "597feeb37313b7f3abae79774cdc42a06b14ed19d94f615559087ee0f95b2ba83e754778b26f2c2261f0c98fff7fb90e", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878424, "uuid": "f46967bb-f39a-4353-8756-e41ff48ef75c", "value": "T1D9237C70B9D37CE722D79DA21028B1652DA0095B471B7B68E5B26BE19F805309FF9C0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878424, "uuid": "0153e3fb-32cb-4769-8073-1e8c1a359845", "value": "768:48bO5lQLHFAJOn+PMmXasAR5WMOIpwAtVUj+PVgQADCL8lPuC7lRx0YNsg0wXkwP:4r5CJ3+Pjea60+z4uUMYNslYkHixXUpi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647878424, "uuid": "871afcdc-1c70-4895-9db3-a3db0019e151", "value": 46100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647878424, "uuid": "c038d1ec-51a1-4f28-930a-35f7c5a23eae", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878424, "uuid": "a7fd0ede-9731-48b4-9315-44c954758f7d", "value": "css.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91cbe806-a935-11ec-9275-42010a9c0029", "comment": "Malware payload (Hancitor)", "timestamp": 1647880808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647880808, "uuid": "0e25ade5-7166-4924-a716-4a7f48fbdd32", "comment": "Malware payload (Hancitor)", "value": "5df3d0f5c72cf5e5f5558d0427fbe188", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647880808, "uuid": "71feaca1-a974-4ba3-afd9-ad3be507627a", "comment": "Malware payload (Hancitor)", "value": "446322c5499d41edee0ca0b83aba36f0cc74ed4743a2e50e6eb36d2a3469d85f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647880808, "uuid": "7186998e-bcfe-472f-a31b-eba2dd53d01c", "comment": "Malware payload (Hancitor)", "value": "7f3d18d51f70b226fd93cdcc50b30f24584e54a9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647880808, "uuid": "feed77c7-9e35-4a0e-97ed-7ee4fb9e8087", "comment": "Malware payload (Hancitor)", "value": "e42d8b6ac2c35af73d24ef1b3bce984e733cb368a5417bbae40d71329c4966acdbed3a59a360028236775c00b0deea6c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647880808, "uuid": "23ec1049-f89a-4fcc-a376-3274a1f3c5f0", "value": "T186857D33B2918837D073163C9C6BBA989E397D112E38A45B3BE41F4C1F3D64179266A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647880808, "uuid": "2b1570f4-cea0-4829-8ba3-631e3d71dc83", "value": "7dd0862f2c3ebf8ee256cb045aad9794", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647880808, "uuid": "518f2189-399e-43ef-a86e-5813279a8e0d", "value": "49152:ZrJ8MafVQ7yB/+E7kCSCFEWSHWTXtB9PBJPnaHzHIfup9lBEnTJB:ZnNGwEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647880808, "uuid": "ddc06682-6ab8-48c3-93b7-144056730cc3", "value": 1795072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647880808, "uuid": "3476619d-e657-49e0-b14f-ba21e6f17d41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647880808, "uuid": "e423851b-00f5-4441-8f44-67e0a5ea8db0", "value": "helf.hpl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c02b73b4-a8f0-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647851251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851251, "uuid": "b86b8f2f-38f5-4b0b-bad2-ea72088f6da2", "comment": "Malware payload (Loki)", "value": "ddf41eaa9eb6e6157ec4027d9e1a487a", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851251, "uuid": "6828e63d-ba3c-4a6e-aeca-279c11598f27", "comment": "Malware payload (Loki)", "value": "44d779790257bbfef572c956b10b022ab88190c2a1102c76f77cf3d0565af7e2", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851251, "uuid": "985f105b-88ad-4f12-bf87-00963c760ed8", "comment": "Malware payload (Loki)", "value": "8bf65878ec29a5d541926398340957de733f0f61", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851251, "uuid": "982d78ea-7f13-4e5e-87a7-84a2cc45d334", "comment": "Malware payload (Loki)", "value": "94e41379067a6da129cbd014322cf6a2ae921d7e5e17ab122110de1f193766b9b4c1b79f8f0bf6f1a71e80434c0715f2", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851251, "uuid": "d2fdc547-fe86-4a12-83b5-ef6f5a052fb9", "value": "T1E414125D7DE06B5CEC8500F9C7428779152CAFD2BE52C3A72026B60C7876E9B88B15F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851251, "uuid": "f1c5e0d9-bb2e-4933-8e0e-a893482da067", "value": "3072:TftSvcz+Bo3s+otGoBpAf7+oc4eXMCOJXNUrqCKho83x0LGZKlXMaY0MzMU:7lv8+otRBpqefwXNUrqCKho83W12aFMn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851251, "uuid": "6921da64-e5c0-47dd-ad8f-ef5166456f88", "value": 190424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851251, "uuid": "667f4636-951a-4bbc-8fd7-517daade0ab7", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851251, "uuid": "c594d734-222b-411d-a7ca-780936cd8d4b", "value": "scan_payment_advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e33b207-a938-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647882064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882064, "uuid": "3240d040-5bd4-4a24-beaa-6550c9e5abba", "comment": "Malware payload (Formbook)", "value": "ec4af82d13718756a0dcb4f47603e24b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882064, "uuid": "810e8fff-ab2d-46d3-b323-44a9108ff220", "comment": "Malware payload (Formbook)", "value": "44eb9b85894fde654ce8382aafb7babe51d12dbe5877a7c684af673fd496a9ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882064, "uuid": "fe412257-c9e0-4214-9850-3283369eb146", "comment": "Malware payload (Formbook)", "value": "9ac06515d9848bb295bebf51a4f7a7bf35295699", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882064, "uuid": "66fedd07-323d-436b-8e21-8af266fd4045", "comment": "Malware payload (Formbook)", "value": "145336207f7747ebf53fc589fb69cf01f091e5db1d14830d40d693f4b9cf49530cb223a700e3a1d5c7ff4751bff4a925", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882064, "uuid": "9966efd4-83c3-4296-ac95-d48a9fde96b9", "value": "T15335BF10767789FBF47B1F3824E200D27AFDBE01A2E6DA5E794870EA1476780DF54262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882064, "uuid": "fdfc256c-f2c7-440f-ab57-a267476d4f63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882064, "uuid": "89fd48d0-2f9a-4e79-b9e4-f2d3fdc9d5da", "value": "12288:I6gDqGHsF4uSQl3zgLPEnxe8GdoCLvsxw/3kJzS+PTWfC0fl0sVQctfYjNdqNTQ:OGGHsJSQl3UEnI8XCjsxwQ0N04UjqNs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647882064, "uuid": "6e357015-f74e-4725-8841-4bc81b26eaa4", "value": 1130336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647882064, "uuid": "4916fd13-78ef-4be2-b6f5-f2be8e7f3ad1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882064, "uuid": "69283646-bb36-47eb-a5fd-cb8767f99a21", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c692151-a8e6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647846842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846842, "uuid": "d721588a-c336-4aaf-82cd-8a56537d6bf0", "comment": "Malware payload (Heodo)", "value": "e8ea53b4ddf3a4c7fba6a5dd0d7ed541", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846842, "uuid": "e263de52-377c-4f3c-818b-50152c44723c", "comment": "Malware payload (Heodo)", "value": "45951f0f98c9d3eb9c0ee7084d2e72ca47a9b7348913b8b42aca4d13aac900b4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846842, "uuid": "19daa37f-6edf-4751-8216-9295b0ff03f2", "comment": "Malware payload (Heodo)", "value": "fd0a061c8c212a1a8799add3c3b2328304c9110b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846842, "uuid": "b8529de2-b0e6-47e9-b256-2b6479abd7c3", "comment": "Malware payload (Heodo)", "value": "068ed4f9e2de997f1eb76df9165f2c10615a1c33a7ea630662316a25f2c710c6d80d9fcdd8aa1730caf0894733caaec2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846842, "uuid": "0e319d87-1edc-4495-aa77-fe53d61abfe0", "value": "T1F203AF30F2928B99E13A947C478CE9F583288B165141BF2C309563AC5F536B67F8E24D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846842, "uuid": "fa3fce4b-99ff-444f-b5a0-f3b75a78c152", "value": "768:CbdpCR8kjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooFVIyYS:CwDOZZ1ZYpoQ/pMAeVIyYzaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647846842, "uuid": "1eeaf695-d442-48bd-ad83-9a90688dc16c", "value": 39713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647846842, "uuid": "14b76422-4377-4bef-9028-15cb2c19a446", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846842, "uuid": "d8d71899-bd33-455c-bbac-2e04aed1c772", "value": "NRD971587236AW.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bae67d7-a8f5-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647853310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647853310, "uuid": "ca83d485-39fe-4d31-9a43-386b1fd07e5c", "comment": "Malware payload (RedLineStealer)", "value": "b969b58a9536fd09b94b84199444dc1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647853310, "uuid": "2dccfa67-969a-4d5c-96c7-cb10f7f92a28", "comment": "Malware payload (RedLineStealer)", "value": "468aa24cddbe9aff58c6e417dbf4291086c657ce41964da4efe2d3af56daa74b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647853310, "uuid": "4e05da09-57bf-4330-989b-b0392a164f00", "comment": "Malware payload (RedLineStealer)", "value": "6075fee32469e9e9843469f541a01529d4b83b81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647853310, "uuid": "c0986e68-2a3a-4df6-89ff-caf311ec25ed", "comment": "Malware payload (RedLineStealer)", "value": "f5aaa0589d8cf0250d78b98e240ca6ad08acab390dc40ca42cf5f92a6740f9f71d57e3db5a65aac2a2af8d6f47d25530", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647853310, "uuid": "3d23cc4e-d3d4-4c30-a4fc-1ca19c29ada3", "value": "T191753358E38D30ECCF4F5778FB57AB67A25A007ED1C5A6EF9E09428202534C61A1C9F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647853310, "uuid": "704e212f-e02d-4ca1-9381-d83dc52aec5c", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647853310, "uuid": "27f88511-19fb-4760-be34-49b6dddce05f", "value": "49152:bV+BP6kh9zBAs2rPhfupPsULuw0IMK3Na1U6NVw:bVQL9zuPrPhfJUgIMGS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647853310, "uuid": "acdd0eb8-dab1-4458-b9fd-69928fa138dc", "value": 1684480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647853310, "uuid": "c04cc134-1b24-488c-b7e4-3a247449aa91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647853310, "uuid": "9561f043-e734-43a6-99bf-b2132f835ae2", "value": "b969b58a9536fd09b94b84199444dc1c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f7af39e-a8e3-11ec-9275-42010a9c0029", "comment": "Malware payload (Babadeda)", "timestamp": 1647845451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845451, "uuid": "f5ac69dd-ba78-4cbc-bf02-e695caab7630", "comment": "Malware payload (Babadeda)", "value": "6fee3f1ed8aaebea30315292a400fe63", "object_relation": "md5", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845451, "uuid": "a9d6e229-1b1f-4c71-b945-bececccc2a3a", "comment": "Malware payload (Babadeda)", "value": "4710c5debc1ad17a85ef82676a4b6b7e15054966de57b0f4bab61c4ede209830", "object_relation": "sha256", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845451, "uuid": "d2f23e3d-e1d7-45c7-983a-5e9c2714cc2d", "comment": "Malware payload (Babadeda)", "value": "cd27a3acfa7de79749ef1d03c0ca1d8f792c61ac", "object_relation": "sha1", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845451, "uuid": "fa8db6cd-611a-4877-bd06-2f75379c89f6", "comment": "Malware payload (Babadeda)", "value": "c5758ac751de76b2a8761adba1fec87ae1055c5a142eb77b559432ad80eb5d5eb58cb5f2c840667c4d6deac4d0349f5f", "object_relation": "sha3-384", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845451, "uuid": "33fb85a8-880f-454f-a75e-e1fd61265cf5", "value": "T117740246A2E642F7EAF1463400A6353FA73566205B249CEBC74C3D43A143AD4AA3D3FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845451, "uuid": "c64acbeb-919c-409e-9cea-d4f5c3e15c91", "value": "5877688b4859ffd051f6be3b8e0cd533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845451, "uuid": "ed5116cb-91c8-4638-8ebb-cc2438698d75", "value": "6144:bldk1cWQRNTBTsJ9GfHQ6t5Savj83/0NZz69ZEWvJqLq6X0njpYiHurXM+U:bcv0NTFMGfzttjs/az69iWmqppYU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647845451, "uuid": "0b08383b-831b-4f80-be32-ee81289d7bad", "value": 355328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647845451, "uuid": "c4fcfcf1-949b-4ea0-84b2-8a936517572b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845451, "uuid": "1c192cfc-87b0-40c0-a21a-37436c2ded13", "value": "71732507.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a147f3f7-a8b3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647825000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647825000, "uuid": "22229b5e-9ba6-4944-ab6c-ea5449b1e312", "comment": "Malware payload (Heodo)", "value": "6eda36e4b14232ec88351f5dee6ef909", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647825000, "uuid": "04277528-4a56-4bcb-92dd-897539e9196b", "comment": "Malware payload (Heodo)", "value": "473f30ca7fd017db3a2257213a3b029d5bc7c98538a09dea840a4b2126b747b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647825000, "uuid": "c6840fc2-5b4e-4486-a227-f5177d400f70", "comment": "Malware payload (Heodo)", "value": "75baee91882ee83d081843fd47359078016a6026", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647825000, "uuid": "836a365d-fa0c-4f41-b3f2-bc5a623444d0", "comment": "Malware payload (Heodo)", "value": "ed302520b2dfdd215b22f8f4c802e7aba3be8f7d03c75fd1ba2089893fa16aec5a8008555a8d3a62381a9a67e4c377d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647825000, "uuid": "293c2b65-e776-4621-8c5c-8ed9f9a05d7c", "value": "T16DB43A317492B279C2EBD73408A35275B21AEDF157E274E36EE707CC4B366906E72602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647825000, "uuid": "db6b9399-46d5-4521-9f01-d42967cff8a9", "value": "55cf9ae1e74cef637eafd17181390202", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647825000, "uuid": "eeae8006-8c76-47fb-b37d-d8d485811ea8", "value": "12288:7FFCpYDLbBHqKK85H3jy2VlMD4zeSvturG9+:7VDLbQKBVlMDOtv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647825000, "uuid": "85cc037b-06fa-4cca-8f43-0f55f175d14a", "value": 516096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647825000, "uuid": "be5ec942-3745-4f35-ae47-aeeedeeeb8e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647825000, "uuid": "6ba5e63d-64ed-4f3f-be74-95c428259bb6", "value": "6eda36e4b14232ec88351f5dee6ef909", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb42999d-a8fe-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647857282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857282, "uuid": "f33aefc9-961e-4090-8e8b-15bfaf3c9e76", "comment": "Malware payload (SnakeKeylogger)", "value": "f202e5f2d52d43d14a6859a0359dd05d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857282, "uuid": "77bad52f-f7b8-4fa7-8b43-4da6fc5565c9", "comment": "Malware payload (SnakeKeylogger)", "value": "475845df71651de04302adea6f1a048d8dd003853d8e18fa6a77b1c2eeaa10b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857282, "uuid": "90a5321c-d184-4481-ac0e-4fec5f2076e1", "comment": "Malware payload (SnakeKeylogger)", "value": "ac04a9d17e1ed894d8fbc75267ba461e6c0a1d96", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857282, "uuid": "8740433f-5cfd-4dd1-9ed8-4f84da989b05", "comment": "Malware payload (SnakeKeylogger)", "value": "eb8b362a513268600bb06dcce805a8da92961db93a64c378c520523ec71983ce4816c51e2c2dc9430d81c241972619f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857282, "uuid": "9027793a-fe3d-40b3-873d-acedfc426d00", "value": "T10E6533A111848CF3EE99EFBC2D3A433F0E209BD4B96665780EA43B58255E4591DD0FE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857282, "uuid": "8f57df0f-0a29-44a9-aa5c-014ee676c160", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857282, "uuid": "8a56dfd4-5da2-499d-b923-3bcb42ea90f6", "value": "24576:DYjtjE8XZgqUnOnEQfU6nkd9vRAZ0ayZmVR4TQ2coZOWwAU3dILAafgS:QtpXRIOnEckdvAZ0ayZmVWTQ2kW7U3d2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647857282, "uuid": "a41770a9-3c1a-45ea-80b8-3e75f18cb23b", "value": 1532928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647857282, "uuid": "4def31aa-c699-4ef7-9c49-2af2dcb9fec4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857282, "uuid": "bb8a9022-ba6f-4177-9b24-14a6b9b24937", "value": "f202e5f2d52d43d14a6859a0359dd05d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8d74c35-a958-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647895906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647895906, "uuid": "2d6f6175-b491-439d-bd96-46f502167b24", "comment": "Malware payload (AgentTesla)", "value": "0eebc199f48fffc046baf1c3913efcec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647895906, "uuid": "32fef3b4-20ff-4a33-b9a0-0799ea31d83e", "comment": "Malware payload (AgentTesla)", "value": "47623352aaaa6d030b303ed8e754947ece26c71d02e6cf0be79938211e29a2f6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647895906, "uuid": "fb84d3d0-b9c2-415d-bde5-3c85eb85b2e8", "comment": "Malware payload (AgentTesla)", "value": "133dbbdbef24a9a478e78b17a5f349da4cd3deb9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647895906, "uuid": "00135f0e-337d-4a19-b3b9-9c0bfbae22b7", "comment": "Malware payload (AgentTesla)", "value": "f636f4d28dbd283b5ac8a4e4a6298948ab5c2f076ff5f8010b14846f9f45756a35ae7dd4867ced001f336b88878d95a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647895906, "uuid": "8ba008fe-a172-4190-b41c-964ab25226c0", "value": "T1AE253C6D712472EFC837C5318A544C28FA50ACFB670B4907A0933B9A5E7F587AF8447A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647895906, "uuid": "0c909164-ef46-4dc5-b07e-846962b7222c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647895906, "uuid": "58f6b296-f495-40ed-a8bd-8fc4e0332b9b", "value": "12288:xxHLXMcGSpzHaX80xuqNSCyjIhs234xGWvI0kwz6GYl9CVASQgXT9B5txGynGMMi:xxzvI0nRYuaS5JB5yyGMMjHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647895906, "uuid": "0187fc49-e3e6-4ec3-ac7e-c51687fc59b0", "value": 969728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647895906, "uuid": "bfd0f1d1-9857-4aca-aa01-be1337d751e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647895906, "uuid": "de6956ad-4dc7-4be1-98fa-891a831ce439", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de181328-a90d-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647863756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647863756, "uuid": "0fded3af-6884-4aeb-9a42-6b25bb7dec28", "comment": "Malware payload (RedLineStealer)", "value": "6df2db7ce312d1eab8cab51efcb1eabe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647863756, "uuid": "20fa1b48-823a-424c-8421-8aaa9cc4a79d", "comment": "Malware payload (RedLineStealer)", "value": "481f30b474cea03974a6845779cdbdbd01130c322e8c5b813f4508632ba20a06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647863756, "uuid": "b0ee8fdc-62c7-44f7-951b-fdf2852d33e4", "comment": "Malware payload (RedLineStealer)", "value": "b06f08e7dc443b2c9b0c5a9a8d603b3f17215da2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647863756, "uuid": "4274b14b-3b60-4e83-86ee-25a6c6c5ff43", "comment": "Malware payload (RedLineStealer)", "value": "0394be602defdda2ac01cc260284fd61f1ef2cda6e7306b289d5fabf01f7b02664b4c08a6c8b460a4bcefad6363b0bfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647863756, "uuid": "394e14c2-6bc1-466a-92a7-380a7c8b7e9b", "value": "T16FC423EBB0C0BAC1C8421FB3972C3F1BA3E96358F9D452256676A95B9FD80477B14930", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647863756, "uuid": "82917cbd-4699-43dd-8c27-25a1963a1c50", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647863756, "uuid": "9ecab4cd-55a3-416c-be0f-c6d815de96fa", "value": "12288:CZ7NP00EkzGQRtqkoqpx+QS03ULaHNqrxlKIQNow9c2s/8p:U7N8VaGQrR5x+kEaHNYK3ba2y8p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647863756, "uuid": "737b0364-b734-4bb1-97c8-9a1ffa5120ce", "value": 573952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647863756, "uuid": "cdabca9f-200f-4d23-a6e3-1e8169710af5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647863756, "uuid": "06e1907c-9698-4e29-81a3-d4cdc3f10a25", "value": "Fortnite Software.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "097eefc7-a910-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647864688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864688, "uuid": "66858dbb-2871-4347-a9ee-7ad45d988c6f", "comment": "Malware payload (AgentTesla)", "value": "305d90ce38cfeb935dfca5cc7bc2327d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864688, "uuid": "78edf0c6-2287-421b-ae93-425a6a56e778", "comment": "Malware payload (AgentTesla)", "value": "48410e44ca5545cd271a2013db55812bd5b5b447ffa66f5edc1ecf403d06c191", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864688, "uuid": "670c1828-11da-4886-91eb-bcf62916164d", "comment": "Malware payload (AgentTesla)", "value": "146340237f8edf288a79111d513fe4ad6f17cb59", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864688, "uuid": "2df08d02-5ef4-448d-b5cb-aa68bf32f092", "comment": "Malware payload (AgentTesla)", "value": "7bad1c8268f06086ce99bf34c0c4f17b9269a37820724095759b5556af318a29c33f76728728387014cfcdd546245ba3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864688, "uuid": "ef8fee7d-a771-4d86-afda-47f1bd8502f9", "value": "T116D2F189757A95EFC10BB928507EBA85AF0601D142F9A987D7CE08FD085FF5C8C39C16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864688, "uuid": "33a258d6-98e4-44ef-b6fe-3c9eb82f8ecf", "value": "768:GSVwP7O1xz8FONMNV+eViS/CrUaoQjLQWOTlBTUARD82w+0U3:GiwPCPzOp+eYSarUFmUlUq8+0U3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647864688, "uuid": "55000fa5-f1fc-49e6-b7db-daf85362ee9a", "value": 30943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647864688, "uuid": "f7ec5979-4c99-4ac7-8c05-bfd226c62d78", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864688, "uuid": "d6a37e8f-2c20-4c6d-b217-b9fc7fb0a043", "value": "MOD41SA10PSQ4W1.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9487e9d6-a94c-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647890691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647890691, "uuid": "6b027695-a9eb-4e6c-bcd1-2136c0c1ca18", "comment": "Malware payload (RedLineStealer)", "value": "bdd67fa61c8382a69867fc10e96aaf76", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647890691, "uuid": "74f254a8-116d-4262-b492-f1c37d635de0", "comment": "Malware payload (RedLineStealer)", "value": "4842a9c0e37df61d5ea5be0e65cced185380550b77428c910de8081a2f0ef1b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647890691, "uuid": "32881f13-a760-4dc0-8699-0a72bc323276", "comment": "Malware payload (RedLineStealer)", "value": "600d7c1690915f43e933eaf1cb509548fe8d4dc5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647890691, "uuid": "8e69bf51-d392-4b26-928e-d3ef62b7c4b2", "comment": "Malware payload (RedLineStealer)", "value": "ca8a557c444fac5464c0cc7b116960053c4b559f9ca875a95dc77079c1f137aaa7e19c183c1a010d688c4cc78fd3c9d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647890691, "uuid": "95564d95-26be-45bc-b57e-e80517ab4051", "value": "T10A84D000BB90E035F5B712F8597A93AD792E7AB05B2594CB32D416EF5A356E0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647890691, "uuid": "cd1a7c1b-fb29-4b8b-9a78-ce1aa03deb67", "value": "7288d715a9ee18d7dad5b71be8ad934b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647890691, "uuid": "94dbbaed-e23b-4483-af44-cb82c71e54ae", "value": "6144:XYuSkzJiw63CEq9fFW3LG+1Qo19g2Wuintl5QLV7R01qBAo:XEkzJiw6hOfFWPm25AxOZHB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647890691, "uuid": "04dfd687-9f32-48e1-8f61-3d334203d074", "value": 389632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647890691, "uuid": "a5e368f2-3b85-47d1-b0c2-16135f35db0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647890691, "uuid": "17c3bc9c-cbdc-4e82-a034-7715539da06c", "value": "bdd67fa61c8382a69867fc10e96aaf76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053e3c04-a8ef-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647850508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850508, "uuid": "9c27b187-5572-4778-abb6-4fbd892be1e0", "comment": "Malware payload", "value": "162bf8e6c5bfe7f22c55d9ba76d84b48", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850508, "uuid": "34edc9fd-4537-418b-9ae8-b31659deef40", "comment": "Malware payload", "value": "48c204bb97634c59cd0c7050d2d0f79117341c9b8d3a515439c7597973b6de8f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850508, "uuid": "3f9b7c24-b2c8-4487-b358-34d5aebc7c91", "comment": "Malware payload", "value": "12bca779b071eeead1f2508efbdf91edc3d50b69", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850508, "uuid": "e2cde405-9bab-4e7f-929a-0ac037f194a4", "comment": "Malware payload", "value": "d39f3592e78daafceeb2565df2e6be3eaa08163ce5763ad88a7cd02bac1e57597819f9b750f84ac43fc32c221bb39634", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850508, "uuid": "d5b23125-164e-4a1a-9e75-c85710dc1ee5", "value": "T14724C502FB866B1BD2E9193440A9C37CA7669D53C992829371C17B3FBCB5574EE0BB10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850508, "uuid": "45511b70-372d-4adb-9439-7bdbca02fa55", "value": "3072:isJgDV4R4G1qt1E/q59mR7AhI4anomOkxCCll1:HJgDV4R4CpyNi4anomOkoqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647850508, "uuid": "693dc35d-7ccb-4d6b-9cf7-48bd030f783f", "value": 228352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647850508, "uuid": "2e9e7867-7bbd-4fd3-9c83-e3a611f42556", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850508, "uuid": "dd457351-1065-4355-ac8a-34af0dbb3a39", "value": "SML_F_37 e_application form-MA7492H.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b289be3d-a914-11ec-9275-42010a9c0029", "comment": "Malware payload (OskiStealer)", "timestamp": 1647866690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866690, "uuid": "7808f7b1-6887-40e3-bc16-70b1a11fdaf2", "comment": "Malware payload (OskiStealer)", "value": "867a7574f6a6225f0b6e88ab9fd76c5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866690, "uuid": "c80ddc33-11cf-4053-955f-e5509599cf81", "comment": "Malware payload (OskiStealer)", "value": "48c6b04927b84944104668484d7fcdb9cac6ecf195307821a13c5de0ea3bf107", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866690, "uuid": "25c8a6de-41ba-429a-aa8c-9a068c83e289", "comment": "Malware payload (OskiStealer)", "value": "5ab7d2c44bb8b6930ed689fd9de94e68cf8459cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866690, "uuid": "dfd08be1-c2d3-4f56-b7f5-fd0d5276f555", "comment": "Malware payload (OskiStealer)", "value": "1b52bb017ccd80ab6e599b37382b1966ada536e65b857f51f7e04234bbf682851844ad497cdc79508c47451f3af0256b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866690, "uuid": "2b664310-6de3-4458-bf07-1469160dcc5d", "value": "T136642353A7C448EBF5E306712C7AA722833FF6E809B8428F67D08FB5C65159345291E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866690, "uuid": "610bf0cf-3222-48a0-bbdf-b4a5db190af9", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866690, "uuid": "b64d3d98-1f03-45e1-94db-b1c99b0003e6", "value": "6144:rGiCzLQ53j9w0XBMy/VizsJIBtwSvoLrESsDObXj2Zk3QxG:rR9wSM22sdSUrDWObXj3gk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647866690, "uuid": "83f09341-18bb-4ead-9d62-a298d16c7a29", "value": 330772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647866690, "uuid": "b7ff4c36-38b0-49cf-9c34-3c59703e0380", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866690, "uuid": "e19102fc-3ea0-4f8a-8f12-1408e2a5a3e8", "value": "Invoice.NO65TG43_xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc8c5a72-a942-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647886463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886463, "uuid": "63f8d77e-954f-4104-858f-d14fb9fce506", "comment": "Malware payload", "value": "0dc969799cd07a91d7d00825bf6d7e9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886463, "uuid": "fa91e072-b209-4bea-bfe7-30888ebd64ba", "comment": "Malware payload", "value": "49424ea75f90474c09ff21f52d86bbbbb9577e420c553f4dd942ac555cec938a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886463, "uuid": "6b2816e6-f221-45a4-b2c3-a10ad050d421", "comment": "Malware payload", "value": "dd21e9900ca37dad0ce236aa636cf5a5554dda56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886463, "uuid": "1848c149-ce05-4f55-86f0-38ad5cb05b12", "comment": "Malware payload", "value": "44c09329c7324905e225491c04166ea715be13c9628752a3f26af8276d7260f21eeef121ccd110d2ecc265976636bde8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886463, "uuid": "63d5d982-791b-4eea-b769-0360758f59ec", "value": "T1B0C37D1175D0C872E572193109A4EAB19E3EF9714F606EEBB3C8463A0F742C19936DAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886463, "uuid": "ff865ae6-c083-4b70-baae-9d2d81556aec", "value": "b1e8695b9eed440cd1ef5f8703820ee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886463, "uuid": "db92f460-a120-47f2-a426-94425a9daf96", "value": "3072:Nrn4CuDcpMkymV5x0RCVZeeUebHCDYp61FmHhe8pTAV02DaEb:Nr4Ndkf5xUCXUXDY8TDaEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647886463, "uuid": "c0456c00-b831-455f-b638-855d374cd644", "value": 125952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647886463, "uuid": "ff92a73f-4b0e-4c67-8857-7c3061d289fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886463, "uuid": "403bedd5-74a4-4db0-bb77-5ead99b9303e", "value": "SecuriteInfo.com.Trojan.GenericKD.48643443.32552.13475", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "589a40d9-a935-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647880712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647880712, "uuid": "d403c045-cf06-45e0-9bc3-372d2864ba3b", "comment": "Malware payload (RedLineStealer)", "value": "0cf5ca8b66054f548311a08d486280f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647880712, "uuid": "e40728a6-41a8-4110-8bc6-32361781170d", "comment": "Malware payload (RedLineStealer)", "value": "494acc0f2d4cb623bf47766f4d409ee33e61f99895b33a8b8042cdcb0b37e5f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647880712, "uuid": "c94b1e78-6e41-4bb5-ba15-739882246bd8", "comment": "Malware payload (RedLineStealer)", "value": "70d3fb63c8529890f8b38a0e107015624257337b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647880712, "uuid": "8b466e58-083b-4b69-ab45-a0b4e1881b1b", "comment": "Malware payload (RedLineStealer)", "value": "0885419adf902a51d9916805a4674692a656d3696a9242c3478f29eda5f17dd451770dd301d96a3708965832b75d0aa0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647880712, "uuid": "b740578f-7036-43e1-9418-d30347ef3603", "value": "T1B2938D3177C8FE36CA58B7769617532003F1EC82A26BC34BBECE77656C426557A02AC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647880712, "uuid": "efb4c855-2652-4c31-91dc-0ccf003ce265", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647880712, "uuid": "1458832d-927d-4287-85c9-7c1ee92916ae", "value": "1536:FjjRV4rfb7zPvblDDZyHXMkbfvZK2y918LHO+CogFfHN:lFCrfb7zPhfZyHXMcf9618SEgxHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647880712, "uuid": "5b68a114-eaf4-483a-8d2b-217955d17370", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647880712, "uuid": "0ee008b3-d818-4a03-bebf-14244473e6a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647880712, "uuid": "82186b8c-a1b0-42de-b783-0c650196d27a", "value": "0cf5ca8b66054f548311a08d486280f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd42015f-a8f4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647852964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852964, "uuid": "5876e3fe-1c71-4e37-a340-65f74af4cb96", "comment": "Malware payload", "value": "4282de3c6b6fa5e9ca6565c3caac03d4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852964, "uuid": "19470642-452e-4469-a39d-81647b6a778c", "comment": "Malware payload", "value": "494b7f404ef72e7484b5df490c4ad91c614cefee92b875ddd0026b819e77c8d5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852964, "uuid": "9414be02-7366-48fc-8e18-162c82573793", "comment": "Malware payload", "value": "c346f0406073bbfa2d5b74b26c73aa13e79e5a5e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852964, "uuid": "ae380f61-5342-4e6f-bd34-20b2d0a49b1a", "comment": "Malware payload", "value": "d8b9846828beb9b172eabf331a56a95a0e2ca368497281108b9f872f0402d5e932ebb7f21547d4a0d46fbc8e98571edc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852964, "uuid": "2d8e10fe-4475-497e-9b8f-cc08dd9de926", "value": "T19B121ABCD1BB8ADCCFCA52E0B9217E5910A9366DC3C85253367CB3716B59EBA1103470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852964, "uuid": "5956196c-bcd3-4e3e-8e96-dc02a0f1fa16", "value": "192:KLFxObMTBEDTLA22h+2otAXYNb/RzsjggUL4GKBP/ezpilY:0Fx4SEDvvbLb/yjgRL43eP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647852964, "uuid": "de436e7d-e851-4053-b3e5-1b98b7ed6cab", "value": 9762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647852964, "uuid": "bc682d39-2eed-4714-a765-f2a28d7220eb", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852964, "uuid": "89dd3653-1bbb-4d78-b592-75b52c495999", "value": "EXP-146 INV+PL ERGASIA PO 002.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab498e1-a8e3-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647845551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845551, "uuid": "02584252-35c6-4470-bc8b-519a4bdf7085", "comment": "Malware payload (Formbook)", "value": "15d055f71e370bd9998d39591b3b79c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845551, "uuid": "db345618-4061-49e2-9e1e-5ed4c452ea80", "comment": "Malware payload (Formbook)", "value": "496a9fb5d6f7b03a1dff59806fe6b74faf6755a903e82d99980769d0890f2730", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845551, "uuid": "541fb1cc-8509-4674-b80b-beb28ee0cccf", "comment": "Malware payload (Formbook)", "value": "57934ffb0fbe5a2f79e7164b0883430713db02c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845551, "uuid": "bc4fe311-51cf-43fd-9f32-dc1013438ad0", "comment": "Malware payload (Formbook)", "value": "6da732f6580ad19e3c4f31ca6b0fe513b73ba591e068b98c18b608baa5be601995574d4f86de75a0acd885af8de79a76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845551, "uuid": "fc8bed11-133c-4451-9047-6923b448d2d8", "value": "T12315BF23B6905437C13719788C579764962ABF012D78E88A7BE47E4C4FF93A23E38257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845551, "uuid": "9663c66d-21f9-4c7b-aae3-3505d03df48c", "value": "950e62f73f5e5b7317bde1e9f4b3b286", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845551, "uuid": "67ab0bcd-9cdf-438a-bf50-bad9b77162e9", "value": "24576:bqdMzLC5KzxOOWKMK7JbxvcMOJDnVinxHCP9iWvjCPH:bq/AfT1OpVinxiP9iswH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647845551, "uuid": "669771a1-5175-4dda-880f-8111cc75e9c7", "value": 931840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647845551, "uuid": "4324e56a-83a6-4b54-8893-b5491942a7fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845551, "uuid": "2dc085b7-c5fb-45ca-8e7c-0d38859fb707", "value": "PAYMENT_TT_COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac5070e-a8ec-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1647849416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849416, "uuid": "ec9ada8f-a9c0-4ea0-ac96-f508f9c65365", "comment": "Malware payload (AveMariaRAT)", "value": "b6fdc93520bea642974ef59099cd5177", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849416, "uuid": "b183c6b4-2cf7-499d-b4e9-7ac95e57a202", "comment": "Malware payload (AveMariaRAT)", "value": "4b1532fa6483dfb4194a1f3fbf583f511caea6035f61e9ffad798bd58981f5a8", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849416, "uuid": "d2f9e5c7-20fd-4ef6-a237-fecffcaaea85", "comment": "Malware payload (AveMariaRAT)", "value": "c57a04f187123a0e0e1930430593a78d8308a2b0", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849416, "uuid": "86cba5a1-f52e-4c3f-b0db-5a9ff4a109b2", "comment": "Malware payload (AveMariaRAT)", "value": "1fa215f66a2ee8e9bf28d78237bc56eaa2a9e29a6459f153122b6a778fda5d3543ee889cdb03f8e20117499921c24237", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849416, "uuid": "b0f4b4ef-65b4-4891-b336-047cb5d1a36c", "value": "T1462523BA23B84731C46C5374ECE6608586324903E651EF50AFC6F52A1D27B8B1B07EB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849416, "uuid": "c869d211-4cac-4f60-8e85-6569ce4c8108", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849416, "uuid": "f69f9439-3880-4d4c-b0a5-0a477bd2bdcf", "value": "24576:wUual98wKYiARGnXdPNv1nxLm5if1JWJ8CMmBj6Ggt0qwq68mQ/98:LucAYpGnXdPd/t6BgsSl8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647849416, "uuid": "b77c63c8-1715-4611-9638-f86a2151273a", "value": 993280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647849416, "uuid": "34c2a158-af6c-406a-8e27-af2879e35445", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849416, "uuid": "e7d995df-35b8-4dec-a299-b8d166a09a83", "value": "LETTER OF CREDIT-PNP PO-11698 SLUB INV REVISED.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "319f8283-a8e0-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647844140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844140, "uuid": "5d910516-ddbb-4401-ab71-64b748327e41", "comment": "Malware payload (RedLineStealer)", "value": "d8c2769c26679527e7f79274a890779e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844140, "uuid": "8a36776a-a2ab-422c-9bd1-bf6a63db7548", "comment": "Malware payload (RedLineStealer)", "value": "4b371db161ab9f5e29f410ca7eab4d101912019d3bc5b5235d3adf86ae884859", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844140, "uuid": "fd68d050-dad7-4304-9283-923470fc46f5", "comment": "Malware payload (RedLineStealer)", "value": "24566bb06dfb5e14d1161b7132c52c098ac3953e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844140, "uuid": "15192ce3-414f-46ba-8888-ce5e1f166f2b", "comment": "Malware payload (RedLineStealer)", "value": "4bd3cce426205bef32fa76386ec90bc13376a7b218507fae3d4418f4d67c34c8adcb61b09991fd8a9c2770baf01aa53f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844140, "uuid": "70cd364a-0d18-42e3-bb92-475d15c95f62", "value": "T1EDC423FBB0C0E909C68F55BD0D05F825A0A737DAA54090CF60E8AC583D2D5ABBD597F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844140, "uuid": "81eb187a-2ab9-4e5e-8af1-8a93eee39d35", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844140, "uuid": "151d6fc8-cba1-4d3f-b030-cd9301ee89ad", "value": "12288:6BDKkWtDbN1Ch6tTkQS03ULaHNqrxlKIQNoV5qoaaH8WA:6VK1DbfChdkEaHNYK3YqdWA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647844140, "uuid": "ada16755-94d1-409f-90c6-32603c9c0ac9", "value": 592840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647844140, "uuid": "5a87bd0c-7663-41f3-8508-015f4bf93c91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844140, "uuid": "68ff6928-afea-4ac8-b101-c9027f87851a", "value": "35247800.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa8d00f9-a95a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647896875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896875, "uuid": "97e6c78c-8111-418e-bcfe-74c53d3c7ff7", "comment": "Malware payload", "value": "6fd33713c2414d17c14f8ccad05ce474", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896875, "uuid": "5a1e0943-c120-4775-a07b-43ee23a102a3", "comment": "Malware payload", "value": "4b7553d0f29882f51b32bc9bc3cfe018b4c865727195e60385311b41a0bd70ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896875, "uuid": "2d093333-9fdd-4028-8b36-70ee6994f6ba", "comment": "Malware payload", "value": "705da2bca7922b96d3940de12889027f550443ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896875, "uuid": "ff439d83-a627-415a-9f3e-180982a10efe", "comment": "Malware payload", "value": "6931e36c448a19fe3cf7e4d0e22c1403e27e3e50de72d89d3ead644113d02f115da3b4e9cfe43edbb20992068aa1ef76", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896875, "uuid": "fecd3be0-8a1b-4a84-bd78-ea4524957bcd", "value": "T1F9552325B318CC2FDE6887F16963F1909678BEC16C1957039EA93EDEC7B4E136D46280", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896875, "uuid": "92241c95-7f6e-4ccb-88ef-6a8274172a08", "value": "b30bf38ed871ba992c8dabfb61d1aed1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896875, "uuid": "bbeb738a-40af-4507-96fb-af2a628c43f5", "value": "24576:pE6SU62CtQXB3CSod31MgAGd2xP15pQgFlHw6bsNUbwhMzmLYme:pEQ6XtmcKk8fpQoQYiUUazma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647896875, "uuid": "cd9fdc41-ade6-4b4e-a28a-2acfb2ec278f", "value": 1321280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647896875, "uuid": "8ad9e515-68b5-46f2-b3f3-0a083d519f40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896875, "uuid": "6521fd54-ae05-4f51-84f5-278d8f3f8ed6", "value": "6fd33713c2414d17c14f8ccad05ce474", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22c6167b-a931-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647878904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878904, "uuid": "8aaa6ab4-b707-451a-bac5-974e6068ba18", "comment": "Malware payload (Formbook)", "value": "5a997195a91e670c8cd93feeb58ca9c2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878904, "uuid": "1bb0fad8-d5ce-4a98-b663-8976878d6f5e", "comment": "Malware payload (Formbook)", "value": "4b7dde2fea5e47f598c99c16ee2def08d1e2ffe13053a2edd47f2f7ff93187e1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878904, "uuid": "85ae3936-0356-45f1-af5e-8cf2a129977c", "comment": "Malware payload (Formbook)", "value": "101ac225f8f04cca8b5f1cb94aa6cc0c64c21ff4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878904, "uuid": "39090c21-ffd7-498c-9bf4-58b1d549c6c7", "comment": "Malware payload (Formbook)", "value": "1413d9875919e3a5e00150f8b7490d0971baea677225373274c58f78343816e62baddba4054972ffe2529fc4331463b6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878904, "uuid": "255ea03d-7303-4d0a-b70a-d5ef156a1fbd", "value": "T125A4F145139D50A3CDC5CDB84AB6D2B88AAFBE964E744007724C69E9EF3F16B05603E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878904, "uuid": "126657fd-29c8-40a9-85b4-a30479ce061e", "value": "12288:zOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOU:zOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647878904, "uuid": "406726a4-9a0f-4fcc-b144-32b76734d74a", "value": 475136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647878904, "uuid": "bdcc9859-a1a8-4dc8-897a-6e4c143a5a28", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878904, "uuid": "d75795c3-62d5-4aa1-99cc-c2897927f099", "value": "Purchase Order SFOWRN5.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c30ea3a-a8ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647857418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857418, "uuid": "a1fb6b7f-871d-4289-97dc-02707dd8561d", "comment": "Malware payload (Formbook)", "value": "bcad1b4b7045b6a547d9994e04356561", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857418, "uuid": "650b9df8-2eed-4035-b297-df93de8b29c6", "comment": "Malware payload (Formbook)", "value": "4ba70a201f9aeed927954ccf79ebba102df5f50c437c278636b1905b3f71058f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857418, "uuid": "e967a781-a505-4401-9362-8e755d6e6626", "comment": "Malware payload (Formbook)", "value": "5336d3df0209627b48ea4ecffbb7186dd3f84671", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857418, "uuid": "eb183bb7-28d1-4520-8c2a-ff6c0f2b8100", "comment": "Malware payload (Formbook)", "value": "fec7872ebfb6781af4b1de07bd8bf8bc16d8ee2c8478ed14efa79bad88030d09aac592ffd173e623380b298ed41c11cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857418, "uuid": "62973fbe-b57b-461f-b364-5e4bc3bd32cf", "value": "T126158D3AB7E1A612D9B309B234A4049082F57CCAE5B7D4FC8A5CACAC3575C4EC13D75A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857418, "uuid": "8bd5a56a-75e7-4f73-ad1a-a03f47269c3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857418, "uuid": "85fa98de-9426-4e9a-9ac8-b571bd855278", "value": "24576:EfxgkRKxfYnmbcCkJ6y5jBlQtxGMCL8h:COkQVOpzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647857418, "uuid": "97dd15be-eb9a-4964-8b2b-5fad55afb640", "value": 924672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647857418, "uuid": "87ea2465-8562-44e6-8bf7-1a76df4d9138", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857418, "uuid": "b75a87a9-9b41-4345-8d62-5c49e8587173", "value": "bcad1b4b7045b6a547d9994e04356561", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ecb54bf-a8e4-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647845880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845880, "uuid": "19d2783a-4d72-4a9a-8f8e-f9a0d02796db", "comment": "Malware payload (RedLineStealer)", "value": "3fdccf39df1babcbe28b5ae35be59305", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845880, "uuid": "a3bf82cb-4556-44aa-859f-44f89975acb9", "comment": "Malware payload (RedLineStealer)", "value": "4dc361682e4922aa389758a96f0a0d0b375610b6c5fb22ab120e0132ca09da75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845880, "uuid": "d251dfe7-5e53-4c94-a676-9fd0661dd635", "comment": "Malware payload (RedLineStealer)", "value": "8efa79491e87d0ac2a508e7fac481a5c8cf0e018", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845880, "uuid": "387c33ed-1134-4bc9-9cc6-5a2ee140389c", "comment": "Malware payload (RedLineStealer)", "value": "a6d61dca6d3b09c7a81080da7fb06160d9a3c21eea20d74c83557f56c629cc846afbc36f1ba481421953588186dab6bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845880, "uuid": "f8e6af39-acc1-47fb-bd7e-43e23869cfbd", "value": "T15C1523540214380CE2CC1FF8B223138A97EC67ED1DD8629BEB6D0AE7566F1B9464D5EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845880, "uuid": "be40289f-e17f-4136-a050-324f45d7bf60", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845880, "uuid": "d750949a-65d0-405c-a474-30822ee938b9", "value": "24576:GcQ3uHegnjWmLMcVQ6WbpmfH5CkEaHNYK3gA7oy3NVzLjO:GJuHxWy6J/NafU6NVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647845880, "uuid": "98eb783d-b213-49ed-a155-b3f72a57f6d4", "value": 944944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647845880, "uuid": "c6df5bd3-f5f0-44f1-a45c-8ae4f4b81d69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845880, "uuid": "b0a1a1c9-5779-4ca2-b208-40a1f3820903", "value": "37827613.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f37b8c9c-a8fb-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647856061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647856061, "uuid": "87272212-8cc5-4a7e-8c0e-9e8a8768cedc", "comment": "Malware payload (Loki)", "value": "e42fa8f79ff1efb480ae28c1adcea3e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647856061, "uuid": "d4b09881-cb62-4f78-97d9-3e5cbec8cdf4", "comment": "Malware payload (Loki)", "value": "4dcd1dc440dacf61917beba2988c623cf4a584b4b3d4dc6e4fb48c8c83102b6a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647856061, "uuid": "25ff1101-5bf4-4520-8796-c47629e56d49", "comment": "Malware payload (Loki)", "value": "3212dab8c6302f4dfab5ff964fbc74f6e1fde9ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647856061, "uuid": "017dfe45-cbda-4217-9c7a-d51a16ac724a", "comment": "Malware payload (Loki)", "value": "611558f8b10c3516070eb7e2f15dc8907f541ba31b0b87f7f74604f10250626b0d4ca520c87cfade13288884619125aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647856061, "uuid": "48308d6b-094c-46e2-bc85-d35bdf2b2b5e", "value": "T1E834123D5BC56527DCA102B01B7E9FBBE7F2805D01DB5E8787A02DBA1872386140599F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647856061, "uuid": "a7e0ef4a-1275-4d89-9119-baf39d826ac3", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647856061, "uuid": "f3d25022-d598-4948-a39b-e91cc13284f3", "value": "6144:rGiSxCw4zlgBv3BTvn2Egb6iAimMeOuXSstowHzYZwg:KCjiB/Br5pG4X9qwTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647856061, "uuid": "d3b42e76-51a2-41c5-be0d-b0fbddb4ae6d", "value": 241201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647856061, "uuid": "c1da096d-7352-4c93-8451-99cd24241cb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647856061, "uuid": "db16ab8d-d09b-48b6-ae87-5129772215d1", "value": "e42fa8f79ff1efb480ae28c1adcea3e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eb26948-a8ed-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647849879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849879, "uuid": "126b7114-abaa-4fdc-afe5-ef0bcc90b464", "comment": "Malware payload (SnakeKeylogger)", "value": "94a4d3e94d908dbbc6cfe39c2e2c3d7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849879, "uuid": "47cb65c1-c124-4d36-b4eb-a362935302de", "comment": "Malware payload (SnakeKeylogger)", "value": "4e2f92936c4bcbfc90dbad8a545150cd3f1ee247ee6cb4f55de1ab4f7111cd61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849879, "uuid": "61212238-cdc1-436a-afc2-a07e2bd337d2", "comment": "Malware payload (SnakeKeylogger)", "value": "aa55ed4dfa00a97f1ceb0830bad1c0d174167683", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849879, "uuid": "6d0a0086-7823-4648-87da-9fba3b5130e0", "comment": "Malware payload (SnakeKeylogger)", "value": "4de3d5d7575c641de6d26e6381bb72c40a398d8a85d72d6126433e8357108f85149a05c3bc82a79c45b49d76307de607", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849879, "uuid": "84932dd1-2f03-40d3-a9e3-c0ec7261a151", "value": "T16125336937FA1321E82CB675FA482AC04BB204577926DB18E945A4DA0E137110F67FFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849879, "uuid": "6326cb8e-167a-460d-8eef-72187220b9f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849879, "uuid": "db9d2aed-d612-4064-b798-5d1ee04d3479", "value": "24576:7HUl931HJ/zfeCnJNAsdwviEYa8ifSgVCjt:7HKFNzfeCnJKReGS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647849879, "uuid": "e5d5a368-5d92-4937-a11e-48db93c8ac11", "value": 964608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647849879, "uuid": "00fd7527-f3db-479a-a749-93fee7838a33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849879, "uuid": "b5d432b7-6c09-4cc1-a694-9d40df41f7cb", "value": "payments.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd5a08c-a92d-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647877149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877149, "uuid": "804a21b8-b0fa-4fca-9739-04ce192027f3", "comment": "Malware payload (Formbook)", "value": "a1e4e121c1bf7157a4b99f5f47492c80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877149, "uuid": "7fe0da0f-0461-4fb4-bd23-f65895ac1a7f", "comment": "Malware payload (Formbook)", "value": "4eac3744a1240baa0ba6a519876425b8c52ddaefcb6e65afe077d71b1393ae52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877149, "uuid": "2cc7146a-1a6f-47af-a5a5-2fff85cd265d", "comment": "Malware payload (Formbook)", "value": "a689e4386bc380ffbacef832f49d7984bb2d19c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877149, "uuid": "11272f96-ad86-45fa-adfb-5c4a67f7cf12", "comment": "Malware payload (Formbook)", "value": "7d409baba1edd036d8e38389985096e76e2f2fb1e81ab634f27b28e84e94ebf0dc0889ade2acf03a14eb51217283aa7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877149, "uuid": "e6f68a0e-5637-4eb1-a49c-253ccaa53bae", "value": "T1E3B49C3F15696377C97BE6358690142AF690D5EF3902AC19EE931B800D131CB7FC6A2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877149, "uuid": "07854e59-86ee-4b69-8e78-46f0f3f48d89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877149, "uuid": "ca7e4e14-54e3-4403-ae21-2b73c7290a72", "value": "6144:6TxWy/E+/Ig8W0+5mBQBLXR4Q4d6lNm7uwDiH2ZkxqFxPvcfznnHNou2FP:akyz8W0+5moOOLwDiH2ZkjfrHNV2FP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647877149, "uuid": "d47a6ff4-5650-440c-acd3-ebf4ad7d5945", "value": 533504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647877149, "uuid": "5a5a7e10-11a4-4b45-b8ad-1699cc057970", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877149, "uuid": "3d2d4f48-9a60-4ff0-a3eb-0c4256594b9f", "value": "SWIFT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1595a4f0-a8e5-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647846240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846240, "uuid": "2bd2b656-5087-4144-abc9-85ecf3ff2689", "comment": "Malware payload (AgentTesla)", "value": "5822ea90065a975e82f0851f536c2c55", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846240, "uuid": "5b495b1e-c617-4243-b96b-ea171d2f55c1", "comment": "Malware payload (AgentTesla)", "value": "4f02bbb2cb89ebe126bd1041f3026799412b24fde9e4895fe3a561d7f87fd716", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846240, "uuid": "9c1322ff-cefd-4383-9d1b-e2fb660822f1", "comment": "Malware payload (AgentTesla)", "value": "2d8a120ba022668ef3ae490bda82ec5c73b2c5e6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846240, "uuid": "bc31d3da-b1c1-4770-8503-34e93971fd38", "comment": "Malware payload (AgentTesla)", "value": "3dbe095873820dda7e92f58a9b1bb2abdbeebaa53ee07fe2ec71176322bb8e787bc5d16dbb9e73c46b227803f16a7805", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846240, "uuid": "1a8aaaf5-ea80-4863-b05d-88d8cd38c584", "value": "T176F4F8BD715472EFC877C1328A945C64F650A8FB630B4917A4931B9A9D0F8C7EF840BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846240, "uuid": "f178a86f-8202-4ee2-a5a4-3893b0e181ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846240, "uuid": "188bfa43-f1fb-412b-93b4-e4f04e3cf262", "value": "12288:JURv+kQan8SqE/9haNfk1pTz8qcS/W4whjYWIP73XvZFKpURInWoi9IY/3kMve9H:2Rv+j5vYvkMvub7AbSGJiu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647846240, "uuid": "ce703691-f355-4dbc-a391-4620c2d3757b", "value": 740864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647846240, "uuid": "05aa6ad7-dc36-4b15-b7a9-7158f61fb115", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846240, "uuid": "e8c34b48-dac2-4d7a-ba6c-bbc93e70741a", "value": "tax invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f732677-a92e-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647877663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877663, "uuid": "1c6d0ae2-bc9c-4249-824d-f4e326538e3c", "comment": "Malware payload (RedLineStealer)", "value": "2153e47a0dc1bb8431f3a5ba0cf4d8d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877663, "uuid": "625a276e-a0fe-41c0-91dc-123e72b5ea2f", "comment": "Malware payload (RedLineStealer)", "value": "4f6070fe259cd83ed1947c7e56fac48d29869bdf8fb4ef4d853acdc4dc64760b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877663, "uuid": "d1531a9d-65ae-480d-967a-55094533696a", "comment": "Malware payload (RedLineStealer)", "value": "cefeb6661c83f953a8ea07161963f4e3f9d55541", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877663, "uuid": "1f492012-06ed-4d69-a979-e56ca92d3075", "comment": "Malware payload (RedLineStealer)", "value": "6a63c51c28c9446fe7c6c5b01b20bc20023c1426538f0071028538ca8fc9f0af910290601054b8a634a545f67edd3115", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877663, "uuid": "e6c774e0-e2c2-4ed2-8a95-67beab53059b", "value": "T17574C000F6A0D035F5F716F8597593B8A93E7EE2AB2090CB62D066EE56356E0DC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877663, "uuid": "bcc5fad9-dadd-4c2e-b0a1-63433eb55dd2", "value": "b1f4d968dd55bfd215498c3ca94c2cf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877663, "uuid": "d0873ab1-e50a-491b-b489-b64078a54ede", "value": "6144:yldhGIG4ihW54BilZrxOl4upQztHHp9HZIGnwVqBOtwRquN:0dhythW54BiFKatHHD5cVqBOtwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647877663, "uuid": "e1d5fe33-44af-4482-8142-e71b311093c3", "value": 370176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647877663, "uuid": "baeeb2d1-6d8b-4cfc-be57-c83daf1cd442", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877663, "uuid": "878f0476-4b34-4fe3-86a1-2f9e58e4f13c", "value": "2153e47a0dc1bb8431f3a5ba0cf4d8d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d482e88-a8b0-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1647823570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647823570, "uuid": "045eaa33-78f1-4fa1-9fc9-94e2ac4ed1f1", "comment": "Malware payload (NanoCore)", "value": "7ff83bbb700000cbec628a72e5b083db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647823570, "uuid": "7025bf91-f04d-4ee5-8c43-c58364e55e51", "comment": "Malware payload (NanoCore)", "value": "4f99d4eb386ab8c60ca6e918b6c7089f29089a5f77c255b01d54ebfdcf55c69d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647823570, "uuid": "4a7e0efe-04c8-437a-9f6c-052a0af7db5a", "comment": "Malware payload (NanoCore)", "value": "1580d079e617d6cf75e0cb0afa7bff2b02a60aeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647823570, "uuid": "dc191e0a-6fa6-4d6b-ad9e-a24f9eed0f77", "comment": "Malware payload (NanoCore)", "value": "b4c3caf2cae9120a09f0abc2c62601ce819a58d004929eecfdd8a5210115b3bc7cb025e9bd4b3909edf7808f4ec06baa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647823570, "uuid": "ce2fe836-ae42-4ef5-981a-84595f2321c2", "value": "T18314CF163BA84A3FE2DE8A79711212138379C2E3A9D3F3DE18E451B75B663E506071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647823570, "uuid": "54471db3-470c-4063-901f-5b5be077c5f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647823570, "uuid": "9e425fd6-a6e7-4ea8-a5fb-aaecee496dea", "value": "6144:wLV6Bta6dtJmakIM589K96LQHUFoqqg+EUA:wLV6BtpmkQ9THUFfqg+jA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647823570, "uuid": "22b7a59c-fbb5-4138-8211-a4a39c500711", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647823570, "uuid": "11517251-6726-4685-a2a9-ed58b1b699be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647823570, "uuid": "07cd3a9d-5118-43dd-b95e-ccf6326a860a", "value": "4F99D4EB386AB8C60CA6E918B6C7089F29089A5F77C25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdf906e9-a8fe-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647857287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857287, "uuid": "8ff52839-a1a4-4e3a-bf41-f0bea24d4e14", "comment": "Malware payload", "value": "86f95711b9ae5c0caa5c29ed03fcc069", "object_relation": "md5", "Tag": [ { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "SLoad", "colour": "#1A35A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857287, "uuid": "ff68b17e-0a6a-4254-809e-f7eefd96b695", "comment": "Malware payload", "value": "503368a62a7ba218732d7083fa0bf7a451d4fe3c040b4a3bd35487f6211de18c", "object_relation": "sha256", "Tag": [ { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "SLoad", "colour": "#1A35A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857287, "uuid": "ab1f539a-cf21-431e-9ce7-3ff043a26e68", "comment": "Malware payload", "value": "2d4ad52560bda0994715298a1bf19d141c13bf0f", "object_relation": "sha1", "Tag": [ { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "SLoad", "colour": "#1A35A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857287, "uuid": "7293bf75-0cb8-48fa-8f3c-b3bcab83fdd3", "comment": "Malware payload", "value": "a19e50b39635c0ab01b6bea8c63744258c160ec72f0080ee9ab668dcd3215bccaced76302b133012ec4f9fec640f7948", "object_relation": "sha3-384", "Tag": [ { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "SLoad", "colour": "#1A35A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857287, "uuid": "1648d30e-1c01-417b-a5f4-7d51a6fbe804", "value": "T1FFD329F7C427AE4E56FD2B790AFD3AD130526246C782C123D920A46D7247BE1FA7406B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857287, "uuid": "eb975710-43f0-4404-81ea-6360e308d8af", "value": "3072:vrLUAxezczKGY3ATQJip/QLvY/rp/FXnmeo87Ci4GlzOZ9z9XnE3+MQ:vJezczK33YOipQvYjp9Xnmeo8Wi4OzOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647857287, "uuid": "fcb589ba-e269-4ef8-b824-33c8fe74573c", "value": 133372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647857287, "uuid": "116d4e75-e83a-4409-b1b1-f0a3d1047622", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857287, "uuid": "8d134e51-16c4-411e-b126-bc7574f84264", "value": "503368a62a7ba218732d7083fa0bf7a451d4fe3c040b4a3bd35487f6211de18c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de277f2c-a8ee-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1647850442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850442, "uuid": "f371dd36-dcba-4008-876b-14e66482802c", "comment": "Malware payload (Gozi)", "value": "c0de3291fe744c4941a518ac41cdcd10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850442, "uuid": "90258ec8-f8c9-4464-a8c8-ebcfe6f66356", "comment": "Malware payload (Gozi)", "value": "50ed0329ffb7ae83f7a8042ef7f6bd5af5f308e52f479965358cfe4d646b1847", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850442, "uuid": "9161c543-b0c1-4b13-acab-ac50494adf62", "comment": "Malware payload (Gozi)", "value": "07a83577f3af719d8cf386d9768edb24a104abab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850442, "uuid": "b68897e0-085d-4f7d-bf62-bbf0e9120490", "comment": "Malware payload (Gozi)", "value": "05a8935b50008a0ce554d74c6ee8ffc2aa938309f28bdfd6fabf42d497f64a8abec74d7aa4d91a9926ef82d0531e4ded", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850442, "uuid": "ff2a39f2-8467-479a-a3f7-fde8474e38d7", "value": "T18B54BF313690EA32C4565130DC26CFA15AFFBCB119A0860377A41B6D7EB23D19A6B35F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850442, "uuid": "b76bce19-3988-42e4-b9d0-700781f2fa50", "value": "5fb8a90699385dd79bbcc37048719eae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850442, "uuid": "7537b295-71ad-4dbf-8e1b-8e520c164c1e", "value": "3072:yegxD1L1RBOhoaJSoIzl7aQ5wYM/h3jTxX:CD1L1RoLJS/peYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647850442, "uuid": "7d997458-3405-4651-805a-fe7f11dfaff1", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647850442, "uuid": "d0a02d70-e582-4a2d-bee2-881134458bd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850442, "uuid": "d8d5ed0f-32c7-4bfd-9131-24ae447e21c0", "value": "50ed0329ffb7ae83f7a8042ef7f6bd5af5f308e52f479965358cfe4d646b1847", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b48792-a909-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647861836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647861836, "uuid": "58fbe3b0-f627-4213-b189-f26d1e16b303", "comment": "Malware payload (Heodo)", "value": "87b6fdba3b6296787d638b8eed58746c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647861836, "uuid": "79a481c2-e97c-4d73-baa1-41d4aeabb923", "comment": "Malware payload (Heodo)", "value": "51167730fd8967e07bb0c71ce835970c25c7ca8ab49b42a026a7dac0da0fc82d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647861836, "uuid": "3fd1a6fa-5266-471b-8fc7-c9897e6f8105", "comment": "Malware payload (Heodo)", "value": "1fa59994436a1820fa880f62bb29408e6cd7e96c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647861836, "uuid": "da8b7488-3c0b-4f4c-a782-75767bec3468", "comment": "Malware payload (Heodo)", "value": "fca490e73dade0d0bb741a41570e1ae0f1c3c6d60bdb2cef7b1cea47cc6c791f77917ad39d4c0b0bbb50690fd8e887d1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647861836, "uuid": "02cabc69-5f9e-4305-8e25-846fd0b8b023", "value": "T13FF46B936BC2C077E41F0279860A6228725BD5323756E6DF37C1D79FC9387A2AB38102", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647861836, "uuid": "0395047d-1edb-4cf2-a946-69cc1cca350b", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647861836, "uuid": "52dcd30b-c32b-4d70-b2ba-d7f887c8b27b", "value": "12288:wGOAWAyzLzHKwJrCf9dJJjI1rMpUsN+JinUqqOYJwOD7ZjAjKL7mYYlgV0p:w5aYJwwPHmngyp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647861836, "uuid": "d147a5c2-cb06-4f82-9a70-3ceeb7df3e74", "value": 782336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647861836, "uuid": "14d81de5-dd17-4594-9e88-8e70911de0fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647861836, "uuid": "bb011a84-2ac5-4b03-ad31-35eb3290be4a", "value": "emotet_exe_e4_51167730fd8967e07bb0c71ce835970c25c7ca8ab49b42a026a7dac0da0fc82d_2022-03-21__112352.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65a2bf86-a8e5-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647846374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846374, "uuid": "14d9b7dc-fdd1-45a6-b764-4af772181b52", "comment": "Malware payload (Formbook)", "value": "391a9268885e7482c9f58bd6d0860f4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846374, "uuid": "08225509-9962-4fe3-ab67-aeff28b23569", "comment": "Malware payload (Formbook)", "value": "519613b7d1ac99793523eed3df18438ecf95f4da29fd4c1ccaddc08cf0600960", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846374, "uuid": "486279e8-af59-4a41-8744-c8bb8898bbbb", "comment": "Malware payload (Formbook)", "value": "3b0a4e33f829ac9c660fe3ce27d763791671e72c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846374, "uuid": "39447b95-5285-47eb-9f09-fd5f5aac51af", "comment": "Malware payload (Formbook)", "value": "a6dd29d0902421cb800e36f9cbe9ea32fb37f178ba5df86d7e1eb892d3f7127a6717db38e3b4eec60ab78922b9af29b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846374, "uuid": "85bded16-5b7b-4a48-a678-1dd850298b98", "value": "T15D521BA86FA8D6F5D9351AFA1CF74A102639F113E416EF1F70C5620B6D2321644F2B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846374, "uuid": "58417228-8b48-4561-9140-5c66e8d1d2c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846374, "uuid": "4b01d72f-bb72-4932-8d85-4145c244ecfc", "value": "192:Nbf8XZXFCRgHHn2/NBAsLSPwj9TfiiLX2HS9yxSyrsRt8G3mSF6zQtjzK:N4xfHnsNvLFx7iiay9ycyrsR2vZMtjz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647846374, "uuid": "8eef2b74-1d45-4768-9e8e-c0b710518f12", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647846374, "uuid": "a6ff3223-69c8-4bb7-832b-200d315e7873", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846374, "uuid": "752026f7-690e-46d6-a6de-38f05cba2b77", "value": "Zzogrgou09876545670987654.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52352a78-a91b-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1647869535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647869535, "uuid": "89dbb91c-64e5-4b59-8aea-14cff4e3c515", "comment": "Malware payload (AsyncRAT)", "value": "be7d8603d79043c19fe1bbb7430063a5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647869535, "uuid": "69954d6b-0ace-4294-815e-d0082ba23ca4", "comment": "Malware payload (AsyncRAT)", "value": "51c23c9fee47972db699d6fbefcf75f1f841e2a72efff842b34d38f9faf89a34", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647869535, "uuid": "c143e756-0c5e-4aa3-bd99-9510b381d421", "comment": "Malware payload (AsyncRAT)", "value": "70ea685356260783390552a16e44b93c2bbd341b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647869535, "uuid": "c429a355-cd9a-4881-908b-5417b4a631b3", "comment": "Malware payload (AsyncRAT)", "value": "288ea7b1faf8b9d823470f66dcc4c847911620939bd472663b8b6ab5fabe4c1d1517a8bbaf4926e4842dcf5f016be0b0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647869535, "uuid": "6ca6804d-e1c9-40a4-b39b-0017f499468a", "value": "T12BA3D55816D81485EC4524331A72825E6B2FDE4539E31ADFBF58BF1A93BFB808913C4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647869535, "uuid": "37fb0040-6bd4-44fe-9da0-09b8d336313f", "value": "2a2a662be9dffc461398e7c94d0b55b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647869535, "uuid": "e58f827d-6910-4961-b5ef-de97d8007f70", "value": "1536:GsQPbrquy4ULa3hmdSIZjwLLbQjKSNu6qUO6H2EgfIA9:JA/q/RLw2FAUJeEC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647869535, "uuid": "4b22c6cd-f7a3-47d1-ae87-f9fe0e9d837a", "value": 99840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647869535, "uuid": "b222c149-3043-47e3-ab9b-3b1b068284ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647869535, "uuid": "2b8ae4c7-8932-427b-9d45-8b5c6638d832", "value": "be7d8603d79043c19fe1bbb7430063a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c18ff50-a94f-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647891831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647891831, "uuid": "0721635f-5aa6-4327-be05-f03942dade9f", "comment": "Malware payload (Loki)", "value": "8561ad01c4cfc100b8a32bb67e8cab1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647891831, "uuid": "2620f369-da45-4ba5-a802-bcd388e5158a", "comment": "Malware payload (Loki)", "value": "527d716f7921358e58c8d7f62f4716d9d482e8aa401fc923433110b99f1b6bd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647891831, "uuid": "09cefb36-66d3-45f3-9643-b0c2f4587d62", "comment": "Malware payload (Loki)", "value": "c08669be828d642a3b98a8ffaf69056290d515ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647891831, "uuid": "1225c370-893f-40b6-98ac-bf9b9f19cccb", "comment": "Malware payload (Loki)", "value": "6188c7dc6caa3cf033cce3da5bb62b35017d66000238ab38a48ac310db469e43d61233e24fdf14033b16d677018109e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647891831, "uuid": "f57341c6-49d6-4283-ab14-8a138a73898e", "value": "T176541203978647B7D5931B747677E3BBE236D18C408A3E434BB40D276DCADA7822E960", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647891831, "uuid": "7e15b308-8acd-40d8-b076-afc36d582557", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647891831, "uuid": "2dcb3075-145b-48e6-a357-d2317a1f140e", "value": "6144:rGiVCiBLrcXvw2gtYtVOY4QQ8dKB60oFo5FEoMu1qRESvF4+XKHhaM:JCiBLrKwbtkQbFHJtPz13su4KBaM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647891831, "uuid": "00b75e6e-b76e-474f-8010-791054ad63b8", "value": 304298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647891831, "uuid": "992b64b6-b14b-4ea1-985a-e7c526eb02ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647891831, "uuid": "fac78ba6-488f-420d-aa1b-cb448c8e32d8", "value": "8561ad01c4cfc100b8a32bb67e8cab1a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "360243b9-a8f4-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647852737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852737, "uuid": "9211f22e-453a-4288-abef-588b3aa57749", "comment": "Malware payload (Formbook)", "value": "465547c83f9fe1bbcb9da61ff3e10196", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852737, "uuid": "99b7fa5b-cb68-4a83-9455-ddd1d176a815", "comment": "Malware payload (Formbook)", "value": "5297d79e8c5477e872646905da36e71b4a40f9d801f34b6e4521932981f1e9c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852737, "uuid": "2ec16c6b-243c-4a1f-858f-90177a135766", "comment": "Malware payload (Formbook)", "value": "1cf498f47ffbd5c023ada8814e1891142bb0c537", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852737, "uuid": "d4bd95c2-d165-4f28-87e0-7fb13a4061b8", "comment": "Malware payload (Formbook)", "value": "01c3b3b29e2582d98d0308441842dea94bacf20d4459624542e25e871f9ce98e2eb5c5aa2e1f0dc620c8f73d8541f080", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852737, "uuid": "10677242-4b1d-4971-aa77-9bf49fcdca9d", "value": "T1A534131DF1C68AF6E2A1043027BBEEB9E777D68410E8B1536FD06E533E31052C66A5C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852737, "uuid": "62ba8429-43fe-43a1-b2aa-c01169565a45", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852737, "uuid": "3a8b0af7-6a15-49b5-a8c7-5fbf523b7e79", "value": "6144:rGivWfwrrd6UkjCx5KWJiQlyrhdBm4GK6qQ:hgU0CxsqvIGK3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647852737, "uuid": "b92ddc4b-4f2d-4b92-9bdc-86335edacd83", "value": 249017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647852737, "uuid": "7dc21dd6-52cc-4e8f-ac9c-ce33805a5503", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852737, "uuid": "3e78f406-3713-4e61-9909-bfbc38b0de0a", "value": "465547c83f9fe1bbcb9da61ff3e10196.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e1543fc-a953-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1647893687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647893687, "uuid": "a847090b-f8a6-4465-aae2-14ef1c18dc84", "comment": "Malware payload (Gafgyt)", "value": "acff3ddd6b21545ea9c9c435481dd2fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647893687, "uuid": "505302e1-fdce-4335-b538-61b7c72bfa2a", "comment": "Malware payload (Gafgyt)", "value": "53d2f54603c2b54dc552081023d943b194ea448c6c33d89e3efa835cdd0f5788", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647893687, "uuid": "bdb24595-7129-4d8b-8012-42827284f571", "comment": "Malware payload (Gafgyt)", "value": "7c8ed70513023b0c2964bba4617b9b7264fbbf36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647893687, "uuid": "a823d16d-8f77-4ee8-af11-acb85f0da8f9", "comment": "Malware payload (Gafgyt)", "value": "f203f88bfc53dc16f25cde87596ea9f4091e414f35224ee99af60dc902c7d3c15c03df7ab53943065d7fc49439a875d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647893687, "uuid": "ec74c013-97a3-4b0d-963f-6fdda027271b", "value": "T115C31937A71C0783C49B56F12DAB37F18F69BEB313965181A10AFED00772AB12512F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647893687, "uuid": "c36a44c1-4708-4f15-b197-cb854c57771a", "value": "3072:6W4xIMA02+A+UfT7pZ7C9fyMmm/mcvLJHavrNb:6WeIn029fT7pJC5mm/mcvLJHavrNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647893687, "uuid": "6a89949c-ade2-449e-87a9-766d5df62ddd", "value": 121441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647893687, "uuid": "68c9e7ce-3f75-4b61-a683-9018a7a03f77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647893687, "uuid": "4506f492-bf02-4cdc-9031-3a1faf13d410", "value": "acff3ddd6b21545ea9c9c435481dd2fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329cdc1f-a8e2-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1647845000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845000, "uuid": "6e7b3732-d474-4dde-bb28-71d0808a0e79", "comment": "Malware payload (RaccoonStealer)", "value": "c4885121ca6743fc70b883a4aabaa0a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845000, "uuid": "583a54f0-5ea6-44bd-9dd2-fe48c31382b1", "comment": "Malware payload (RaccoonStealer)", "value": "541cc1f9003a29965949b077e6f628b945788c8203c057a4a995b125b1732a34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845000, "uuid": "c72960a7-c6c4-4790-ab0a-c23c5938c603", "comment": "Malware payload (RaccoonStealer)", "value": "d72bf0cff25eab92a0f1438c919f3bba2fb87d73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845000, "uuid": "d952b352-de6d-4ebf-a71d-9e8db689936a", "comment": "Malware payload (RaccoonStealer)", "value": "e314e9fe2d6f645a5d633ec6c9e0cd38d2b1ed978e920d55efd429fb8181b19eee5048b25df9de60d71af50ea517f3d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845000, "uuid": "00c3c79a-5cdc-4541-8c39-c9bae90eea36", "value": "T1262523396BDC877AC07A3BFE265354164FF6A3DB5030E79C6E94ADDC288AF454A40B04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845000, "uuid": "23d2bcad-dbd7-41b0-8f19-d7fd94a760e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845000, "uuid": "f576165a-95ff-4e3e-8be8-d408c25578b7", "value": "12288:BP/ImR1mPju7VfCOuughtYCZwbf8fKlL3Uy+UeIGH0oB3dsViF8vPsp7aPWXgoDQ:amXUjgloizgKxUXHBUKyVxiGPWXTea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647845000, "uuid": "9c537ab3-165d-41e6-9e74-0f770898878e", "value": 1026560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647845000, "uuid": "3f2cdbf6-32c6-4e76-bf84-f184e57b24b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845000, "uuid": "696f7ed1-0516-458b-8781-5b7f24f1ac0b", "value": "43028565.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1753402-a8c9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647834449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647834449, "uuid": "96e31275-70e7-4683-98ba-d2404c42e7ff", "comment": "Malware payload", "value": "f89cc983a17113d4a7824f644926ae5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647834449, "uuid": "5eeed134-9263-4c78-b24e-7c678c7c46e8", "comment": "Malware payload", "value": "563c116f6316bc0d37da9ac3e5977c1d1f3d56d278e86bb2e89555291bd14c6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647834449, "uuid": "7f52992b-4ead-472d-8dcc-49a9808cfae3", "comment": "Malware payload", "value": "b8f3bd3ec9181827322097522f04a910b968f33e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647834449, "uuid": "880f8799-f8e0-4a8f-b342-a6afbb113fee", "comment": "Malware payload", "value": "fe2e9e3f5e86d5986f56259a5a70dc98a86d965b148026b7d2c915d71a13631a9f2fe2185f0544c614daa0f3af6158df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647834449, "uuid": "aa08ad47-a6ef-4dc7-9e37-785086ababe7", "value": "T12E81310A985144A3DD4FCAFE0E77406C3BB8694121B04531893B4CCAEDF3F50BA16EAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647834449, "uuid": "03976843-742d-4f21-9b2a-44b97708cbe6", "value": "6cc2ba1dc8cce18b2184b2c4fc569781", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647834449, "uuid": "57aba9ab-b0c5-4f3a-af45-3b55e64985a3", "value": "96:dfg8Ar5BkIfgBgy8gZmYazo0TQEW0AGwBb:dIkWGuzTQE1AG0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647834449, "uuid": "34114e3e-8154-4023-920a-f7f705068698", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647834449, "uuid": "b598219e-3f6b-43d1-97a0-62354e4b0bdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647834449, "uuid": "1f98e899-da9e-4220-9023-ec93b2572239", "value": "SecuriteInfo.com.W32.AIDetect.malware2.1406.5690", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b6c7f8-a8e1-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647844759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844759, "uuid": "6257a388-cece-4f57-9adf-731bb5100d01", "comment": "Malware payload (RedLineStealer)", "value": "e33bb4ac1f596884ddc4802751e7369e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Zapchast", "colour": "#82347A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844759, "uuid": "91862a37-f17d-45bf-8322-7982f999148b", "comment": "Malware payload (RedLineStealer)", "value": "56a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Zapchast", "colour": "#82347A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844759, "uuid": "9a7f7856-c17a-49bf-af77-a03842fe14c6", "comment": "Malware payload (RedLineStealer)", "value": "7dbf53f971f22383e9d8a3dbc315c1247bd5a5ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Zapchast", "colour": "#82347A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844759, "uuid": "0cedc6dd-1634-4cb3-b02e-6e1ec1091525", "comment": "Malware payload (RedLineStealer)", "value": "28db6940552507738b9dfabcbb3eea9e8057b177e9c93f9fa232a3c587f9bb0abcd44a265f43025bb6060916ce797a09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Zapchast", "colour": "#82347A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844759, "uuid": "c419a3ce-dac9-49ee-90d3-ff5f1a609cea", "value": "T132245C35B390F436E0E20439A8DF83F564297A303755D8EBB7954F2A6A711C29634F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844759, "uuid": "1cda8674-9f5d-4258-95a1-489c4230125c", "value": "ef16730f39cfc071fa7952154fe83b40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844759, "uuid": "3945cd80-ff6e-4bae-9c5a-cb1b81294f97", "value": "6144:+p1fQWacrDafGZK87gHoLBnluwMK/r1I:+9rafd8oofuwMKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647844759, "uuid": "8a78f4d9-8730-455b-a203-3f0b15f43c18", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647844759, "uuid": "3768592b-94d6-4576-85de-334a03c00897", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844759, "uuid": "cc5e0734-8fc4-49bf-8ec8-68f4beb83ae8", "value": "69947568.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af98a57d-a92f-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647878281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878281, "uuid": "668fa5f2-23b6-4673-8c55-e66390547cbd", "comment": "Malware payload (RedLineStealer)", "value": "c0e0b71dc6dac6e0488eda75cc5ed86b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878281, "uuid": "41fd531d-93ce-4def-8dce-af91eb9f9f7f", "comment": "Malware payload (RedLineStealer)", "value": "56cf528c7b47eec296feb89c8314db85d81eaca55b96387360e0ec3e7b6caa1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878281, "uuid": "4271d415-1eff-4b32-a1db-6cb9bbea8c19", "comment": "Malware payload (RedLineStealer)", "value": "0b32efca81fa78bd01651e639dde1f94d1c8e92d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878281, "uuid": "cda697c9-90df-4fff-9aab-9bd2775b8b1e", "comment": "Malware payload (RedLineStealer)", "value": "6123ef123e63c3ebb6c4b4c86447077dd1fb02d38c38d08ba83313a636d9675e56b024058ee9ee20e979ff02dcc66499", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878281, "uuid": "a1386bbf-9311-4b82-9d26-a1a30eb8f8b0", "value": "T1E1052311B6499606C1AE9036D0A3ED8F9950E50F274A2FF7036FE22DDCB2347E857E16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878281, "uuid": "311e9b0f-d47f-498f-9fc1-8b111ef5b7ab", "value": "5d8a1d49ecc14555c770b25d78911277", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878281, "uuid": "6d1231ea-5e5b-48ca-bffb-c00d67accec4", "value": "24576:pWT6V41/WvkVI5cHmDyoEZHP1QxevhhAqWO0:p1fvkCGHz1K8ZhAqz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647878281, "uuid": "e52a5685-7220-47a2-b068-a9d066cfbb3a", "value": 864240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647878281, "uuid": "cb7f6bd2-60bc-47cb-9d60-c4f89d85329f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878281, "uuid": "3ba63419-387d-43a6-bd0d-101a01990384", "value": "c0e0b71dc6dac6e0488eda75cc5ed86b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac468264-a8e2-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647845204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845204, "uuid": "6eca4bbf-cf44-4a6d-90ab-8886e0b08789", "comment": "Malware payload (AgentTesla)", "value": "9f8487647eb81bc3a4549a36b5e4bbf9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845204, "uuid": "a713d71d-0492-4368-8bf9-7c1f99cc83ba", "comment": "Malware payload (AgentTesla)", "value": "56f8b3fda6a65566a935015d00f888d856a23466429687ddb97972cd99ee4964", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845204, "uuid": "3a0a94b0-a5d0-4953-aaa6-6f3657c62fa0", "comment": "Malware payload (AgentTesla)", "value": "209db4bc4ef7d320d9ba788119688f985e141d54", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845204, "uuid": "3b5d54bd-297c-4420-87ce-e7ced121f973", "comment": "Malware payload (AgentTesla)", "value": "4fad425fc1632867152f486d5d2ba2bdb341e3752e76c8a8e75f722d696481a01bcefd8e1a0bb5ef15976df8f429945e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845204, "uuid": "a81b9f93-eb11-4377-8d9b-62a0442132f5", "value": "T1DE842388B49FA6EE4683DE1728DF77B585E2C1E0E7A040F4E88B4D3B15786911D7C368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845204, "uuid": "7e1f9820-2fa9-45e9-8490-76d3651f3a0e", "value": "6144:+vJlJ0bUfZ5Ur8WDznBA8EiL1mpKVmwp76ns1cnY7yU6I1Cok4g5eiG5JByoOl:+Jl2bUgocaRp6p76s1HPohHeiG5H2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647845204, "uuid": "c1c33a3a-55da-4f61-8263-8b6e5be721e7", "value": 397674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647845204, "uuid": "7a24bf50-b3af-4999-8d0a-3409d589cb8c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845204, "uuid": "202628c7-66c6-4965-ac74-47bfc7fd5ae5", "value": "INVOICE.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fbec9f7-a8ba-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647827762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647827762, "uuid": "260badc1-f9bc-4800-971a-aa0b42e0ee12", "comment": "Malware payload (Loki)", "value": "58db2143528fd925103525be4fc678bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647827762, "uuid": "0d1355e1-239e-4a83-9cd6-ab4b0579fed8", "comment": "Malware payload (Loki)", "value": "582ec9f33b90224cb6e6b8e89b23b117c36f00aa34fd6b541b5456259799833b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647827762, "uuid": "885ef52d-b044-4c46-90f4-4b4231a13ba3", "comment": "Malware payload (Loki)", "value": "f770180b45e9fe17b3b2057053df0456615bb1d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647827762, "uuid": "70de76ee-415c-41ce-a439-e9b132c65768", "comment": "Malware payload (Loki)", "value": "0693c9cb0d5984daef42e4bf7693bc38b0ccb17e26769ac6d4331ad39cf3105816d6d9dbc8b0ebb941fa1516f57cae28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647827762, "uuid": "cb7bd75b-05b3-4a5d-997e-c780b82a46ef", "value": "T17E949C03760964D5CDBA2B362F93F3B923DC9D8A0930841366EAFE9F35BDD474886521", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647827762, "uuid": "093e08bb-e60b-48fd-b588-272c7f45122c", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647827762, "uuid": "68e7a15f-d295-4f5d-acbb-163658322d18", "value": "6144:eGiuz36EbmDvmsipRbD+ah4dYC2NsVN/Vc8NcrAjUkwsya6PTtEL6dU+KdWhd5:vJR/+U4uN21WAjU/a6PiAd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647827762, "uuid": "164d016d-e9c8-4a83-b28a-543ae6c48208", "value": 426997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647827762, "uuid": "6d435300-af71-4bae-896b-7b4d7c76df98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647827762, "uuid": "42761bff-5768-4e34-83f1-e5169deee1a6", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fab2524b-a904-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647859939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647859939, "uuid": "1615d413-527d-4f14-8f02-d4f5daef6400", "comment": "Malware payload (Heodo)", "value": "7dea5dba7ba302f663d4e608b3e71e80", "object_relation": "md5", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647859939, "uuid": "9b56a8c1-7f06-4ca9-b7b4-10c69450c817", "comment": "Malware payload (Heodo)", "value": "582f3388db031dc710daae2ff744dc7c58a220130d15de1a88a3d01c46927b5e", "object_relation": "sha256", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647859939, "uuid": "a203b1f7-7c57-40a2-8ca6-b04a57c96a7c", "comment": "Malware payload (Heodo)", "value": "474ebbd39aef4dd3c9f4c9ab1892a0b531da96f3", "object_relation": "sha1", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647859939, "uuid": "81d66cdd-d70c-4f50-840e-63a5a95e2723", "comment": "Malware payload (Heodo)", "value": "a47a4d0995b53b9d3a66e44ff6d4df73c182a472d3bd8db77c4a3974e8efef411b8ca6d03e2868a0764b955607f516f7", "object_relation": "sha3-384", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647859939, "uuid": "24bcdc6f-454b-45d6-94af-d8097ed46ae8", "value": "T144A4231CBF72A68073BBBB540E608BF28D7B4E00E9474D14B963741A1E1EDC75E6B858", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647859939, "uuid": "41fca878-9e63-495d-9c86-74a96db38f06", "value": "6144:48pS9/raQ4ofDde+ExD+cTFu6vk8izl6YMTWFs79G1+Oi9uTyGqcXUN7aXDHrbnX:4tjaQA+kFrk8ipAWFetOiYnqIUMbAs0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647859939, "uuid": "d0d49f07-d8cc-46ff-9ce3-39f5bc8b3985", "value": 450862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647859939, "uuid": "1135d2a0-bc19-4c34-8af5-63c1b4cf92ae", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647859939, "uuid": "d0d1ca59-1488-4555-931d-e7c6259d8738", "value": "220321-mv9xvsbgbm_pw_infected.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5d37b9e-a947-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647888653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888653, "uuid": "0c462042-cf95-4d62-9140-bbcbd2fd7bd9", "comment": "Malware payload (Heodo)", "value": "8b00555812af375636e4fee35729065b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888653, "uuid": "b0243856-8006-4671-b721-618d85fb0cff", "comment": "Malware payload (Heodo)", "value": "586c91fe4a42ce2c9579df2917dc48c2b6f9a03c07ff5bde4be4829986d83ab8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888653, "uuid": "4b85c056-3ebd-4c4b-aec9-b3ecae38909c", "comment": "Malware payload (Heodo)", "value": "808001ca94bb91437e99b0f6743637209d1ea97b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888653, "uuid": "415b15a2-acd2-42e6-ac31-4a8624a5a0cd", "comment": "Malware payload (Heodo)", "value": "b2503095ff735be0dc6afd267c93b29f719750632d316b18213e7f4b9f62046ac5545582000660d6c35eef1b7fea007f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888653, "uuid": "5dafa143-0555-4502-8e88-98caebadb770", "value": "T198B43A11BC916832C36FAC7456073262588EE7F0DBD1F26FA3E0495C9A7C5E36624BC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888653, "uuid": "40866a1a-0800-4006-b516-a197340f906f", "value": "14e6ae8d1400b6271725b3f01025b85e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888653, "uuid": "e54eaf6c-7f16-4050-8f11-b3a427374610", "value": "6144:VikzyaB9eoCyx/mEhHB5RYSJ/xI+qiCjzQNPj79GkqbscgCG5qH6scI:VNnCGmyHB5SSJpr0zQN39GkUGQSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647888653, "uuid": "8b072f62-fa17-4e37-b1ce-5da47ac16051", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647888653, "uuid": "d10ff906-291d-4933-be58-0c798f4080b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888653, "uuid": "b7c36c79-12c0-46f5-9710-3ed6331f5754", "value": "emotet_exe_e5_586c91fe4a42ce2c9579df2917dc48c2b6f9a03c07ff5bde4be4829986d83ab8_2022-03-21__185045.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c722d8c3-a8ac-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1647822057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647822057, "uuid": "ca183ac5-ba84-426d-b8f2-e346632f087a", "comment": "Malware payload (DCRat)", "value": "71b8ccb880b94fd599b9fca6ce1cbdd5", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647822057, "uuid": "adba2161-76e6-4300-8c27-be7541ddf3b8", "comment": "Malware payload (DCRat)", "value": "58a7160bc9c6b737602ae6560a308cc5a824807f6ba4fb61efc5d5bb0c41ff91", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647822057, "uuid": "23174935-a614-40a4-a407-a69b9f108a5e", "comment": "Malware payload (DCRat)", "value": "422f13281c448338a885685a99a2fb71501d56e3", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647822057, "uuid": "58dc905f-3b2b-43e1-a5b7-6537643f4a14", "comment": "Malware payload (DCRat)", "value": "c0b7b5711d4288cfc8c9391d56ec3a3f7aa57e10e519bd53dd1646f441bd53c5a70b7767cc254e697c1a7ed264ba5c7e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647822057, "uuid": "53f3adbf-73da-4d69-95c8-e586c79bfb42", "value": "T10C3517127A46DD02E0293A3BC9DF452457A8BD417B6ADB1B7E9F336D70123A70D0E1CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647822057, "uuid": "d1139e87-1293-45fe-ae26-eb0d89fc95f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647822057, "uuid": "9574c26c-4f6a-4639-a78a-a5a7b2606647", "value": "24576:Qrnc3Ibr0gbmgoHCfwHl7gjUHgklkN+4:v2r0gbDq4CWU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647822057, "uuid": "e012c8b1-b3d1-4bfa-b6ae-27cbbd0d8bb9", "value": 1120256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647822057, "uuid": "c89ac2a2-21a7-421d-b068-9630b697b53b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647822057, "uuid": "46e783e5-c0d0-4047-a0c8-8de5df31ab13", "value": "58A7160BC9C6B737602AE6560A308CC5A824807F6BA4F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2825a62-a8f3-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1647852570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852570, "uuid": "b97504cf-d079-49b3-adb5-3607fff23e6e", "comment": "Malware payload (NanoCore)", "value": "c9511cc1763b5ca3fe086089b706f34a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852570, "uuid": "fa1b542d-d9a5-4ebb-9f9f-c5135fc6de15", "comment": "Malware payload (NanoCore)", "value": "591b31c78e65c2887c48bf3b00ffc6584e3c2f624c152b45b8fcdb76d833720d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852570, "uuid": "001258ab-a85c-49f2-979a-3093cbe93a98", "comment": "Malware payload (NanoCore)", "value": "9439d5717601276e0bb060f96437a319ec5cad72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852570, "uuid": "8d066fe8-79d5-49b2-bb35-9c1f0b5eb595", "comment": "Malware payload (NanoCore)", "value": "8e776e64fab7905c616cd32f7beaf902605ea9b787bba53de7ad23661a31a7bfceba1201ec434726f1111abe5a3671fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852570, "uuid": "fbc9e794-2e0d-432d-8ea2-e97fadee95f2", "value": "T150457D0A36F9806BF1B74B646976BC684934BB217914E13EE94810DF686194CFBEC373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852570, "uuid": "b6e5cbb7-6c7b-4db1-916d-5eb345dc048e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852570, "uuid": "067753f8-5047-42a5-a3cd-b826a3768642", "value": "24576:fzGLYWVHyf7IPBIlZRDoQM+0u9NJlR0Umc1n5xzxcb2:faqsm9cQxlLXR0UmQn5962", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647852570, "uuid": "8660b1e5-d42e-4bec-a469-738a1e034ce9", "value": 1205328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647852570, "uuid": "30a8430a-d3f9-4ccb-b271-51957dd15813", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852570, "uuid": "9fbb1409-8030-4939-a7e1-994fc9e4d402", "value": "RTB~0398746454670484764678-40984766478.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e966ca9f-a947-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647888686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888686, "uuid": "c452fd30-6011-46a3-8540-7273debd27d0", "comment": "Malware payload (Mirai)", "value": "0d6ec05db10f19ae04e6a9d78feacbe7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888686, "uuid": "8b9478e8-f7d1-46b9-b2c3-e9995b51d210", "comment": "Malware payload (Mirai)", "value": "591cf7deefbe54bdeedcddb1825fab90dcced062f419db0663f167b2c61b7b64", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888686, "uuid": "13351291-6d59-413a-b001-5a1b9dbe4313", "comment": "Malware payload (Mirai)", "value": "b1150a9a3aa559984a0f02cd1dbd323942b2c750", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888686, "uuid": "8bab6724-9ee3-4d6e-921b-6c08641e6f80", "comment": "Malware payload (Mirai)", "value": "ccd1d6a092a307863c8fafa4765f5ade88e6a614e439d9ab510d418f0087f06059462e1e5c99d1e8eda7f114195e0964", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888686, "uuid": "007fbfa7-43b4-4fe2-9a4c-aee8ed78d07c", "value": "T1DEA3F81EB73B2E4AC0D02136C1A1C7767BA7BACA20AC46FDFDE12E45AE15D5017419F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888686, "uuid": "6534801e-63a7-4074-ac75-57154878f7ee", "value": "1536:3yzX/XFiLdniKYpKhYiujKUHZum0j+hjHENnp9Q+TXwwfIEFD:2XSdHY1TuFcmzQSdfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647888686, "uuid": "6ca1beb8-9a48-4247-8949-e49675efe533", "value": 104904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647888686, "uuid": "e994a8ce-e9c3-44ea-b954-b9dfbf9dbcf3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888686, "uuid": "09e2ee58-9c38-422e-8f40-9bb98eddc477", "value": "0d6ec05db10f19ae04e6a9d78feacbe7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebd6d018-a945-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1647887831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647887831, "uuid": "b4dcf8a9-0692-48d1-b1bf-e2cd135482b9", "comment": "Malware payload (RemcosRAT)", "value": "427f1494e1a52d28b862510add64ed15", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647887831, "uuid": "1c8bb821-c868-4f12-aa31-5f0c2396f19e", "comment": "Malware payload (RemcosRAT)", "value": "592768f9893fba006aab4daa3f112449e6d6d697c995cd9c28ec4818c7f12146", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647887831, "uuid": "779c571e-0c8a-45ca-b77f-3a7a5cd3020c", "comment": "Malware payload (RemcosRAT)", "value": "bb286ac314ae0dbe8f5bf8c4e080cce746f447fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647887831, "uuid": "3287bbb1-c714-4685-ae3c-b0eafdd40960", "comment": "Malware payload (RemcosRAT)", "value": "c3a561a2cb8d87a1813d52e5011f87a179b28add46c5974a4eb9ea0ada59f01147c3e41d8fcdff99c2e731557ee8c483", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647887831, "uuid": "a906d1d0-3f6b-4f22-8bad-326b8e0f1d64", "value": "T199A4BF11BAD2C072D97251340D29EB35DEBCBD202935857BB3E61D5BFE30180A72A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647887831, "uuid": "6657a124-30da-4591-b94d-efddbea99a46", "value": "029a987f21e33b48f24d21b6f9ff1129", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647887831, "uuid": "e2afe525-e6d3-4f12-9ec4-ecd822b44ecf", "value": "6144:hOFBH/FMNjt18F+9a/NgAeDB4CcOtKp03b13a4LJ+sAOZZPWXbTcU5yg:hOFtiNBuFgawDB4NOmuwsfZPqyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647887831, "uuid": "1d91c5c4-94f1-4d62-8f6b-c708ae5f9ed7", "value": 474112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647887831, "uuid": "886f0de3-6cc5-4f9c-aa58-5a820eb15843", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647887831, "uuid": "44d8278f-002b-4779-b684-0270cfbcb67b", "value": "427f1494e1a52d28b862510add64ed15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c14ec877-a967-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647902363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647902363, "uuid": "0c885989-ccf5-470a-b031-e4146cde443d", "comment": "Malware payload (Loki)", "value": "eaa40413006a41c46f4918fd4eef4473", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647902363, "uuid": "3e02a925-db52-4f12-b87d-702c4d477450", "comment": "Malware payload (Loki)", "value": "592d7eb5c11442dfd6c5c9cbff5d977c16c8671b22a339c23e76102109083a04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647902363, "uuid": "7157e735-9d95-4334-ac9d-468653afd04c", "comment": "Malware payload (Loki)", "value": "bc2b3dd1d7869b9b43307fcb3047bb3ab31033c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647902363, "uuid": "fb413621-e03a-44c0-ba17-1cd53e6254db", "comment": "Malware payload (Loki)", "value": "3c2f3f53d51161e6f905a9b26112a0384eec5da1d190ac036256e2f00e6bf560605794408981eaa54b1c3babcb6834f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647902363, "uuid": "ceba4e16-70dc-4b44-8559-8a08a17c4f36", "value": "T10135D0A021BF5EB2C13BA7F1F451B7BA0FA17F09D701C2B949B368C6A1E5729747014A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647902363, "uuid": "80382bfd-721b-4089-bb51-c2fd7906eef9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647902363, "uuid": "ef9422bd-06cb-465e-aca2-303c7ed1022b", "value": "24576:eK99p25VmMJdOB2kiHfrIxykxjZLKIH0tcwnMloU4skdep:BG5QMJdEHiHfrIxyYZLKIH0VM2UGd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647902363, "uuid": "142904db-b279-400e-8f14-1ff180117406", "value": 1103360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647902363, "uuid": "52dabd55-6386-4cb4-988e-3f5ce2fb6fd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647902363, "uuid": "c71d7d20-17b5-44e7-b79c-285c593b15f8", "value": "eaa40413006a41c46f4918fd4eef4473.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b833f149-a942-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647886456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886456, "uuid": "bd5ec388-7855-4ad8-bb17-a875b4e1ca2a", "comment": "Malware payload (RedLineStealer)", "value": "fc4ba816e9a41ea4f07f374b604da9db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886456, "uuid": "dc31faf2-be10-4387-8119-0be61a06994d", "comment": "Malware payload (RedLineStealer)", "value": "593def1f84e9e332d4fca2ee90693f644b281b0fc7a5a5d40fcb59a30338d2c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886456, "uuid": "3d818b28-a583-4831-9a7c-6b942a9b61bb", "comment": "Malware payload (RedLineStealer)", "value": "6352e0d5735090dd52700fbd2539a5cb05fb21b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886456, "uuid": "e9f665c4-2ed3-4d0b-b386-ea581baa0e18", "comment": "Malware payload (RedLineStealer)", "value": "ee62259048e7bbd34b889e4f0c717139f2e1000ddae2ec4898b929df3dbe7fd442294c20069b338980b15e8b6717741d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886456, "uuid": "b8ee215a-b6bf-4932-9101-e8ba876057f7", "value": "T1FEC433AB1BDED965C0A307BCFC16BC87962061C47CE4EA9477769D432E2D823C9198F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886456, "uuid": "b95577fd-562b-4a99-a64f-e1cf4301aaa1", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886456, "uuid": "d7d3bfdb-262c-435b-8ee6-ad1368949cb6", "value": "12288:fHye+A3f2569vC2ZHQS03ULaHNqrxlKIQNo3kuZYefS:fSZA26nkEaHNYK3UkEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647886456, "uuid": "1d8ba53b-5824-4e61-8d5c-17bab646376d", "value": 562688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647886456, "uuid": "cd4545d0-3d93-4971-a5cb-a3f7fd1ec558", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886456, "uuid": "b8d183fd-9b27-47df-92ce-ca7f7b868ead", "value": "SecuriteInfo.com.Trojan.Siggen17.23642.11642.25580", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18cb83e2-a926-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647874163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647874163, "uuid": "4a517e5a-9477-4ccf-87fa-f3aad9781b60", "comment": "Malware payload", "value": "78d7227eb2b364c55d034fc61a6298ed", "object_relation": "md5", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647874163, "uuid": "40268c09-1428-4bc0-9589-3b3facb7d62d", "comment": "Malware payload", "value": "59657b9b3ebad7ffb7d0df2c5c11f177c4a0a69bcc3e26fff194f00b47850683", "object_relation": "sha256", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647874163, "uuid": "94529c1e-e143-43a0-aaf2-a3db1069b25d", "comment": "Malware payload", "value": "321004bce04d9108db94ee41088b5d50969f2284", "object_relation": "sha1", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647874163, "uuid": "d5051abc-57b3-42dd-b73a-df4b3a18cc35", "comment": "Malware payload", "value": "f952c07802f39f03b694793da99c6095b7070664314a4409ffdab4eb6ef87ca312f4bf44bf6dad77926cceca195ad80d", "object_relation": "sha3-384", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647874163, "uuid": "cc491c7e-9d33-412e-967b-73514356c8ca", "value": "T1C6D2F1620D46CE1BCF8231B20677417CB3BB95F6709F489595C50B391A3CAAEF08A5F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647874163, "uuid": "d557da12-c45d-4043-9b14-ec9eb50993c6", "value": "768:hT9sij1Tjyw75Ord51A5dKVZqbiTICEsx7nCeLIBmojiJau:hTmcyw70Gd2cbfsCeLcAau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647874163, "uuid": "aae0b8f3-992a-4bc4-9fdd-22a708e5c6c8", "value": 29080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647874163, "uuid": "c8ad4b56-cb73-4038-bc62-27b7076d4f96", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647874163, "uuid": "e6ef9032-83a4-4184-95ac-e491a8066783", "value": "CTP_4820.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "056586c6-a92f-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647877996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877996, "uuid": "810c3761-128f-4c97-8774-f4dc79c177c4", "comment": "Malware payload (RedLineStealer)", "value": "cb37b2c03cca2f4ae68d7e2b7f8e8493", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877996, "uuid": "a29d437e-4796-4c7c-b8f2-d8da8bbddb18", "comment": "Malware payload (RedLineStealer)", "value": "59786cf4ed9f5abd0a5b8fa810764e66f6f958f95452a9908f582a37fe1a4ff3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877996, "uuid": "f1f79492-8dd2-46eb-b093-16a885afcad0", "comment": "Malware payload (RedLineStealer)", "value": "ca21f84498ddf02eef6ebbbb6f9c7f1f64d97cc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877996, "uuid": "a51a4f78-53e1-4ff9-b499-33e327e310ed", "comment": "Malware payload (RedLineStealer)", "value": "24e47fe4f663117be07c3064d50dcfbd92d01c3400ad7759cdc070ecb4f5f6e805b67e1eb9ce71e3a07200357f287c07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877996, "uuid": "759bc7fb-ab14-4779-966e-1632c98a2fc2", "value": "T190045D95B3DD4638E6FE4B7468B1514143F0EDA26C12E7AE1DC4F0D91E36B80DA22BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877996, "uuid": "e269a121-305a-40e6-826e-695469fd204a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877996, "uuid": "a6822198-ba39-4d9f-abe4-7036e345988d", "value": "1536:k0DokCrEG2IkACcZz0zttMXKGRW+1g263gMSJoL6ibuTx16sHZMLJpF9N:kUCrEGQpzsaOW+Ro5IPHutpF9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647877996, "uuid": "6a9b989c-1f58-42bb-ada8-bf28a9fa7744", "value": 182272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647877996, "uuid": "446b7d6c-e70d-4332-be7d-32f6194c07ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877996, "uuid": "8492e6bc-fd9c-4b42-82bb-5a9e0e142276", "value": "cb37b2c03cca2f4ae68d7e2b7f8e8493.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a6d8d32-a8e0-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647844262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844262, "uuid": "cc232c55-78aa-4233-a4f3-a22970d83f6e", "comment": "Malware payload (RedLineStealer)", "value": "3cb1a68f26e9843de8acdca933a9499f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844262, "uuid": "6e25d2fd-d24a-4d72-a5fe-ea0ebaaf99b8", "comment": "Malware payload (RedLineStealer)", "value": "5995b21678f6271558627722bd249db1b37e10c7269421940e80131ea141cb81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844262, "uuid": "d85f44b2-a420-446e-816f-5caa620088b4", "comment": "Malware payload (RedLineStealer)", "value": "2fb3eea4a64a2a8afc80b47aa1a1bffa16f1eece", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844262, "uuid": "3e03484e-26d6-4e06-9238-dfa14de99e22", "comment": "Malware payload (RedLineStealer)", "value": "5fd1b6cd382dd0b2e45da3b4c99a1621a27a0d2592447d4674d05d7ef9ee28006bb56ef2463f48a396a59cda603414b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844262, "uuid": "6f29ec76-d8a6-4684-9457-4e8daef98345", "value": "T1022623FB126921C1D5E5EC35C933FD6671BA13BE8A419CB994FAADC622074D5B303A03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844262, "uuid": "0bd8618f-106a-464a-a5a6-2789b138cec6", "value": "b2ec5e305a410e6442f3911ef61575a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844262, "uuid": "eecce6d2-9bf7-4bc8-a4ea-7e5e73e28902", "value": "98304:jX+0jm5QZ2ydZgQNaaqc6OCqCGd4bP6g6klhO9/Gu+7:jX+8uQWQNZKOxCNbPekrO9+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647844262, "uuid": "61390de1-839d-4f49-a478-af2c93e12edd", "value": 4707992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647844262, "uuid": "d7615379-8bd2-4a20-b128-27af086d1cba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844262, "uuid": "43f5df61-168f-454c-8b22-f0ada39c4372", "value": "36284295.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53dd42f9-a8f0-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647851069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851069, "uuid": "852f2215-a4fd-492b-8e6e-753c62518d76", "comment": "Malware payload (Formbook)", "value": "6d63226194d1c2cfc421153e39531312", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851069, "uuid": "f74b1a5c-5e71-48c6-950c-04abe493cb37", "comment": "Malware payload (Formbook)", "value": "59970e7fd41243761c720878d433fef6443d187bcb97afe5e41bfe3d6f4f9649", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851069, "uuid": "c023f44b-f826-46a2-900f-3fede4bb7c06", "comment": "Malware payload (Formbook)", "value": "7440b097e5f04a59833c68614532447269216765", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851069, "uuid": "7985d848-6b6d-451f-a64b-2a44a8514195", "comment": "Malware payload (Formbook)", "value": "4878382e9d05e47792e5b343612d8dc34235c900f5e4502859ea589c4bcf3751eb36688a29a2c9ddaf9a5530bf3a6595", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851069, "uuid": "9cc81d17-faab-4bcc-98b0-e4f6b3929d62", "value": "T15814127A3F28E14CC192F1BE1447627585F9FD21D0FB931374EBB265003212AACA65AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851069, "uuid": "bd96e140-1ea3-485c-a24e-20d967d47667", "value": "3072:lrOsQ8zecItOGNUfkowyUEMmeCHsUR+O5JEP3ggs+tWwOkiGFqJ2x+uQh4:xOsScID2ki+cH8O52P3ggs+0wji0q83R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851069, "uuid": "29ea4d16-96c4-4ff8-b30b-84ef6cbfeefd", "value": 190408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851069, "uuid": "6aa2d419-9d3e-42bf-9a1e-77027226fecd", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851069, "uuid": "770d1f84-a767-4c0f-9fa1-4cc32b08149c", "value": "New order RFQ - PO-038194.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "163ca5fb-a93f-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647884896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647884896, "uuid": "4b854d5f-410c-4fe0-ac85-c73dfe0bfa81", "comment": "Malware payload (Loki)", "value": "fea051869b74131b13bbf412be2a3aa0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647884896, "uuid": "59ea3580-3be7-489d-bd08-01a923bca77f", "comment": "Malware payload (Loki)", "value": "5a19e83b7097f0a561b992fe66ad846537bf5b2a70c18530ab378d99a5ded5f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647884896, "uuid": "51792b56-8c3f-46cd-8598-02b80b193d7a", "comment": "Malware payload (Loki)", "value": "e9d2f68016ff47b46b3727de31a92748836e44cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647884896, "uuid": "5e9a82a7-868a-4ab4-903a-44b29e1bec3e", "comment": "Malware payload (Loki)", "value": "72e4d19e6be635981c781b8eaf65c11f9bfa40e1b23ced951ebfa12c1a36d0287285705bcefe78d84b2f62b48df8e73f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647884896, "uuid": "07b1a1b4-400e-4d2c-97b3-1c9c24695ac5", "value": "T1E664F5C5E94465A0DD19AB70AA36CD354623BDFDA874A42D28DE3E273FFB2D31026053", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647884896, "uuid": "3ac8e44a-9cf1-4ec1-9147-33a8696ff00d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647884896, "uuid": "8d421d75-9885-431a-acb2-d8865d0ec3b8", "value": "6144:kMblMtKk4dcpq6h0Zik2AkzL7r9r/EDppppppppppppppppppppppppppppp0G:NlMok4dcpq6hzkSP7r9r/+pppppppppT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647884896, "uuid": "768fba48-fe0c-4fee-9c07-b97efb8ded93", "value": 324096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647884896, "uuid": "69c387ed-d91f-4512-b6e1-6084881d6eab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647884896, "uuid": "f7f56d47-547d-454f-ac10-2cf1e33d10a9", "value": "Comprobante de PagoPDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6d2c81b-a8df-11ec-9275-42010a9c0029", "comment": "Malware payload (Hive)", "timestamp": 1647843907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647843907, "uuid": "1e312c29-675c-4991-a1f2-129f65a290bb", "comment": "Malware payload (Hive)", "value": "de56cde528237db0bafb21e16e5d2660", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647843907, "uuid": "358cefcc-0578-466a-92d9-d059491e6b03", "comment": "Malware payload (Hive)", "value": "5a2a01a909f8ad20484259c2e305c24791ea8fff7adc3f63f927440e2d14928c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647843907, "uuid": "0b788852-783a-47f7-bdf7-5527b89384fe", "comment": "Malware payload (Hive)", "value": "6b62db2fafd0b4d00c4be9b69da99db2bae37556", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647843907, "uuid": "62b3d720-dd07-4335-9765-a34ac9265599", "comment": "Malware payload (Hive)", "value": "14562ad10379c586d011706d76dc744da8790675ecf25555f6ed2f9249c4c73f0fe21da022f4cfe6ae7445706153768d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647843907, "uuid": "58c7907a-4659-4b68-88f9-40f91c6337e9", "value": "T1C9A5339285224E99F54A11FA03A7B0924FA1641137ED5E7E2BBB5CE4013F4AF3F86163", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647843907, "uuid": "660ef147-3d7d-4fdb-bc37-a2bebcb609d9", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647843907, "uuid": "5dfa4a04-807d-46fb-970e-465247f0451e", "value": "49152:2SCBb2ZtUOPOxJ2T6JP1oH5wzwMCaTXX1sF9VeG0d3mY:2rBb2ZD/K1oZmwMb5g4Vm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647843907, "uuid": "3dfcb2cb-e8ec-404e-af92-0edf6c8f05d5", "value": 2217984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647843907, "uuid": "f396d330-6fdb-4957-ad14-fc231c320683", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647843907, "uuid": "d575c3c9-d239-4232-970d-716f0407742c", "value": "33132493.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a813528-a8b3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647824988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647824988, "uuid": "4e361e2a-e456-4d6b-8444-6745291f7187", "comment": "Malware payload (Heodo)", "value": "53f85ff2c2c9bd5da7392cfac0e23508", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647824988, "uuid": "1af4fd5e-57d0-495a-b268-7d2b95923af0", "comment": "Malware payload (Heodo)", "value": "5a37a27291b38254dcd4b5f8357e0197144c44af80a16211e960ebb1bb70a923", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647824988, "uuid": "3ed96ac4-a1bb-4d83-b6fc-b00496c80dd3", "comment": "Malware payload (Heodo)", "value": "a347bbaf13dea63d99f0b00b4928bfe38a877ebb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647824988, "uuid": "0301241d-c21f-497f-ac4a-fe5e0288d020", "comment": "Malware payload (Heodo)", "value": "f9b64a23678eba4ecb5ac81a1a24448014105eee68e6fc7166df4455434ce95538f310f7c8c1197077a8b6a17447fcd4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647824988, "uuid": "58e12585-2f86-475b-9e8f-8179067c326a", "value": "T1B8B43A317492B279C2EBD73408A35275B21AEDF157E274E36EE707CC4B366906E72602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647824988, "uuid": "5c93463c-a5ad-463f-b6b0-d67766a261e6", "value": "55cf9ae1e74cef637eafd17181390202", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647824988, "uuid": "08dc8605-41df-40ec-ab2b-a6fd466b490d", "value": "12288:7FFCpYDLbBHqKK85H3j92VlMD4zeSvturG9+:7VDLbQKyVlMDOtv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647824988, "uuid": "e8148c26-b93a-44aa-a8ad-54992e19d4b8", "value": 516096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647824988, "uuid": "4576ca19-b60b-46ef-86c3-251c960880d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647824988, "uuid": "6a19ab0c-c88c-481b-92c3-ca14bc163c2e", "value": "53f85ff2c2c9bd5da7392cfac0e23508", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff93f90f-a8df-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647844056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844056, "uuid": "263772d8-3617-43f4-bb04-8b062821b9b7", "comment": "Malware payload (RedLineStealer)", "value": "b114c21e7c2c66b54e467cd3d443ad8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844056, "uuid": "00e4a325-4381-4c52-938f-bde5b3da92ea", "comment": "Malware payload (RedLineStealer)", "value": "5a78bc9ba3b6a584ceaaf2648c89319466f69ebdb73699bedfd10e3d92c80e6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844056, "uuid": "5e03de60-74ab-4587-88a3-fc70b98c5ebc", "comment": "Malware payload (RedLineStealer)", "value": "ce77e38e357d376b90111765ed8a06d4f954c84c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844056, "uuid": "0f7c3710-5376-4bcf-88e4-b3fac26d6bb8", "comment": "Malware payload (RedLineStealer)", "value": "3de0ea38139f425e4f17c3d1a5a50889310de973b7a0972de129ad2c83ed5121e27f6fe2c3d70fd7a49e73b985d7ae64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844056, "uuid": "6860bde6-44b2-4662-bc57-20129908a516", "value": "T158263302D3A4600CDAFE2D7BB7B1C6DC71ACBD4DE283F626B582484F1A4605577687B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844056, "uuid": "9f6b7c82-fc2a-487b-89e1-bd61eb1d901e", "value": "7dc28ef949f54ad98c715895ecc34cff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844056, "uuid": "4b8556c1-c58e-43ff-b473-cf4aca7b2030", "value": "98304:2kxEOA9H/OrWi6AGXRwCtwVFd16TQ7ORMDzyqxD2H+d:L64ZRqQCR8zla+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647844056, "uuid": "ca490153-06ac-4bec-9251-eb2266a1975e", "value": 4545024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647844056, "uuid": "74e17251-97a3-4e4a-b383-b9cdec1ef8a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844056, "uuid": "b147f503-545f-4e57-ade6-5b2760af9db2", "value": "34387341.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "937c100b-a8f0-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647851176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851176, "uuid": "7fd45bd9-edce-41a8-b9ff-4b373fb02873", "comment": "Malware payload (Formbook)", "value": "f2936d9759edbdf5bc8659effe77e682", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851176, "uuid": "7472f4ad-5f03-4a16-862b-badbafb2f80b", "comment": "Malware payload (Formbook)", "value": "5abe9871725ea27cd02f3f32a450e100120be1d0c1a578a7dbfa69770dfb546f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851176, "uuid": "d41caf69-6dea-4918-8dbc-6eb3b09c9b7d", "comment": "Malware payload (Formbook)", "value": "54dda6434d7a6fcbe54b0334dc6d648da50509b1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851176, "uuid": "68bd8c32-ec6b-4100-9308-9e86da2c65c2", "comment": "Malware payload (Formbook)", "value": "1b4aba23964622b163b1ab2267219e7fde7121a6cee4d229c46e642872d55f44f3adb66ccb450b0daf9b6f2c65b7cf55", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851176, "uuid": "4d7fbcb9-f067-47f3-ac07-0261428ad931", "value": "T1BC1402BA75330E97F2B611F3F4198A191E39FD559BD3E3065138376EA03586E0A0AF14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851176, "uuid": "704054bd-e178-4ba4-aafb-9af1d10f8ba5", "value": "3072:q8W93BobNqf9PgS2hK5ZvPcAaTMGwSc6uwAhAymCMKhS/Vp:DeGbNq6le9faBwScHqi8Vp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851176, "uuid": "905dd6ac-1fec-4b26-9c96-4f59c58fd250", "value": 190600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851176, "uuid": "c10e97e8-e0d9-4840-ac56-12e5c7d19c47", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851176, "uuid": "cf1d08b1-6885-459a-a9ea-8ca0132ba1b9", "value": "21.03.2020.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42edbb0b-a8f7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647854047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854047, "uuid": "113ff880-2b1e-48c2-9a15-f88339e79d89", "comment": "Malware payload (Heodo)", "value": "fde1f0c21064429fbfdd0b6e28a64177", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854047, "uuid": "c7e87afb-bcc1-4982-a17a-158ed2c02e23", "comment": "Malware payload (Heodo)", "value": "5aede4b32a4ba9a827838549e37a704389a31234dd02f5ce955b805464f17258", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854047, "uuid": "9561a406-5995-4a55-bd81-3f3760da8ffa", "comment": "Malware payload (Heodo)", "value": "782ceb29299b40f439f2267e1199a2c50c2faac2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854047, "uuid": "603e152a-6f7a-498d-be14-e6e325b09af4", "comment": "Malware payload (Heodo)", "value": "c25681402896d824b8d82903bf418505fb2dfbc3fa509611b3daaf44e92aea4b7dbea1c376c7d57de6460328cec7561d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854047, "uuid": "799e6367-736c-4158-bc9a-fe14878ed55c", "value": "T1FC056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854047, "uuid": "3f8e57ee-f78e-4ceb-8f74-924217666103", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854047, "uuid": "1d3dbccf-3f1a-431d-b17f-0f080c3c0915", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rd5CGNHrH2tZ+d+:gMV/rd5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647854047, "uuid": "5a59d6cf-8a07-4687-b9a3-cff725062901", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647854047, "uuid": "d48f6199-167c-42db-bcaf-1204f73afddd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854047, "uuid": "518d3aec-79c1-4ea9-86d9-b30abb4cc3b9", "value": "fde1f0c21064429fbfdd0b6e28a64177", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40d29110-a8f0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647851037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851037, "uuid": "3e842865-de83-47c5-b7da-db142b9fb618", "comment": "Malware payload (Heodo)", "value": "aa88e74ee73788990177c75d2132b122", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851037, "uuid": "a30ef1c0-c7e7-4feb-a044-b9f1b5bea933", "comment": "Malware payload (Heodo)", "value": "5b6d5147c62046933e93526268cfea39de514977eee399075252921e561474b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851037, "uuid": "0d6c5a44-e178-44ed-ad82-8486c3cc982c", "comment": "Malware payload (Heodo)", "value": "1918c4b36493b834b64c2ccd91fad150770a743b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851037, "uuid": "0c46a311-d721-4a3d-8c02-73ca6ff4e292", "comment": "Malware payload (Heodo)", "value": "32bfa88bd2f1911f05f089ee7ad701861797902566704dd3d87dd89e455ab3306eef44f3b292e6020b4eb19d30b47cb1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851037, "uuid": "b6171608-c76b-4380-87ac-5ddd0e3350f6", "value": "T191056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851037, "uuid": "fb409d3a-278f-4582-bf5c-276e673bef40", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851037, "uuid": "6ac6fa14-f372-4e04-bd51-7db4406bf233", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/r55CGNHrH2tZ+d+:gMV/r55tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851037, "uuid": "0de058a8-ac19-4c8b-8c2e-c04793ba2ead", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851037, "uuid": "82780efe-e6df-45fc-8a97-d306ffbb1d6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851037, "uuid": "b70cdfc1-2f5b-4d17-abcc-08bf87d006d9", "value": "aa88e74ee73788990177c75d2132b122", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "312f9e55-a8f0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647851011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851011, "uuid": "bcf1b95d-2723-4e00-ae39-6b5132c10ffc", "comment": "Malware payload (Heodo)", "value": "f89b492e53d41e7b0de8dcd6921af791", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851011, "uuid": "1635fd81-9c90-4ede-a644-b8bbeda62ab1", "comment": "Malware payload (Heodo)", "value": "5c508b393e2ee7856f7cffae444b830b74b8706d4f17e98c4bf99a7f1fc6338f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851011, "uuid": "672e4d6a-f1f8-44d3-8971-3bc103cf99e7", "comment": "Malware payload (Heodo)", "value": "acf45e50f18531716eb772f7942a17dbaa442b29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851011, "uuid": "51752079-98e9-47ad-bf4a-9721209c2a47", "comment": "Malware payload (Heodo)", "value": "9ae383daffb6eb9893518c668af392c629ae92ede3e8ece76b9235271f05b785651208732676850b01d6d66c25dc2a6d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851011, "uuid": "7343e437-ad3e-4332-8a22-e38557a666ff", "value": "T110056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851011, "uuid": "ed3a0a94-53ae-4932-8fec-c7b449c7cfcd", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851011, "uuid": "682f049f-acf2-4b3d-aee7-9f1c70f4c263", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/r85CGNHrH2tZ+d+:gMV/r85tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851011, "uuid": "7ce3cf09-5dac-4f09-857b-2f6f85aa2a05", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851011, "uuid": "db841d66-a89c-47e5-a022-d44219955ce0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851011, "uuid": "0fc8c512-28b1-4050-ab8b-9abe7409c4bd", "value": "f89b492e53d41e7b0de8dcd6921af791", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e71c025-a916-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647867300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647867300, "uuid": "40831414-2a95-453d-81ac-1b5db97bff51", "comment": "Malware payload (AgentTesla)", "value": "2db9ff8926ec24f137b7a7dfcbd7b31a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647867300, "uuid": "b22263ba-ab8c-4955-ada6-8bdc7b50e623", "comment": "Malware payload (AgentTesla)", "value": "5c67bbaa6c3a8f4caa22c37adaa2d10d677957f94afc86bf4d6a6604a77c61ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647867300, "uuid": "847c5209-2d75-4ef2-9311-22e522e8f5dd", "comment": "Malware payload (AgentTesla)", "value": "eb7c05e91a753a69109e7d760a2b3d74493878a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647867300, "uuid": "5598e969-1e7f-414e-8e1a-b8df33001f96", "comment": "Malware payload (AgentTesla)", "value": "2986d97a97539d0fc195f75984a3f39d97b953550746d7f8ae4b108e954cee73aa3a0435e7c3a4446551247bda50b4ae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647867300, "uuid": "784531b9-7665-46f2-bb14-35a28157d6e6", "value": "T160F408BD715472AFC877C1328A945C64FA50A4FB630B4917E4931B9A9D0F8C7EF840BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647867300, "uuid": "f22b732d-adea-4a01-9488-a5abf3d2baa2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647867300, "uuid": "7787f4fa-80b9-4222-a3d2-e5bee06284fe", "value": "12288:IXERDvcbbk1ihJ/jhDGXN8G2VlQPp4drSNLnHj3qmG0QyFtTgss65dcq3EW8rJ:yEpvz3QyFn6q0Ld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647867300, "uuid": "459ea213-5633-4ed4-a6af-3040a46001c1", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647867300, "uuid": "7ccad27d-90d4-4d8c-8172-3d45da057129", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647867300, "uuid": "183d0797-0254-4842-8779-59e79eced7e9", "value": "boni.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df63b70f-a8f0-11ec-9275-42010a9c0029", "comment": "Malware payload (BazaLoader)", "timestamp": 1647851303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851303, "uuid": "65e83174-21d1-4423-b0c3-2881b9e13963", "comment": "Malware payload (BazaLoader)", "value": "8331d179757bc08eca2916237fd66ef1", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader ISO", "colour": "#54D70C", "exportable": true, "hide_tag": false }, { "name": "EXOTICLILY", "colour": "#D74DC5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851303, "uuid": "5a5a21d8-86ed-4652-b796-221c15829198", "comment": "Malware payload (BazaLoader)", "value": "5ceb28316f29c3912332065eeaaebf59f10d79cd9388ef2a7802b9bb80d797be", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader ISO", "colour": "#54D70C", "exportable": true, "hide_tag": false }, { "name": "EXOTICLILY", "colour": "#D74DC5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851303, "uuid": "97482407-c263-4bc6-aaf3-5e7ffb89a56b", "comment": "Malware payload (BazaLoader)", "value": "057077d1f32a756492dfe18baff53ca6dd31a378", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader ISO", "colour": "#54D70C", "exportable": true, "hide_tag": false }, { "name": "EXOTICLILY", "colour": "#D74DC5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851303, "uuid": "bc7d085b-e490-45f2-8ff1-85650b31e1e6", "comment": "Malware payload (BazaLoader)", "value": "d68cbb770411cc3522a82af3761eef3835c9f1ec913849f34953ad9047dae8f8d34df5f741788ce0039ebd1c6fd1637c", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader ISO", "colour": "#54D70C", "exportable": true, "hide_tag": false }, { "name": "EXOTICLILY", "colour": "#D74DC5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851303, "uuid": "a4e1826e-f8d6-4fb5-a8fe-12c255ae443c", "value": "T19F445C6DAF4C25EAFBEADA335AC97864216B336609935ECC121DA7C90B133617F011DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851303, "uuid": "4e61acf1-cfd7-4de6-8c16-4124eb617961", "value": "6144:IpGL6nRr/qJy8CQnzX473venaGyRAU9uBXP:ILn9qJ5rnzoLvong6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851303, "uuid": "7be89914-38b3-469f-919c-f6334dbeeab8", "value": 276480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851303, "uuid": "82872bc0-fa4f-413d-85b4-0c4cf71892f5", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851303, "uuid": "ad7a1425-195c-4369-a3ac-15351eb6fb28", "value": "BazarLoader ISO (3).iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8448fa53-a8f7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647854157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854157, "uuid": "cb7f8040-ba44-4866-b650-e0806313586b", "comment": "Malware payload (Heodo)", "value": "e7a20b8a0b2129416914db6d476c13ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854157, "uuid": "40f1da8d-62ad-46a3-8a72-94282754aa61", "comment": "Malware payload (Heodo)", "value": "5d346b415d274544adb94fe129f92246f72cd0fd40be2fdf0a5a809f60b7ee1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854157, "uuid": "590f03c7-ec1c-4a1e-9796-45dc76b13580", "comment": "Malware payload (Heodo)", "value": "8d54fa6baaeafa81d6ba6174d09efaa35aa9400f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854157, "uuid": "b44d71a9-7be3-4f97-b508-11492f021b4e", "comment": "Malware payload (Heodo)", "value": "858a375ed52a08dab48b5aa58a5ff6f2e3d5d929c329e67bc0b4290a67ee0b10376d940d80f68a11ad01c488aeba98cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854157, "uuid": "561aa002-a804-4fda-b50d-58170c7e6fa4", "value": "T1E7056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854157, "uuid": "7863e1bc-7dd9-4b70-bb1e-76b350e915c6", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854157, "uuid": "3280d2a1-eb80-4cbc-892e-0ddb007f505f", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rW5CGNHrH2tZ+d+:gMV/rW5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647854157, "uuid": "91605fa1-7ac1-465f-a6af-9893f8632b8a", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647854157, "uuid": "913506d3-1652-479d-a0ef-3360dd9c2f8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854157, "uuid": "7152d154-fbdc-4bb8-b9b3-2f7fa809b393", "value": "e7a20b8a0b2129416914db6d476c13ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcf96985-a8f9-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647855111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647855111, "uuid": "01272e5a-4b8b-428e-9e5a-b80e76cfdbdd", "comment": "Malware payload (Loki)", "value": "7a9302e65a81c949b9ac705b78063176", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647855111, "uuid": "2a44686b-47f0-4f99-a8eb-fea0468039f4", "comment": "Malware payload (Loki)", "value": "5d619b8944c749501aed6403110cdbbb71ca435dcf221eb442790f5cb03bb712", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647855111, "uuid": "e53be6e3-308e-4190-b512-2dc06745f6aa", "comment": "Malware payload (Loki)", "value": "8f0e48aecfac90fa152d32ce2b36cced16d964b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647855111, "uuid": "ae054999-442a-4597-817c-d6d3dbfc7201", "comment": "Malware payload (Loki)", "value": "e9c93b16e90bb38894893c6ffac6f4d438465b171f76e4464def01bfc83d17790c20d758cdd432dedcb23b69eecaec0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647855111, "uuid": "e3d57cf0-855f-4d8e-b2c4-0826a2f1d12f", "value": "T1C71523BD775D4A12D5F597B3D4D1A6F023320253BA03E91C954A624E0E23B88DE237BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647855111, "uuid": "aac56435-241b-4a93-bf3e-fc4634ddd057", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647855111, "uuid": "b053e04c-ace6-4bbc-ae83-52d1e2a038b6", "value": "24576:OA1l9PMt9yln260mZ1fiAd+VRHOcmdd9FaE9G0j:OAJEt9En260aQHOcs9FFG0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647855111, "uuid": "4a7bb0d2-f297-4ba8-b51f-0c868913cf49", "value": 949248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647855111, "uuid": "9f130c6b-d26a-4d07-87ca-d9bcb307833b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647855111, "uuid": "5d407bd2-ff2b-4ff5-9ef3-ff03f021d74a", "value": "7a9302e65a81c949b9ac705b78063176.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c70b3d20-a8f4-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647852980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852980, "uuid": "4db1bc2a-62d6-44a4-aba9-6e781b9f0b3f", "comment": "Malware payload (AgentTesla)", "value": "e9277576e2241c80448a4e5c08edeeac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852980, "uuid": "d8d7922f-b2c7-4665-a289-00ba97991317", "comment": "Malware payload (AgentTesla)", "value": "5de3a725e202d9b3135102036a2d460cf6a00eed4e4839af7577cd6e00743752", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852980, "uuid": "cfb1fa32-bb79-4739-a6a2-f2c2a81d77a6", "comment": "Malware payload (AgentTesla)", "value": "c779297474de13a71ee1ebf47201d2dbf60e462e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852980, "uuid": "51fd5842-05fe-4983-98f9-5195c3dd2ccc", "comment": "Malware payload (AgentTesla)", "value": "5fd7e79980ff0d696f813fea72f7814fa03fa6e5feda93f0d7604c3ad2663dc64687eeae08d840b4af927d7748b231e8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852980, "uuid": "ff72ddc1-1849-49d0-a3b0-bea59e5b51fc", "value": "T16A22E66ABB98C23AD9650A358C9396D05330FE219C47FF2BB5C8720F2D3324489D2B75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852980, "uuid": "800199d9-03fa-4436-b086-7a7ee57b4a06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852980, "uuid": "e904b74d-a25b-4b45-af72-35b8175ef29f", "value": "192:m2blidaAmn7d1mrVgOCU/NBAsQpcP19PFkQ:m28EAmn7dsbCyNvW8PO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647852980, "uuid": "4e7dfb7e-751a-4fc3-9f42-3f17bca2f6cd", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647852980, "uuid": "b7b4f96f-ee0f-463b-9c26-716426d42729", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852980, "uuid": "7c33ce5b-edea-458e-93fa-9ee596038a17", "value": "\uff08\u5f15\u7528\uff09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6940751-a947-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647888654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888654, "uuid": "583b4172-dd57-4150-b8ea-0db654b16005", "comment": "Malware payload (Heodo)", "value": "e4fa91eb42bec0081d5315fb4ebc51c0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888654, "uuid": "b3472e36-45fc-4942-854a-5a6e3d44c9c3", "comment": "Malware payload (Heodo)", "value": "5e39e6f856eec9b4c4b71318ba39bd058f96e86476a83b38babce0c7b015598d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888654, "uuid": "f3e9fa24-3375-478a-88b6-eb6f9a9b89d9", "comment": "Malware payload (Heodo)", "value": "7bce38de9c066cefcb4abb5575fe88ab12534674", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888654, "uuid": "5d72abeb-70c5-40c0-8782-9d8b04980095", "comment": "Malware payload (Heodo)", "value": "96859fcbe14012bb382d18e9bedd7ebda8a68fac1e2579b2543a096b5968f7516c0fd8c548cf27d419dcd1ad5545db63", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888654, "uuid": "3308ee9c-9534-4924-aac1-48cab1cc7f57", "value": "T137B43A11BC916832C36FAC7456073262588EE7F0DBD1F26FA3E0495C9A7C5E36624BC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888654, "uuid": "78be41b5-d5b5-41f5-b3a3-ef05654b6519", "value": "14e6ae8d1400b6271725b3f01025b85e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888654, "uuid": "fe4798a5-fa53-4515-a7b1-681099047d94", "value": "6144:VikzyaB9eoCyx/mEhHB5RYSJ/xm+qiCjzQNPj79GkqbscgCG5qH6scI:VNnCGmyHB5SSJp50zQN39GkUGQSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647888654, "uuid": "3a68d8c1-d6a2-4a9e-a10c-1e1a79c72085", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647888654, "uuid": "30da4f4d-08a8-4975-8db9-c9c093071c53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888654, "uuid": "a91d6135-051a-413b-80d3-1ec95e3af126", "value": "emotet_exe_e5_5e39e6f856eec9b4c4b71318ba39bd058f96e86476a83b38babce0c7b015598d_2022-03-21__185045.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9d8b8eb-a914-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647866675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866675, "uuid": "b2cfd8ab-8e8c-4fc5-80c7-838fe245af46", "comment": "Malware payload", "value": "c289b774299183af9c8d88eac1beba1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866675, "uuid": "fc6cc065-b8e2-41be-b5e0-dd227e8a793a", "comment": "Malware payload", "value": "5e46003364d5c1657778379325c9bb03e473acd32246dc0e96a4d3195dfd7ab3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866675, "uuid": "2117e832-5b31-44ed-a6d4-046538540e10", "comment": "Malware payload", "value": "df535138f3b1d619c05b3146e54334051ab3813d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866675, "uuid": "d9fad780-a66b-4b6d-a3a8-bd6435a70284", "comment": "Malware payload", "value": "83d84e833600124df53944636a062311a86185920948af72fa7218200a30975ba03173aa909b5ac2f8db3258dbc0e856", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866675, "uuid": "560bc1c1-86ef-4e17-b531-7235bac44050", "value": "T15D041C809D1CC51CEE6AFAB10833D2B5CE2AFF8ABA4C1985E444FBD6397117146CD938", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866675, "uuid": "614ebe85-948b-4da5-ad8e-63548a740d99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866675, "uuid": "179af029-b83e-464f-8f30-a4d7a91f5690", "value": "192:FQ8oCRIRauSOd/FFk+7Y/K6GDDDDDDDD/b3bnbhbhbh3333VbWbUrSXVVVVj77j/:y8RRIRauSOLFko6dMBfm7omN57", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647866675, "uuid": "6f67e476-5b5a-4e66-9032-bb2bc8e3cfb5", "value": 175616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647866675, "uuid": "3fd4cbe4-7293-4ec5-a7e3-15a1f80f1a9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866675, "uuid": "83a71434-52d7-42b5-ad26-40487251d332", "value": "03-16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c949a863-a8e5-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647846541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846541, "uuid": "3b1c4b7d-5af6-4823-ae0c-2664a0942f9b", "comment": "Malware payload (Loki)", "value": "8f5d6f3ef639c82880a9acb1cd5f2020", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846541, "uuid": "9a596815-3041-4189-8921-dcdc445cbc4f", "comment": "Malware payload (Loki)", "value": "5e5ada5011c85fb61818da4b7ebbf5b6d6db64c06ccb482f1b00ad98db4140f3", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846541, "uuid": "6d05de67-7fdf-4664-ae0a-f68e0af11c9f", "comment": "Malware payload (Loki)", "value": "e2129e6fcf77ccfc41fb6904f939e7f22e85a3a4", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846541, "uuid": "305b81dd-b005-4984-a1fc-d2def5d7d30a", "comment": "Malware payload (Loki)", "value": "6ec7bce3f0d11ed27f89611be493244531277785beec92cbf9e946498f33072e1a693778d16222add3a036f314060769", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846541, "uuid": "a5262ef9-1cab-4e35-91ee-8424e938f211", "value": "T1080412B0B74AC825EB1892393C10B1A519B1ED01CDC6714B99F0375E2FF2DB561E5E2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846541, "uuid": "3294c5d0-da3e-40d4-9a39-ea564f7a1024", "value": "3072:Fqy2de0Kml0GnE9FQQjYnKaKXRaoV7UlQrR6vKSC9QM/OA2KT38wMPP2JbVmpsfu:b9K0GnE9r/3/DZ229Lf/VA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647846541, "uuid": "63babed0-6f02-40b1-9e59-c64de3f00317", "value": 190136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647846541, "uuid": "b599d87d-55ef-4237-a593-52bbc33e0abd", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846541, "uuid": "c716f9e1-afa7-4a8f-aa61-695c9a26bc8a", "value": "New purchase order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3bb2d01-a8fe-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647857323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857323, "uuid": "d98ddf81-1a9d-4b42-a590-d2cf4dd6b225", "comment": "Malware payload (Formbook)", "value": "34e5e4022a03f211723a046e47177403", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857323, "uuid": "cd17d1ac-1fdc-44e1-94b1-67dea08fe03c", "comment": "Malware payload (Formbook)", "value": "5e6a07d2d47e34283f9467d1b4a03e8021a6d5225b93d88096b269fd6f7790da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857323, "uuid": "b1916906-d5bf-4f10-b9f1-e1836c34398e", "comment": "Malware payload (Formbook)", "value": "8f35c4f5180bc77ba4919e0fa8ff7accceb1f696", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857323, "uuid": "1bfb163c-5627-4541-8f98-446017e14616", "comment": "Malware payload (Formbook)", "value": "377bb6e71598b84354b8e247043f59952c9ea9d0f0ad1238cff06679d26e0b2b33483d4f6c8a4ab1a9044a2b9e596b5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857323, "uuid": "920de42c-b185-43df-b89d-14580c56018c", "value": "T1D6B4122A3EE6F8BBD24086B44773C1579AB678D52F81963B77402F3E4D230848F5B592", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857323, "uuid": "105c55cd-3410-4d04-a38d-046c2fc5f8ff", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857323, "uuid": "6b14b3c4-ae35-4f2e-9a2c-7fdb07cbd11a", "value": "6144:cGiLyVKa/p5Cw18soy8UqIdzn9MkIFK2D9TB6ljIZM/01xRb+wf9doB/foVus8Rq:2sOy8dWeB8dkLRb+wV+HolMb1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647857323, "uuid": "f4f46350-249e-498d-a99e-f1ae7fcda70a", "value": 502400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647857323, "uuid": "1b65c99c-719e-4ac2-bd56-125ac775d72b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857323, "uuid": "15d264f3-6c9b-4899-a896-fe31cb89b9c4", "value": "34e5e4022a03f211723a046e47177403", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7df76ef4-a8df-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647843838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647843838, "uuid": "e88e75d1-6f9a-43c5-b6cb-d7160b1fb543", "comment": "Malware payload (RedLineStealer)", "value": "dff4fab24f9563526cf1f7b4c58405eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647843838, "uuid": "feb36e8c-3382-4426-a4c3-3035285241d3", "comment": "Malware payload (RedLineStealer)", "value": "5ea1215126b048abb5a71e83713bc408a6628a75dc4ba77bf0f1d6e363307551", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647843838, "uuid": "b104c6c6-3be0-4c04-be1d-6ce2b7b135ad", "comment": "Malware payload (RedLineStealer)", "value": "308b8a08e69b20fc12262ffbb262498fe9da8af0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647843838, "uuid": "76035476-2d7d-4e4c-ab3f-9433cabbf0b6", "comment": "Malware payload (RedLineStealer)", "value": "d22a0980f90de0752a2dbf9df7b06f3557e47ce180720649553da2c24196b8121443b0bae0087f4372d09eccf1f0afde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647843838, "uuid": "bdd6f892-984a-4000-9ba6-14b0138b24c5", "value": "T19236332E0859B74BCBDA2C78EC27ED14CEB485B25DF04326A937CD70D70D982972658E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647843838, "uuid": "743debab-b80a-4f6f-a2cc-841ea5192d0d", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647843838, "uuid": "f776eaa6-44c9-44e7-aaf4-6c568f1a9b1d", "value": "98304:yGd4GipMlIP0cHfh47yU05hIBSn8shiscHe//:tdY/h42rUBH4iV+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647843838, "uuid": "c7e6c924-2008-437b-a96f-b5aa503db560", "value": 4915200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647843838, "uuid": "361a21f9-f180-4952-899e-9382d5961a1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647843838, "uuid": "9d2c54e9-e1a5-44c3-90e9-d5f8745a120a", "value": "32881443.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3781b46-a8ed-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647850021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850021, "uuid": "d2b753bb-ef48-4bc4-8288-2b6636b96c57", "comment": "Malware payload (RedLineStealer)", "value": "83716641cc82fa12197cf2ccb5ec282a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850021, "uuid": "0064f3eb-a793-4f8e-b62d-5f0f6d703973", "comment": "Malware payload (RedLineStealer)", "value": "5edcdce6feb26860001df5fc8436f64713f7ea3ef06aacf907cdb46d9a1b1303", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850021, "uuid": "b0a9d929-9d0d-4e26-90a6-141b410baaff", "comment": "Malware payload (RedLineStealer)", "value": "c14781f69da4a9e1027e89729f80808886f50c37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850021, "uuid": "af5e3e72-08a9-45fb-8fe0-08b33419d55c", "comment": "Malware payload (RedLineStealer)", "value": "94aa7af947c76f49982b885cbc1e7f8c3642ed91f755bcfffa65eda9959ab5cf751c1a5b8ec9dd9ec01c9348b590bb82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850021, "uuid": "c233e8d1-c100-4d0f-b6ab-4b77fa8fbc0a", "value": "T13A94C040B7A0D03DE1B712F8797993AC753E7AA15B2194CB22D62BEE55346E0ECB1307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850021, "uuid": "ff796c2a-110f-404c-a0ca-78026202bbb3", "value": "31ff0fcf24c663417943c5927af948dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850021, "uuid": "fdfabf30-4dc1-4dfc-9838-a990a3e3967d", "value": "6144:ciwMaJtsdJPt/NiN6WjaxFsyaLeOs0LXAh0IG5Oi/SQ5cVMD3F8Zo6VW:hwltsdJPxNIBsC5LeN0xQi/4W6hY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647850021, "uuid": "7abf7811-73ac-4c26-8252-35911acf1a98", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647850021, "uuid": "9886bdff-a0ef-4726-ae06-be96d8dcb6ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850021, "uuid": "9c21406c-682a-40ed-96cb-d5d49897f696", "value": "83716641cc82fa12197cf2ccb5ec282a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be8b7704-a8f4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647852966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852966, "uuid": "506eded0-3088-4c1e-b3b3-3e8cfdc661fb", "comment": "Malware payload (Heodo)", "value": "fb33b9b644817d41c5ed7e3dd01221fa", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852966, "uuid": "f322e771-1442-49c4-aaff-c819c7663d0b", "comment": "Malware payload (Heodo)", "value": "5edda85cd045aedc9ca0354f88db5971fda83aa7bcbcf18ceecf95af1350fea2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852966, "uuid": "5f396d32-5d91-44dc-be41-38ddca4e8482", "comment": "Malware payload (Heodo)", "value": "4cacd7c674418e81525321a655d96a17d285dc82", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852966, "uuid": "ff5e6571-fbc7-4378-aba9-bc88078b354e", "comment": "Malware payload (Heodo)", "value": "7c2853b0d0fd54f5adc6201594030b34ec33617eebc86cc4b7aa2611d9e3da1ddd0a8888daa6a9189369d1c180678b55", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852966, "uuid": "22de9d6e-16cf-4d35-87f6-442c9d8247ee", "value": "T127A2AF3ED221E818D67B987C830580F6E70B2C561007A9ED2D51F25D66726F7138FABD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852966, "uuid": "f73fa8c3-d3ff-4c2a-8d3b-bd1bdf0ad0d7", "value": "384:2QZAVb1GNjJITo4CGzPd6ZIwVKb5CzgObff9kC+xbX7zL0crX:2TINqTo4FL3CBn9kC+xbLHjj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647852966, "uuid": "b00a2f45-c089-4c35-b73a-b8390d292d91", "value": 21461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647852966, "uuid": "d4857821-4bad-4edf-8447-8328089935cd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852966, "uuid": "fad9562c-43f6-4ab7-affa-91ccd54bb2d3", "value": "Insight Medical Publishing_1.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7d5163f-a8fb-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647855988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647855988, "uuid": "ba16f6bd-efad-438d-b835-61c71ed668bc", "comment": "Malware payload (Formbook)", "value": "5d51a095a4d6db64f79ee0ca6f6d4dca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647855988, "uuid": "8f6fa488-f7a9-4485-94e4-e84ab40dd8ac", "comment": "Malware payload (Formbook)", "value": "5f58441e657a0972d0ba3b2f0377a4547016990b7195fa6259537945580a0ebb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647855988, "uuid": "272b0f39-dc0b-4308-8022-45d04e76f67e", "comment": "Malware payload (Formbook)", "value": "81563b91e6c7d7eae68368dbe3f14978e041bc99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647855988, "uuid": "0c492e6d-6790-43f2-a685-231d35dfaf0a", "comment": "Malware payload (Formbook)", "value": "ee260d3724836d6d9986ca2e0d1382a433e7f42f7eb683f9eb274a7135af2a8c3e93b61ed4c7dc7021ec16b7a2fb12ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647855988, "uuid": "7ae20953-b198-460e-bca1-2ca4e7963d77", "value": "T13C34F8873944C59CCF6D55F7A307854433A9DCFFC918A6096BC833579EE6BA20822B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647855988, "uuid": "033b0b25-4ef9-41c3-81e0-1b6c47551226", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647855988, "uuid": "69e8676b-0187-4371-8a19-5b84460d7b23", "value": "3072:Xgg9x4Cu+qhAp08F1GRnN9dfz5AkqKnoe0:wgvmhAp08OnNekqKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647855988, "uuid": "7c6024e9-ecd0-4d67-89f3-746492e47bba", "value": 233984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647855988, "uuid": "eda9750e-c334-4018-a73f-7d8e3396ea8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647855988, "uuid": "b1718589-de0e-4d68-a38b-0928fe56e659", "value": "Quotation 6000063442 - REQUIRE SLURRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fcce7b3-a8f4-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1647852700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852700, "uuid": "8fb2e622-a5a5-47a4-b018-4edbf02c8b9e", "comment": "Malware payload (CoinMiner)", "value": "25b946c495793f49b4fbc99614d831ba", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852700, "uuid": "4ca5a3e4-32a1-4f3d-a6f2-a17ded61c353", "comment": "Malware payload (CoinMiner)", "value": "6086aa59e962b0f09ba272d1acea503d485ad05e925844e72edfec647add0714", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852700, "uuid": "db280a80-9cca-4a87-970d-54627a8dceee", "comment": "Malware payload (CoinMiner)", "value": "f141a2d1da7abdc079f93ec0e3944bbf8e2e40e1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852700, "uuid": "ce219556-124c-4928-8f3a-f0968037e0e6", "comment": "Malware payload (CoinMiner)", "value": "75793f139b6180e5b445d06b47b1d9575a27a70c48d854e062cd7e692643d3282aca3d668393124cba24c38f157719df", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852700, "uuid": "c973962d-dc0a-4d67-bd5e-bd289a6c3632", "value": "T1D2D55C1AE19320ECC63AC0749B6BA173F531B86955307DBF1554DB742FA2F60262EF28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852700, "uuid": "d1501019-6eab-464f-8ef1-b9babb4b7946", "value": "49152:DegP+eEuRuxwp9C9JoY2/QtOeKqe+3LSCbMr+zf/4kViYinCeZm3YVsdktboDduG:DeA+e95GdVLbMr+zf/4kViIYVidkLWDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647852700, "uuid": "f2446615-8c3e-452e-bae3-ddbe1f313e5f", "value": 3002352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647852700, "uuid": "4307962f-0cd0-439a-b221-e86bc6edf028", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852700, "uuid": "cfb35dd7-dc23-4d65-b81c-17d8260a9119", "value": "25b946c495793f49b4fbc99614d831ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d825eb-a947-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647888652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888652, "uuid": "36448c02-a730-41bc-9cee-c299b85e7e3c", "comment": "Malware payload (Heodo)", "value": "f9504b48a4d76799e1ffb35c9352c083", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888652, "uuid": "7a19ff1f-ac74-4c6d-bdb0-e2e3f1081f7e", "comment": "Malware payload (Heodo)", "value": "60b05ef6757bb1176b056a40f213b9b2a586fcf558cfc1967c5a3c3cfc6d4087", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888652, "uuid": "aef7ff96-e37c-4a54-97b7-95a8f575712c", "comment": "Malware payload (Heodo)", "value": "809104e140234e0bdea52a12886b469ee29d40d7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888652, "uuid": "1de229be-ac33-4e94-8dd5-b2f8809a8b01", "comment": "Malware payload (Heodo)", "value": "85fedb3cbca8d56633d8a6f0560f3f1d301549f1cdebc5a742fa8d91bbdd4af7ef7292de439e0ee5cb4a15e5efa5fdf5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888652, "uuid": "59bcc23c-e61b-488f-9728-6baff707804d", "value": "T174B43A11BC916832C36FAC7456073262588EE7F0DBD1F26FA3E0495C9A7C5E36624BC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888652, "uuid": "5827549a-595e-4640-9974-06b409abdd41", "value": "14e6ae8d1400b6271725b3f01025b85e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888652, "uuid": "79b85def-fb77-4649-833c-fa5c2673a381", "value": "6144:VikzyaB9eoCyx/mEhHB5RYSJ/xG+qiCjzQNPj79GkqbscgCG5qH6scI:VNnCGmyHB5SSJpZ0zQN39GkUGQSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647888652, "uuid": "68c23360-2ed5-4135-b323-56eca9553dbc", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647888652, "uuid": "01c97382-8039-4522-bdd0-6a25ddaf157b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888652, "uuid": "cfaa1bb2-dd55-4bec-99a7-2dfb40186e59", "value": "emotet_exe_e5_60b05ef6757bb1176b056a40f213b9b2a586fcf558cfc1967c5a3c3cfc6d4087_2022-03-21__185044.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15d7cd8e-a8f0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647850965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850965, "uuid": "ba2f08d1-88e7-40f8-a107-c3c213696c00", "comment": "Malware payload (Heodo)", "value": "20678850b1e2f8b70a1400e6883e5216", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850965, "uuid": "b7e28ea7-3a5d-4a2f-becf-c4d48543566c", "comment": "Malware payload (Heodo)", "value": "60ecf0f74917a97bf1a8c609cb2aff9c6344aa9b18c227a779fdea1adb2bca40", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850965, "uuid": "6792f7c0-3eda-4b5d-9551-123904a7e251", "comment": "Malware payload (Heodo)", "value": "739d8b1030b2d2364578fea96dbac8de2c924968", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850965, "uuid": "0e96e901-215c-478a-81b9-f619374d045d", "comment": "Malware payload (Heodo)", "value": "a8ddb8c5a14ae918f28c5ed71871a862f4507173f3f9f835a610279a55172259c6caa88842c728f8c43902242c13b62f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850965, "uuid": "6e28a63b-3517-42af-8116-61f1273372dc", "value": "T1FD056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850965, "uuid": "0fd86d60-be1d-4c04-aed2-a8feafbdf287", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850965, "uuid": "ce6b8de8-5f48-4a33-87a3-112f41189b0d", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rk5CGNHrH2tZ+d+:gMV/rk5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647850965, "uuid": "f2e77b87-96cc-4967-ae75-1204581753de", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647850965, "uuid": "695a199c-d0b3-4f0c-a874-0efb825fff1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850965, "uuid": "467ac5b1-4d7a-4401-9e9e-ab6a1989b0ff", "value": "20678850b1e2f8b70a1400e6883e5216", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "869da8d1-a955-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647894533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647894533, "uuid": "d2f55ba5-5824-4ff5-9f6a-e9f33f3c6dbe", "comment": "Malware payload (RedLineStealer)", "value": "c6376c0a5c8264e2b09c5f2faeed89fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647894533, "uuid": "f729d866-d5d4-44e9-9e9a-de097e80449f", "comment": "Malware payload (RedLineStealer)", "value": "615bdcc0965d35255d99668380668e1811effaa80cc69c1c78f6a455be86c685", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647894533, "uuid": "a887623e-8962-45d0-a8c0-1938d33bf89f", "comment": "Malware payload (RedLineStealer)", "value": "dd9ab4f1d3f6baf9c8465278e0e8e8d2c52a4160", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647894533, "uuid": "50980d2d-469a-4d0a-a777-2fa839dbb3e2", "comment": "Malware payload (RedLineStealer)", "value": "9c12577079263acefb3f23b9bff670f4664a67f94bde1883939dfaf42582a27f2e4a54e6906922645c5b17a196c873a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647894533, "uuid": "a957920a-ff9c-424c-9eb2-4318e20c99d3", "value": "T19FC423EB7380FC1AD0CF09F46D55654753A3C954A38432AB2756AF8AA0DDC43FB1E262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647894533, "uuid": "79ab7539-3b58-467f-aec4-740cbac9981d", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647894533, "uuid": "9dbbc72a-ad7d-4307-9720-fdfdd4c81730", "value": "12288:asvfTRkf5OREAEwPF6VHN9QS03ULaHNqrxlKIQNokhI3TW2S/r:asvfTRk2EwPFwjkEaHNYK3BOTWrz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647894533, "uuid": "07c66b37-54dc-42b3-bfba-be81cd66eed8", "value": 568320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647894533, "uuid": "4fc8677b-4a3d-4adb-8d3f-1448a600d300", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647894533, "uuid": "f06c0c30-6a2e-48d3-ab53-8c8fd49f8f13", "value": "c6376c0a5c8264e2b09c5f2faeed89fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acba057d-a8b3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647825019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647825019, "uuid": "d9834cdf-183e-432e-a1f1-5373f6c48d91", "comment": "Malware payload (Heodo)", "value": "91747b678bb6a113983d2301104444e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647825019, "uuid": "d6e0e60d-a303-4585-b374-5401e82372e3", "comment": "Malware payload (Heodo)", "value": "616d079ad7a03f945f53cca4de4be47ef256588702b23872704128c2e590b53f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647825019, "uuid": "917f7d2a-2cc3-4b4a-8f99-0ac2ff4b6dea", "comment": "Malware payload (Heodo)", "value": "6a051a7bf828a6f68793a4d40d6f37d69382cf72", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647825019, "uuid": "f504dc2c-3c46-4747-bb23-a0e2dee5b45a", "comment": "Malware payload (Heodo)", "value": "82fec107f8809804aa77f2b62e9a89d37075c2c817d39a7457a5e65259297405e780adb13d3ccd08eae142c4d04a3f2c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647825019, "uuid": "9082801f-0811-4326-ac3c-098cdb32eb8a", "value": "T1F3B43A317492B279C2EBD73408A35275B21AEDF157E274E36EE707CC4B366906E72602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647825019, "uuid": "4103d839-acc7-478c-bdd7-bba9c2152f27", "value": "55cf9ae1e74cef637eafd17181390202", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647825019, "uuid": "b6f764c2-a3e0-4c80-afa9-d9cbe0bdf3a0", "value": "12288:7FFCpYDLbBHqKK85H3jW2VlMD4zeSvturG9+:7VDLbQKFVlMDOtv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647825019, "uuid": "f7277313-f64f-4533-b091-1943f8482494", "value": 516096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647825019, "uuid": "53348e9a-ed7f-496a-bf6f-e21a95710077", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647825019, "uuid": "52ad8543-3683-47c0-9f4b-8174f9d1a46d", "value": "91747b678bb6a113983d2301104444e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aabb517-a90c-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647863026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647863026, "uuid": "54ae83c6-355e-4f51-96f2-9b6f554dfbe9", "comment": "Malware payload (Formbook)", "value": "0f5764c57c3af017b048608730e0402c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647863026, "uuid": "68d6cc47-9c70-4ded-acc4-6c7fe0d68336", "comment": "Malware payload (Formbook)", "value": "6171e04c14e21039e5d518ea5b1129a09ac09d23f8c8169da89ba5fc7e816a35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647863026, "uuid": "504e744c-6589-4430-bd54-3215e1029ff5", "comment": "Malware payload (Formbook)", "value": "a14d94994176f88afadaed4ec22a666ce608a251", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647863026, "uuid": "782c238b-066a-4a2f-8946-272b40d6d952", "comment": "Malware payload (Formbook)", "value": "392824641f751da86968c7ab3ccee29c0fddaead87c4f7e7aa819927565417a5198ad544ff0c23adbaaab1d8d46571e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647863026, "uuid": "7f987964-e741-4ead-a307-8c6a327897bc", "value": "T15835BE66F7E15873C03726355C1B97A9993ABE102E68EC866BF55D0C0FF8281BD25383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647863026, "uuid": "07274e1b-54ff-46b8-93fe-1f373b89f2fd", "value": "ecda77ba4b20deffbdfcdb24b1b9910f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647863026, "uuid": "b7b44d34-ecd3-466f-9a08-8f577e0e4a5d", "value": "24576:PolcmxDQ6vSWIqAk3OOJDnVinzHCP9iWvjXf:PA2J9OpVinziP9is", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647863026, "uuid": "0f4bebbe-f077-45b6-b507-8b2da6680903", "value": 1065472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647863026, "uuid": "bf350d61-4921-4686-974c-ed9e12d2db4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647863026, "uuid": "2251fa30-4951-402b-8fea-b527ede7c235", "value": "aaaaa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "205d3db1-a930-11ec-9275-42010a9c0029", "comment": "Malware payload (Ryuk)", "timestamp": 1647878470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878470, "uuid": "65d072e1-846d-4771-85fd-0a318eb1415d", "comment": "Malware payload (Ryuk)", "value": "e163fbce2507c89a106c8ad001dc099a", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Ryuk", "colour": "#C903C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878470, "uuid": "e07158e1-f969-4566-8cd1-2e5dc310b967", "comment": "Malware payload (Ryuk)", "value": "61e88158da4636ab0c11db75e376f42e11a02ebe0387223934fb10944b52794f", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Ryuk", "colour": "#C903C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878470, "uuid": "69fa3c5f-cf13-44ac-a7ea-1c018be4fb61", "comment": "Malware payload (Ryuk)", "value": "afd8e902f55dbefcfa4afa30c95ce49b2daef6aa", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Ryuk", "colour": "#C903C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878470, "uuid": "606ab094-b726-4a86-9561-32cf312f7022", "comment": "Malware payload (Ryuk)", "value": "781b254a013139ef841da5b30f007a660a2394a4c0bd45767e47909673ac0329c7e5a1f0a3d4ed253738a853e619fefe", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Ryuk", "colour": "#C903C6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878470, "uuid": "4034fb23-d1df-45ea-a46e-d303e8a2612f", "value": "T10021E1152EE86614D1B38F3E446B63027B39B957BF02CF29817402051899911F87CE3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878470, "uuid": "d04f4c99-2cca-453a-bc72-0acb37854194", "value": "24:8tZv6CYvd58A4cPK3+/Ryvm8Lyvm8oD+Hp4pkCabVIZMzm:8tV3ePrSOyVy4Kp4pkCaJme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647878470, "uuid": "386b4ee8-2c39-4617-88d7-4dbe933a66da", "value": 1173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647878470, "uuid": "96b9fb8c-4fe1-4648-a001-419780736245", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878470, "uuid": "0f66e280-7a65-42de-9b1b-4d2ac4b32cf7", "value": "Image-8646-ZP.jpg.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25aa0edc-a8f1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647851421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851421, "uuid": "c8e0f4cc-af71-4af1-a802-5eaf48a1b201", "comment": "Malware payload", "value": "f411c1a716639d477d0838bba30a8fbb", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE ZIP", "colour": "#8B5CA7", "exportable": true, "hide_tag": false }, { "name": "EXOTICLILY", "colour": "#D74DC5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851421, "uuid": "2595f9fd-3010-41b6-9fd4-331e288cf7cc", "comment": "Malware payload", "value": "6214e19836c0c3c4bc94e23d6391c45ad87fdd890f6cbd3ab078650455c31dc8", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE ZIP", "colour": "#8B5CA7", "exportable": true, "hide_tag": false }, { "name": "EXOTICLILY", "colour": "#D74DC5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851421, "uuid": "6b7cad42-9af1-4c9d-ab50-92efa8c11cde", "comment": "Malware payload", "value": "8100df98a73a8a037b4085b86ff42af9c438f382", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE ZIP", "colour": "#8B5CA7", "exportable": true, "hide_tag": false }, { "name": "EXOTICLILY", "colour": "#D74DC5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851421, "uuid": "5e444919-9c0c-4626-bff5-7454c2adb4de", "comment": "Malware payload", "value": "4fdd0287612d14c67b1f605af4d22f22e36ce3aa12c67f488ba3a611f4b77493fdbe88add58b5a52bc9f8799c897b0fa", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE ZIP", "colour": "#8B5CA7", "exportable": true, "hide_tag": false }, { "name": "EXOTICLILY", "colour": "#D74DC5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851421, "uuid": "dd477461-bf16-4455-b309-40bb4eaee734", "value": "T13435339CA69C7C9B510234420DCC93187F6C2BE4E6C7DFA87258A197751BF732D48B2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851421, "uuid": "b979f14b-126d-4aee-963b-6b9a709f7b21", "value": "24576:v78He7Xb4ZMhMdNI5BhlQmNeDiMkhSripiP4Ln2zt8GtHf4:vYHe7L4WhMQqiMksriN2zKCg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851421, "uuid": "c96ee2bd-2349-4756-9bc8-867360a45424", "value": 1058953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851421, "uuid": "15ef0dea-c81f-45fc-b7b2-ae5dfa4f420b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851421, "uuid": "4bf90171-c730-4516-b94a-efec9be8ace3", "value": "BUMBLEBEE ZIP (2).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2433a85-a8fc-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647856435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647856435, "uuid": "6a864975-355a-4aac-a931-c48401cd218a", "comment": "Malware payload (RedLineStealer)", "value": "839fe579891f1d5fbc362915f780bd4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647856435, "uuid": "61f3059d-6f8f-44a7-a7b4-90720085ac6e", "comment": "Malware payload (RedLineStealer)", "value": "621b0d5a0c91b1d90588b78bc04fa961412601ab392b91b9d3995498a417dca4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647856435, "uuid": "0d1de8da-b15e-4ac1-a096-75050cac7dcb", "comment": "Malware payload (RedLineStealer)", "value": "e2130c74b6c48794c5287fa54a881b9ffeb7b41a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647856435, "uuid": "2ec32cb2-4e85-4519-851a-7c9fc4b04283", "comment": "Malware payload (RedLineStealer)", "value": "ac1a993b170b2913cabfd35a5ec9ad9ffe6550c78e54f878811fe0647795738e96f798db0ec3a0be430dde50971b4ab2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647856435, "uuid": "f0922e48-3c40-45c8-90ea-bdf24528ce97", "value": "T145A3D4CAABB5DE23F54C31F6D024F5A25E6CBEB64DA2F6435CF874990476A214B001E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647856435, "uuid": "d8e3c4d8-1660-4c10-a5c9-9aba55475e1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647856435, "uuid": "710a45e2-e765-419a-9f32-704b4f1b3544", "value": "1536:MxOntLhG/b6x7kIACy9cbZN9ygf4nSTJ+bNNmsdEDN7r+w:BnZhG/b6xQhh94ygtTJGDiPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647856435, "uuid": "39fc2d60-de7c-4a63-8589-1da90957f7e0", "value": 101376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647856435, "uuid": "98913267-e67f-49f7-8ca6-51a398971743", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647856435, "uuid": "967ddda9-dccc-400c-a668-0dd6f1daaf37", "value": "621b0d5a0c91b1d90588b78bc04fa961412601ab392b91b9d3995498a417dca4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2752ff04-a8ec-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647849276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849276, "uuid": "d932e6a0-aacb-43cd-b778-6a742b21b488", "comment": "Malware payload (Mirai)", "value": "721f12706e81bb97c6319bdaf005cc0d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849276, "uuid": "e6a0a127-d558-482a-a5ff-25e2ee3c2ec4", "comment": "Malware payload (Mirai)", "value": "621ba0e2ccc3a0bca199001c7b75dec2f1135058f02f16debb1d3cbd5a0b32e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849276, "uuid": "76269fe3-6576-4f60-a1f3-630685d468a8", "comment": "Malware payload (Mirai)", "value": "c683a166feaee3bb093295c2f49351f4452db729", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849276, "uuid": "4fba01d0-91ab-49bb-9fe2-19b83fa6f75d", "comment": "Malware payload (Mirai)", "value": "0617e38c0420ce62a11e28eb511e218906c11b7c6678603f9c443c7054ebf8a6fcd765eb6a9a1ced2cb1ad5b27cc450b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849276, "uuid": "8a8bd920-f13e-4080-a0e1-a5acd67fca8c", "value": "T1D0A34A57671D0B53C24B5AF12DB733F0879EFA3116E26280A40EBFC01B72AB41626F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849276, "uuid": "fac1d2f8-1670-4607-993c-2d1f92e23417", "value": "3072:dVjaGMtBMz5Ydw5hphpt8kNUZ09DRDWQfgm:dVatBMV+w5hphkkNUZ09DRDWQfgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647849276, "uuid": "46a510ba-d42e-4e7a-924f-5aeb38a9549d", "value": 104108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647849276, "uuid": "fa607dfa-4b6e-4656-959d-4f2183b3c91e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849276, "uuid": "69b0541d-2a46-4e40-9b4f-e688cfaa5085", "value": "721f12706e81bb97c6319bdaf005cc0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e84592c-a94d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647890923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647890923, "uuid": "e739772c-8c78-4988-a363-259e9d1ecc70", "comment": "Malware payload", "value": "73a2a00ca772abb82329d9c8a0390109", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647890923, "uuid": "baa18c56-d269-4385-b42b-48937506b069", "comment": "Malware payload", "value": "62d9bd841b5d37ddb474e716670cf88993bf007fd1323ec2ef00d366db50abfc", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647890923, "uuid": "9d47e5f4-7b7d-4d6f-a363-6f4e7bccc908", "comment": "Malware payload", "value": "e12e4075798a81c84961bddef67a7b0121338eb4", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647890923, "uuid": "74a9eca1-0799-4b68-9639-e5f88c8866a1", "comment": "Malware payload", "value": "7d78adf6d541fdf0295b104e473c6ed559fbc3b497ca02279bbf2c737a4afcb5f29fd3133a3720b61bf504ebe4d460da", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647890923, "uuid": "0abbcbee-21bc-4f99-88aa-6b585ba51b56", "value": "T19741F0161BD5AB65D3B74E33587ED3208B21B551EE17972C8480E2C86CB0608FC7AF26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647890923, "uuid": "e2d12159-f973-4baf-9fd8-cc55528d5a72", "value": "24:8YJKnlZ2fWNVA6PA+/N2Ll84I0ci856343j5AlWyrH4qm:8TB06lklDITvyb4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647890923, "uuid": "b34faeb1-d1f5-4b81-a180-8dc2207970d1", "value": 2004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647890923, "uuid": "23be62f2-3e98-4cb3-ac06-0ff08e9011ea", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647890923, "uuid": "13e419dc-ff3c-4ae0-a401-1c806cc0f48e", "value": "document.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "316f57b3-a926-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647874204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647874204, "uuid": "ae7a143e-f473-460b-a025-eb714a0e6f83", "comment": "Malware payload (Mirai)", "value": "eb476ab5c233cba328f21c842a5a7059", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647874204, "uuid": "dfe2317a-09d0-4e68-9501-a4e8c38749b3", "comment": "Malware payload (Mirai)", "value": "631fe3bbe3ab3e8cacf59a5686bf4dafeb56ae96573a7c28b3f74d65e1aaa302", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647874204, "uuid": "e112f57e-5a4a-49b8-8a1e-b2fc2b23fd88", "comment": "Malware payload (Mirai)", "value": "a690bee2e7d80c0b7aac14818553350e599e8227", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647874204, "uuid": "94e92a3b-6c76-483f-8a16-118297cfca2e", "comment": "Malware payload (Mirai)", "value": "86810b385182b8471cea2f19cb75163b37956384acea2021682c2bfc2083d0fe7a28482568dfffa22b33027078116f27", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647874204, "uuid": "aa0e5453-3fcb-4e46-b49f-e2cfd6a2ef68", "value": "T13D23E1031CECB94ADCE578B8ECD3404BBA6D4FE8A4791FDC390455BAA9A344296FD052", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647874204, "uuid": "506d39b3-64d9-4956-a9ed-cf8247b83bb7", "value": "768:jJutAi4Zr7hSeENEsxJnfABVNwpIjMt9kU7On3Vq3UIYueJfXKhM3LcaEfhR:jYMNENEsxV4BVNNMUJ3yYue9ahM3LEhR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647874204, "uuid": "38177070-e273-4f00-865c-5345a9fe9046", "value": 48320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647874204, "uuid": "790a90da-33db-42da-8cd3-1e0b8835adb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647874204, "uuid": "87601ad1-e60f-4003-a321-3a3b3332f54a", "value": "Cronarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28523f17-a92c-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1647876766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876766, "uuid": "1bc99979-727d-4918-8fd0-e9eec5a33479", "comment": "Malware payload (DCRat)", "value": "192e5b9e61473b2026f7b5a5f99ce131", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876766, "uuid": "dfbbec97-039b-405d-8deb-f6c2c5e0eb61", "comment": "Malware payload (DCRat)", "value": "635eb25d60884d988f25bdb750251aab24842548b9f503b93487394f05c28b04", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876766, "uuid": "db547ee4-d975-4e95-b4e8-4fd1ad2f0a71", "comment": "Malware payload (DCRat)", "value": "28b994a13d9a547038827be1084f53274a6ff18f", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876766, "uuid": "d7e18eb9-01cd-478a-a3d9-8140480bc23f", "comment": "Malware payload (DCRat)", "value": "914eee3475888305b5d4e6823c23a415418e8c438a9e04be6a3619613037f6aa7ea1359f5ee902d56ac4d8570d242e68", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876766, "uuid": "cd4b2a39-5241-4115-96bb-d3db721200d4", "value": "T1B2356B067A54CE12D0A907B7C6EFD11843E8AD836A27D71A7E4A33AC21013E79D5E5CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876766, "uuid": "4a28a32d-9d28-4b56-a176-a417a7bc12db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876766, "uuid": "95d5e91f-97bc-40db-b35d-c96470b5b599", "value": "24576:jP7XDjVxjFiyvw1wsDaMQ9H3A3fzKbx7qm9QgE2Fb:fNpFj9H3OKbQmU2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647876766, "uuid": "fa6b233a-e69c-4e01-a6ba-1ffe3b772cbb", "value": 1151488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647876766, "uuid": "1844540a-ba8f-4820-b40f-34586199e3df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876766, "uuid": "285020d5-ae48-417c-8b0b-41b8713a479c", "value": "192e5b9e61473b2026f7b5a5f99ce131.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f445def2-a934-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647880544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647880544, "uuid": "0fb3f98b-cb21-474b-a520-d0a392eb6442", "comment": "Malware payload (Heodo)", "value": "d767153b10f7b121a1bf1dc8e8964850", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647880544, "uuid": "b79dbeb6-1c7a-4b97-b5b9-38340302c4c1", "comment": "Malware payload (Heodo)", "value": "637abe06f51f2def7bd73103d7ebc5d362a726ac6b735e28d19a02455d5419a7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647880544, "uuid": "ced05b4c-abd3-48a9-967a-82790a8dad20", "comment": "Malware payload (Heodo)", "value": "8728b7c15ea0f2d92931592b0eb4b25418df4333", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647880544, "uuid": "3b64dd27-123f-499e-9e56-ae1554e9b03d", "comment": "Malware payload (Heodo)", "value": "f42695bcfebd8fa0086d0ebf1f5f3725445b0a10321c764ec64a8e8c4222800784564508e9affbc33db20eb329346196", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647880544, "uuid": "5681592b-929f-4c6e-b67e-304c218ab261", "value": "T1A5F2A031F2E29F55E476583C468CDAF8D73DDB22420A7E2C308A537C5F126666A4F28C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647880544, "uuid": "f7b5a9f4-c4fd-46e7-9528-8e318d3af86b", "value": "768:PrtDp5eCAjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooNQ3:PrtlgCUOZZ1ZYpoQ/pMAIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647880544, "uuid": "77000d2e-13d3-4a0a-b54a-2d23c1fe1b3c", "value": 36493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647880544, "uuid": "c10be129-1f86-4dd3-aa1a-5ef2e43fd614", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647880544, "uuid": "96e5b42d-2f8b-4cb5-9b05-a35942dbe7f7", "value": "adjuntos_74.zls.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7948344-a8f0-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647851209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851209, "uuid": "7c531923-6f35-4278-83b8-a41a9df96813", "comment": "Malware payload (Loki)", "value": "3ecfaf14bb1cc5b276e27351efe4019c", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851209, "uuid": "95b5d8b5-7e54-4abb-966c-92cfe54f6be4", "comment": "Malware payload (Loki)", "value": "63dd2b5be29af7b21fb7ee06b2dc7f850820fc7355d49f6cba0e3bdb47ccca18", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851209, "uuid": "bc45174b-2c8b-4bba-901e-41499f19f71d", "comment": "Malware payload (Loki)", "value": "646e9639cf4bbce96626ec00a07a5be3bc32105f", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851209, "uuid": "d0613d6f-045e-4a61-8177-048d80696fe5", "comment": "Malware payload (Loki)", "value": "21376fd10efaaf63aa2450559a68de219a237583d39dc63545bc25629a12438dc91cd3374fe9dee06e0a624a18f2a481", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851209, "uuid": "72251297-e7ba-4a6f-8c82-f7fe0dcecd41", "value": "T1FB1412A2F4A5EB5BCC8101FB353ECE058FF5FC0854D2426D94A5BEB32B305B13A9A605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851209, "uuid": "2ef5e90e-4b6f-42a5-9e09-4e944c0e0f94", "value": "3072:X51MukFu93sGJ+PZdOqLg1Ad4ekOyqYsJjCKqWelQYJ+WNGgz7fYo2cJM6ySjQ:/9kc93lJSOqLL/kO7jCKpeRxz7fns6yF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851209, "uuid": "e6ad7b28-3cd1-45c8-a9b8-294d528ae469", "value": 190632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851209, "uuid": "41460687-e32c-4008-bf76-7241af21ce8d", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851209, "uuid": "a813f27c-9745-4ed1-8dde-a5fcdcd8a752", "value": "Statement March 2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af81d0b0-a914-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647866685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866685, "uuid": "29bf6bcf-bf2e-41f0-9b96-76ac4b2f1702", "comment": "Malware payload", "value": "651a7165935aaa358942694be9709b56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866685, "uuid": "1d206722-51f2-4146-8a3f-5b74152f1b46", "comment": "Malware payload", "value": "64019a23b439d055324cc76c40a3df2577a1a293923d0a1b169dc04063b343c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866685, "uuid": "41fd6a18-ea80-45ab-ab7e-703d934fcb2e", "comment": "Malware payload", "value": "03f649108715edc8f9e0daf2dc87903003156fe4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866685, "uuid": "ab209b00-817f-46a0-9a48-7f75f86e7344", "comment": "Malware payload", "value": "e460faa309add93f00f6a2bd8a235183c8a775f40aeac46213d6980e90cfbdcc80c796861b8a227b7f25bf83dd0efe73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866685, "uuid": "55f8ca2a-ed8e-49c3-ae07-6aaed1ef0f29", "value": "T14F64232CB3F188ABEAA50A312073C7B7E7B4CA064547554B3B794ABD7D210980F676D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866685, "uuid": "c39bac2b-6be2-4dd4-baf8-7990510bf093", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866685, "uuid": "760f9011-0eb2-48eb-840a-afca42dc34fa", "value": "6144:rGivarBTL6SbZ9FFpRGKAQJh/f3rPRR/lqcFwtbHHPZP1c8rJ:+rV+S/pRJhrxqEwtb3zrJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647866685, "uuid": "47d27986-dfcc-45ac-a3d8-937dc40308f1", "value": 314047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647866685, "uuid": "a5e973f8-dfc0-4ec8-9549-2033856aa89b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866685, "uuid": "c8255ccb-c046-4d7a-b86e-6a64fb9ee406", "value": "factura_834.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27b8284a-a8f1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647851424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851424, "uuid": "5dbb4e4b-5cb5-4a4d-b0cb-03f147603a0f", "comment": "Malware payload", "value": "df34f23037c5dc05c2f03513928b4b97", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE ISO", "colour": "#AF335F", "exportable": true, "hide_tag": false }, { "name": "EXOTICLILY", "colour": "#D74DC5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851424, "uuid": "1549a11e-644f-4e05-8e37-e52fa2ed1450", "comment": "Malware payload", "value": "6483435f12ab4a0babe3abeda8511e1f00560f1e4482f30fa2ed32daf39c0be1", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE ISO", "colour": "#AF335F", "exportable": true, "hide_tag": false }, { "name": "EXOTICLILY", "colour": "#D74DC5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851424, "uuid": "83c4d9cf-4916-4e46-ba12-c6522544e3d8", "comment": "Malware payload", "value": "9b107dd8a2d34819bd94dfcc1bb65a0106a95660", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE ISO", "colour": "#AF335F", "exportable": true, "hide_tag": false }, { "name": "EXOTICLILY", "colour": "#D74DC5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851424, "uuid": "522bb8bd-e903-482d-b40b-d28f4312814d", "comment": "Malware payload", "value": "2f5a8f535634ebb3f127ad81ace86ba188364e71a94f2cd44b3b735f6b19bebc6c46f4b3f62902f0c40ef5baaeb6a41b", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE ISO", "colour": "#AF335F", "exportable": true, "hide_tag": false }, { "name": "EXOTICLILY", "colour": "#D74DC5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851424, "uuid": "c3b9c5d7-9d62-4501-8ee9-c9904424e0e5", "value": "T114B57C45A7A804E4DAB6C13CC9569607E7F2B8150370DBDF0AA84AFA0F237D11EBE754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851424, "uuid": "270499e3-2366-47b2-9980-03ae0a3555d3", "value": "49152:5iCsh74TQUm5D0/pwphZ+byFW1igxwlqPGOg14:+2xlALay+LxO1O5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851424, "uuid": "04759a8f-96d4-42fb-8882-c2aa12d5ac51", "value": 2306048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851424, "uuid": "e60c919a-15b1-41df-a4fa-8b4639fc988e", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851424, "uuid": "bf9cd9fc-3154-4a01-a352-e3e9d5f690aa", "value": "BUMBLEBEE ISO.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2125688b-a911-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647865157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647865157, "uuid": "8dce6807-dd28-4841-9e80-3d65acba78df", "comment": "Malware payload (AgentTesla)", "value": "e95fee9a631b313fa82ba6074c3b18b4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647865157, "uuid": "aea0b381-2e45-4c88-83e6-fbdb7a459a4d", "comment": "Malware payload (AgentTesla)", "value": "65199866cfbfe0372e1c2b33871e7d56d21835deefe21168a77fceb7ffb59b5c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647865157, "uuid": "c7cece3e-71ce-4dfd-8f8e-df500c094bf6", "comment": "Malware payload (AgentTesla)", "value": "4d07b1e47b81cb20e37fa0ca6026cdaf590debbd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647865157, "uuid": "8d68b450-3219-4766-8673-b9e99a05b0d0", "comment": "Malware payload (AgentTesla)", "value": "f5662503c5fa7c5f5192ad60a597ce114998fdeb549c4c57464ad4b909f93a1f2434ced68135ae8781a07f786e07d708", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647865157, "uuid": "d122874b-575c-4f04-ad7e-3b78fc643792", "value": "T14B24297E1B455D02C7EE027D6037890922F17517C32A938F6EE248EE1F552CAEA1EED1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647865157, "uuid": "30da686d-2c25-4480-a8f6-d8e127505b83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647865157, "uuid": "af1316d0-c36b-457f-8c50-3d393f1c0989", "value": "6144:olORPBfqFe/lVbnUfTsQO4GMUbt8062oR1RCbRsT9qBq:olORPBfqFetVbnUfTy4AAsRI9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647865157, "uuid": "9adce229-3e89-4194-88d6-0ae9596562b7", "value": 212480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647865157, "uuid": "09d7a079-bca9-471a-ab23-a34bd5742b3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647865157, "uuid": "136b9439-7747-4d06-ad1d-fcf3294c027e", "value": "File_98277102720032022img_screenshot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5abf1717-a90f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647864395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864395, "uuid": "e5fd7f80-ca93-42a6-b485-7d753f5ea0de", "comment": "Malware payload", "value": "bd48b7e0067ec2c40d3702047d4f4c3d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864395, "uuid": "be797c66-72b3-4249-a131-becfedcb3839", "comment": "Malware payload", "value": "6569ff5101dcac80cc7fc8224a1c9490a68e27be45a5c4f46a1d783d8529766d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864395, "uuid": "8631999b-2cb1-4f44-a34a-66ba2ef154da", "comment": "Malware payload", "value": "7691bbfcea8bfa558440a4eb79a05ce9b9a118af", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864395, "uuid": "69cb834e-3f8a-458c-a558-b21bea62147d", "comment": "Malware payload", "value": "1bb39bf87819919267a3aff6a8cd8512e1cc77768a211bab7f2a5ddd0bcea5bf0c4793f8177afd266c0957f4e47ffdaa", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864395, "uuid": "9197bd95-ae80-496f-939c-cb6222c5f4ff", "value": "T1C19407A36BC3C077E45702B9C75A5118B2A7C532375AAADF37C1671ECA383A2B738151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864395, "uuid": "3759b141-7ad6-4947-8254-1550645970c4", "value": "12288:wGOAWAyzLzHKwJrCf9dJJjI1rMpUsN+JinUqqOD:w5aD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647864395, "uuid": "d5f92da2-9de6-4100-8ed2-6be27b2e80e8", "value": 445912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647864395, "uuid": "f5f9795d-4ac7-4f0e-aa78-b17a1f04673c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864395, "uuid": "7e16693e-4fae-4cd4-b105-0d78021d3ce2", "value": "emotet_exe_e4_6569ff5101dcac80cc7fc8224a1c9490a68e27be45a5c4f46a1d783d8529766d_2022-03-21__120630.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba71ffab-a8ac-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647822035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647822035, "uuid": "9b3e411c-d157-4309-9a25-3d931d97c74a", "comment": "Malware payload (Heodo)", "value": "2f84d4bf6d9f8f5584d166ea839d9f39", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647822035, "uuid": "bb8cec7e-d65f-4939-b7a4-1465473bdc2d", "comment": "Malware payload (Heodo)", "value": "657c1a93d2dcb42850fad3b23d74ab92937d621b7655742ec85706da5db3535d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647822035, "uuid": "ed94b5d0-92c2-42e3-9537-9cf3ba662df2", "comment": "Malware payload (Heodo)", "value": "4737cfcb4885d2cd02bd5a71b96c88075089c7c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647822035, "uuid": "88ec44d2-b340-496a-87fe-385f52b7ced3", "comment": "Malware payload (Heodo)", "value": "9eeaa6ae2f73bc5e760b0c9c433684ac43778600523856943f57d4598b32fce838fcc5d919d4838810aca559c0b042b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647822035, "uuid": "e07aceba-70b3-4505-8489-d07d70a39e95", "value": "T1F8A428123CE2B072C89BD0348FC56164855FF5F5AFA6727E62FD229C4B24DA18E17B02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647822035, "uuid": "851f26fd-3207-4861-af5b-608737134310", "value": "3881d76bffe56c7cefb6ec7d56cb4aac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647822035, "uuid": "006029fe-c97c-44c7-956a-3b490d409f3c", "value": "6144:2zP28Xoxy3TAaZOO+kdEWKdguBw423quMsLh+tEgrtenN6YlXmcwT:2zxTlZP+42x/23q7sEbEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647822035, "uuid": "e65fddbf-6a66-4d1a-94f9-d237d7b4fa7d", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647822035, "uuid": "ce0b29e9-1517-4f52-9352-5a209ea97068", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647822035, "uuid": "bfbf86a1-b2bc-423d-8c5b-eab4f99321d0", "value": "2f84d4bf6d9f8f5584d166ea839d9f39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2de2083-a95a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647896836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896836, "uuid": "9f78ea54-6082-4d8e-a7cc-05a3f4cbd93a", "comment": "Malware payload", "value": "8c2e592716d4f5581a3e0e731aa79bd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896836, "uuid": "76a930b1-5124-4a51-ba39-237258a9e30e", "comment": "Malware payload", "value": "658c8b82b443feab93ccaf1388a6234b2f67a810344ab25e920a8d9d221adf51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896836, "uuid": "7b856aa8-5f4a-41a0-a291-4d1727d84503", "comment": "Malware payload", "value": "7038ba7c198606f340e10735dd12342231b1fab0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896836, "uuid": "18cd3daa-fd30-44c0-824f-efc0efff5a32", "comment": "Malware payload", "value": "f66be6f503ccd8d8c96046519a7dee3e3bbbcf40593adc8938ebda5d9e62d492d23d20aad4a8d7df4b9c915bd1657a2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896836, "uuid": "63482803-d3a9-48c5-82ad-fa5555b17d70", "value": "T121D42316D7095593C94C007EB8E7CEB617345A26DF05FDBBA66CF2FF6C0A2295823602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896836, "uuid": "bbdca394-9328-4c07-ad71-6bd5bfbc4143", "value": "6144:u5MXqlTEMacOEt/X2LrZ3YFD+qHiVWcSEGnjih1KBND3h/p/UZEOHHrpm1HUZLx:0MalXTX2PZ3dPwCGjSKBNTctLpm10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647896836, "uuid": "75e87021-0074-414c-994a-1cb159fc42bc", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647896836, "uuid": "191ee0fd-7c8d-4ceb-849a-7dfb44f7450c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896836, "uuid": "fffb8539-0702-4bb6-a326-e5909714a084", "value": "8c2e592716d4f5581a3e0e731aa79bd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5db6f3d8-a940-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647885445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647885445, "uuid": "e5e4f926-2c70-44f2-bd02-6d5d1e307497", "comment": "Malware payload", "value": "fde4ef3dc2fbe820403d4700b937a146", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Facestealer", "colour": "#537D39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647885445, "uuid": "fd3ec516-50ab-4f78-aeed-0f6cfaece51c", "comment": "Malware payload", "value": "6590c5e57f483a949e3f420b50e6b9b9caec0be71bcf7b32ec5b1eeb6445dec6", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Facestealer", "colour": "#537D39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647885445, "uuid": "5ec70148-6f08-4868-ba7d-171abfd514e5", "comment": "Malware payload", "value": "b05dc1f17324192d39f80da30615f2e3f5bf6b61", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Facestealer", "colour": "#537D39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647885445, "uuid": "84ae3e64-0fd0-4cab-bad6-20fa0ec5ba19", "comment": "Malware payload", "value": "08245320e49c4d505626b67d3a8ff09bf0e50d99a1ab2681f2e9949259f9509e6d326f0cbcf0541a4a3b7ec64cbcc0e7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Facestealer", "colour": "#537D39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647885445, "uuid": "b61668fa-5772-4472-bbb3-3842ee0634f5", "value": "T1EB8733EFD320A41FCD3715324AB6222522930E4B4847AF5B2419761C6E7F9D91F89FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647885445, "uuid": "712926ce-8dc1-490a-95a9-1d434f83edc1", "value": "786432:NK13GEJfkHMnxnT8WbEXYOThzQjIqiF+o8DiXh+Yc5XN1m:NK7oMnx8WBOdjF0DGhLc5XLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647885445, "uuid": "ae54c389-b52a-4098-9bed-16c04d73eda5", "value": 37654656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647885445, "uuid": "1a860850-9e63-41dc-ac2e-b0e2f9174efa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647885445, "uuid": "886d080d-3dda-42f5-a96e-d29f7e77f95b", "value": "com.wilbertweber.fadedphotocollage.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c186aca6-a947-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647888619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888619, "uuid": "c8302f38-ecef-4255-97ec-add059ecd9b3", "comment": "Malware payload (Mirai)", "value": "27714550792d46535d2440ff69b275ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888619, "uuid": "ff800cff-94cb-4c28-89f3-621f323fe1af", "comment": "Malware payload (Mirai)", "value": "65e175ee4169a39db1d0e7118d38cffff05d222698c6c38bbb0466ccbe4bb81e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888619, "uuid": "40c61076-95e6-48b1-8c91-4accc549c36b", "comment": "Malware payload (Mirai)", "value": "99aca3a0c6ffcd276437f0cc5024903d389cc025", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888619, "uuid": "418f332c-6d6f-44b4-b68a-a1cd91fa975b", "comment": "Malware payload (Mirai)", "value": "accd576b501a408196f44ae60d8d774a2be382b94ccb9805cc9e91b9c5cb6351ca925f2da1089099787b86059395e220", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888619, "uuid": "a3bcfd94-ce02-4439-b8f1-7d2f7130a68e", "value": "T1A4A3E5816C20CDEEEEEAA0765308450E5E8A1B9055F12B35DF8FFE56D9B70873687D20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888619, "uuid": "37e20389-3dd7-4a2d-9645-e759eb92c04d", "value": "1536:aenzAxdNbqYQd/VWjTgbLJyprex5JYRzZ2JxK33mkosDUaysJa8yrGa/N:avbHKPFyIxfYRzBHhFyu+r3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647888619, "uuid": "bca750d6-156d-4214-871e-4766c8af199c", "value": 106544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647888619, "uuid": "c695cd2c-d162-4152-9468-002e1927dcbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888619, "uuid": "4d8386ec-3973-4324-ba11-b7866a9d9b6f", "value": "27714550792d46535d2440ff69b275ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9357e856-a8f1-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1647851605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851605, "uuid": "8cf4bd66-12fe-4448-b403-bfb183c8b1a7", "comment": "Malware payload (RemcosRAT)", "value": "b1e61143db5888a7e77e19c85476bc36", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851605, "uuid": "66f90918-ccbe-4f97-b484-814f3e7fb757", "comment": "Malware payload (RemcosRAT)", "value": "6616cde4c6746cb8b012adbcec92cae7ff730e8d4f3d5569dfa3fe065d532684", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851605, "uuid": "1e8d9f15-2328-4a0a-a880-ecebaf16e4bf", "comment": "Malware payload (RemcosRAT)", "value": "8b6426d6a448e8ecf83f39191f16ccf4dd9eedd9", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851605, "uuid": "6ee90254-f3e0-4ec5-91a0-761d0df94ca3", "comment": "Malware payload (RemcosRAT)", "value": "7a35570a09e6eac1e79f9d46154a529c4c0e1333ae210db34492ec0490e9e63c452cf3c0d5e5e191c2e5db8be111ac1c", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851605, "uuid": "d8af1855-35ca-4a52-b125-a163ab5cf7e8", "value": "T1B251DE49365B753822366DF29C1F541D93734383A1B452A13E0E8AEECD3517CD7C682E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851605, "uuid": "03b20328-4803-4e0a-aa20-9f80351e26c1", "value": "48:eKWsJobmcNkIOWphFSl3hjl/Jn1rSn0xtu/Pe1SVpqjX0BdIa:Yv6CkIxphs3bJn1rSnCM/OmIXfa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851605, "uuid": "4dedd589-fc05-4175-a553-64d6529b8f30", "value": 2542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851605, "uuid": "4e9ae0d7-bdaa-4ba2-914a-b1e74cccaab2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851605, "uuid": "358d8ea0-d886-4c44-9ba3-00584fa3678f", "value": "transfer proof TBF11321.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc6de98c-a93c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647883940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647883940, "uuid": "a5406989-c046-431d-bc08-1fafadda021d", "comment": "Malware payload (AgentTesla)", "value": "f287499865b463af6c8b5598c1ec2448", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647883940, "uuid": "3cac32af-416d-4fd8-98a0-9840cf44da26", "comment": "Malware payload (AgentTesla)", "value": "66864bccc103990d796e6060fd04f196cc520be2a872463fb287a61535962f85", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647883940, "uuid": "6e91a835-3e3b-4cb3-bd15-04fa1f47f497", "comment": "Malware payload (AgentTesla)", "value": "fd4c4b7e61d03766488890657f4e841f0bae755e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647883940, "uuid": "cc978b4c-f3c4-4e0d-8077-e73f6f61abe5", "comment": "Malware payload (AgentTesla)", "value": "9a881f823ccec7c4d123c80046f81a357b5bd4c1d604c3a01eb50463384636f63bbd1511b536031fc5695e1c58b1e1fb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647883940, "uuid": "aea6ce6e-b166-4aeb-b953-941e7c1a9b03", "value": "T13445DFE421FF5EB2C17B97F1F451B7BA0EA07F48D601C2B9497368C2A1E5B29353460A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647883940, "uuid": "bb4c2315-e899-43bf-ae8f-88d7797daef3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647883940, "uuid": "65a57181-bbf1-4912-95bc-4156e5c79ab0", "value": "24576:X9907zPyb3rk5xQNIu7cCOfhPrZE3xa974upzT:tUPyHk5xdu7KfRrZkxatJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647883940, "uuid": "65d4579d-0556-485e-80a4-dc4840f44768", "value": 1191936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647883940, "uuid": "2162a6b2-c38a-480a-a857-f9fdfad600cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647883940, "uuid": "6d625dbd-77b4-4761-b8cb-0bf631c3c28b", "value": "PendentesDoc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b352ab2-a947-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647888555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888555, "uuid": "2758a678-9c6a-47d9-9157-d540c99d76b9", "comment": "Malware payload (Mirai)", "value": "7cf6064a4330d5b95d1d56424935873b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888555, "uuid": "b1a25adc-794f-4421-8f06-d61f35ef0a39", "comment": "Malware payload (Mirai)", "value": "6691b7fa76b9723b907dfa2a242ba9cf015c39a6d9130a5534d8b680bef0612b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888555, "uuid": "4c0204eb-1cfd-44a9-a238-956b2b35e094", "comment": "Malware payload (Mirai)", "value": "f3bab890be0abbb52159489f6b9bcf697d19445f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888555, "uuid": "9e9f1d98-a1e8-43cc-b6fe-ec2b7ab48260", "comment": "Malware payload (Mirai)", "value": "e217131ab9dfd1ba1f0bd2a0343589f154b67ac4ccd758177453b2d2e09d846a84140af0d977f0045f713b56a31a2ae9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888555, "uuid": "190ec6f8-b510-45af-b3b5-82f97ab72d40", "value": "T16DE318E372CEAB61DD8345F04AAA279B3F035115BE1743D77D2EB63AA2243D60574B20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888555, "uuid": "88b4135c-2831-4060-929c-21c32ae9a35f", "value": "3072:N5f2w22XNX9Ti9eOBgyugG5MTKig1n9q:NsM/Ep+U+n9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647888555, "uuid": "606d7e27-dec5-4279-ba91-342ea23d2ac9", "value": 148764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647888555, "uuid": "9c7dbed2-5945-4ee6-be30-2b5329392ce5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888555, "uuid": "77daeb11-de65-4d83-9af0-bf03b9abecaf", "value": "7cf6064a4330d5b95d1d56424935873b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aea56669-a8ee-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1647850362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850362, "uuid": "87ae12d6-d3b3-4d06-96c1-604eae9d9d91", "comment": "Malware payload (CoinMiner)", "value": "0fdb6dab6f29e54b5220292da7e33be3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850362, "uuid": "969fa756-1b0a-4288-9099-f3eaa1f4c5b2", "comment": "Malware payload (CoinMiner)", "value": "66fa2281567f268adefb54e91b88bfbd7a08eee6c40ff4aafa31472b8d49a3a6", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850362, "uuid": "e58f8542-b534-46b6-8b61-7b6ad3f55b87", "comment": "Malware payload (CoinMiner)", "value": "dc25ca8d22001ce234872aec3549d11fc7b05849", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850362, "uuid": "b245aaef-4196-473e-8d98-ac216d275b27", "comment": "Malware payload (CoinMiner)", "value": "1721d38e301c302b64f7c7434fb050c1009d982d8748b91ac1a24f2fde676150be43e176fd468cee8e97d92cda1886cf", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850362, "uuid": "301afd4f-a430-4604-be81-0c6533bde9f8", "value": "T1A2453342D6E4FC32D92AA37A5205EF5EDF54F526C7CF823CF638407AC9A461610477A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850362, "uuid": "20539626-1e4d-4073-afad-b2fde1028bac", "value": "3eb7622479f8b2c1a30189a3df7139f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850362, "uuid": "49d41587-9478-445e-99db-d67a8394ec4b", "value": "24576:2y+jMkaTDtuF6kYK2MS6+wxaD21EtYlsVVRylcOJLrTkHurKge:2yFkaTDtuMkxrU3t9icaLMur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647850362, "uuid": "489fb9c6-2594-40c1-ac8d-5a0933485632", "value": 1189888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647850362, "uuid": "c4a35d74-41bc-45d1-a53e-827581237efd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850362, "uuid": "618faa4c-2af8-4e37-8bc0-d1ea9cd370e2", "value": "0fdb6dab6f29e54b5220292da7e33be3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac02788f-a8ac-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647822011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647822011, "uuid": "b3a594cd-b424-4697-869a-a368ae9691d9", "comment": "Malware payload (Heodo)", "value": "b3dd55566aa62ee0ce1df4b81c4d0f6d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647822011, "uuid": "1d94895a-358f-492b-8dda-69848e7a3666", "comment": "Malware payload (Heodo)", "value": "67249f24db6b6b5e58a9f38f19b293c091f80094a6cafb53659dab9d09d47dab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647822011, "uuid": "23482b89-36d8-4896-8ee0-957e9e3db827", "comment": "Malware payload (Heodo)", "value": "ebb6b64f28e44dee8547e511bfa514dd7ae5765b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647822011, "uuid": "36898534-66f0-4bb9-9094-f4ae232f7206", "comment": "Malware payload (Heodo)", "value": "520fb2ba8384d0ac347f48a770b62c13a4ca36445612d8f0db48757611006e5c4bdcaf28c423a6b2032836b57c94361d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647822011, "uuid": "ea5645bd-e03e-439d-a07b-30e2cfa7272b", "value": "T177B43A317492B279C2EBD73408A35275B21AEDF157E274E36EE707CC4B366906E72602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647822011, "uuid": "eccf7d28-6a53-4dea-894e-8aff1a992342", "value": "55cf9ae1e74cef637eafd17181390202", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647822011, "uuid": "27daf8a9-c8bb-430f-8f6f-0ea72eea0f3f", "value": "12288:7FFCpYDLbBHqKK85H3jy2VlMD4zeSvturG9+:7VDLbQKZVlMDOtv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647822011, "uuid": "d239c309-48b4-478c-96a8-c7fcb2110391", "value": 516096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647822011, "uuid": "da7fd900-fe0b-4b60-b56d-2cf9c44e3245", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647822011, "uuid": "98e65e65-4ef5-4aa6-92fe-00b41a0ca325", "value": "b3dd55566aa62ee0ce1df4b81c4d0f6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9726684e-a8f2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647852041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852041, "uuid": "ce29a39f-a137-40ee-a00a-1f1658d48f0b", "comment": "Malware payload", "value": "b05b278fc88ab45bda786536c9d76206", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852041, "uuid": "3d5c97a2-46ea-4fb1-85e5-e27de1a7c9c9", "comment": "Malware payload", "value": "675bfec1571822204ba946375e1912bcd56126ea3f018b5c567269ff1141bf1d", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852041, "uuid": "b9356f38-1a1f-429b-a78a-a5ae75b88b96", "comment": "Malware payload", "value": "ea66e59c994e8ba0cf43198427c1386e7fd2a91f", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852041, "uuid": "1bd3b4d6-dc6c-402b-8e9e-c239cb23a1d4", "comment": "Malware payload", "value": "1d0dd856f83223b33e2eb27e12fc8c5f777d5273e986594ee80044d3d3fc8528105bf73d002d605c7a740f6fff3a49fb", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852041, "uuid": "fc2d66cc-061b-4387-8200-3ccb937974f6", "value": "T11E066B33B2C4613EC4EA0A364937AB58993B7B717B128C5B17F4494C8E356423A3F667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852041, "uuid": "bb6ca3fd-64ac-4b13-b5dc-720804d91729", "value": "49152:p6n+e2X9hc9F3d7DS6i8IKH3ynjIfx6DCTiDfKhWtwGYB3A:At2XUTCj86DV8WtwGY9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647852041, "uuid": "d39339d9-38a1-4da5-8a4c-b62b96ce6ffb", "value": 3939328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647852041, "uuid": "ebb07b65-6084-47b2-98a1-0f221e77e696", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852041, "uuid": "5eb89103-88c2-4397-8df3-6be6afda801b", "value": "__&-uiod.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c6fed9f-a938-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647882088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882088, "uuid": "f963c09c-4d6e-4153-934e-4f6c47d5e85a", "comment": "Malware payload (Quakbot)", "value": "9efeec483e8b1bd11dc1752046c6d35b", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882088, "uuid": "350b802f-87b5-49ee-8bbf-ce4bda72aa92", "comment": "Malware payload (Quakbot)", "value": "679a4a4d90fa5ec3b62d9042c26f7e8f6dc7c016e764df215ef6e749ee6a3906", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882088, "uuid": "f9f22470-4de7-44b0-9a87-44156f59a6f1", "comment": "Malware payload (Quakbot)", "value": "9bd60805c5343236131039671f991200ca0c832d", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882088, "uuid": "4d6ca128-6baa-4a5a-9919-59ef062d603f", "comment": "Malware payload (Quakbot)", "value": "bf0344e14d615823686458c2ffeb9bfc66b08ad36a577b734cbad5f727be773b8ce85342e38bd09844c4e46a3b8d579f", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882088, "uuid": "ec2c400a-2023-4a6c-ba66-c46ea7332b51", "value": "T11125AE61E2D059BFC177397C5C3F2794AD357E012960C48A2BE82B0F8FE7581276629B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882088, "uuid": "eb227333-e068-4f89-b82a-a6ffd85ba179", "value": "956cc96766458bd7d01e9c9834ddda6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882088, "uuid": "9477a4d0-e36e-4ea9-8b70-0aed16fbab28", "value": "24576:RFsgREgNUQVt6akhUSz7n+Xz4oA9bDajPNI5zvpiGaTTr:Rnh8b+rAdDa7alpiGMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647882088, "uuid": "60a2a953-74ff-4880-9fcb-13c666387c59", "value": 1007687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647882088, "uuid": "501d1902-48aa-4e5a-a228-9c4925186f45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882088, "uuid": "91ae76ce-e954-43ca-a71d-8f711c73df63", "value": "679a4a4d90fa5ec3b62d9042c26f7e8f6dc7c016e764df215ef6e749ee6a3906", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38cbff9c-a8e3-11ec-9275-42010a9c0029", "comment": "Malware payload (Babadeda)", "timestamp": 1647845440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845440, "uuid": "400c9232-4da2-422c-bb2f-42880f415e7b", "comment": "Malware payload (Babadeda)", "value": "8d2e09a3ccef42ec87e482e43a969cc5", "object_relation": "md5", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845440, "uuid": "fdeba006-2710-479b-b785-98645454304e", "comment": "Malware payload (Babadeda)", "value": "68468e56e132b170aabb28e2868b1dbd0bf40f14c0b0406fe78ad3c71ce9f527", "object_relation": "sha256", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845440, "uuid": "5385aed5-1588-4205-885b-8846113db6ad", "comment": "Malware payload (Babadeda)", "value": "d0a8f9c6d6f611d9a6a526e7ce75216a5f4304a4", "object_relation": "sha1", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845440, "uuid": "de22ab40-490a-48f2-b425-3fe0d5985aad", "comment": "Malware payload (Babadeda)", "value": "10ab24d2045d4d020d1f1940e0087d92491812440418896b7ee87491272369bbd08c61c153378eb6ada2e2b6abad9127", "object_relation": "sha3-384", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845440, "uuid": "bde62d22-2eaf-4208-9633-773c7b5bfc7f", "value": "T139740251A2E643F7E5E1413301F6B02FE176E318A309EDEBE75D68025A427E496B03F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845440, "uuid": "c94d24bb-2fd3-4112-8334-fbf7098891b2", "value": "5877688b4859ffd051f6be3b8e0cd533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845440, "uuid": "7c8d1370-f182-4692-b986-099430f30a0a", "value": "6144:mzBkLL2NTB9OrXnJOlogF9IW9UIMo/PqbcGivZQDUeXZMps2v:mKyNT3qnUlpdCo8cJyUyZv2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647845440, "uuid": "ae45a9ac-958c-46cd-9480-f07b38b1aa57", "value": 354304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647845440, "uuid": "a0f7722c-64f2-4aa8-b541-176c0262de77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845440, "uuid": "49610bd9-ffa4-4505-b64f-28583ebf071d", "value": "90869089.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1499cf2-a93f-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647885129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647885129, "uuid": "4acc233b-b8e0-4076-8215-4a2c6aa94712", "comment": "Malware payload (RedLineStealer)", "value": "813e3167fad9fac636c116b816fe8113", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647885129, "uuid": "aef3a26d-a2c5-4bf5-933d-8e0b7cebd7bc", "comment": "Malware payload (RedLineStealer)", "value": "68e3fd94b1f30d96efcb7eb78a8157734aaa94498428be2413b96eb875e033b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647885129, "uuid": "6b8f6b30-d239-4775-a0bb-1f8a67fefb91", "comment": "Malware payload (RedLineStealer)", "value": "3dcbde3a4e5a60d3eb03e69f6c704b071df4cc60", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647885129, "uuid": "efa06c85-18f5-485b-8523-f07e1a7da782", "comment": "Malware payload (RedLineStealer)", "value": "360e58c2de03e1dd8e3275a94ed4ee3afc8c5ab24fcaa597462118e9ccb4b804817b1f894c891fee2216bf2e1cf61736", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647885129, "uuid": "6829c2e0-c6f0-40c7-b9c5-9d1b28019dbd", "value": "T1D494F11AA2F85766D0AA4FF11CF8A7F36561B5CBBC40E34C8409728C2667BD28D79D31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647885129, "uuid": "e3e54e13-8ca5-444f-9df3-e216ae8d7104", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647885129, "uuid": "91e525e3-c7dd-4990-add2-f0682b58e46a", "value": "12288:kfs4UgXkpb/a8PjoF2N4zkU9HesaMJcR/V:M00k17oF9zkU9HesId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647885129, "uuid": "6274d0c0-58bc-46ed-96da-fdf667e8c34f", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647885129, "uuid": "a82825c4-5c42-40c3-b1a4-a59b352cc4d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647885129, "uuid": "7b701a24-da83-4b3b-8cbe-eb07dc1b4f50", "value": "813e3167fad9fac636c116b816fe8113", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c41fc53c-a920-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647871873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647871873, "uuid": "c555a902-e6dc-40ab-b4d7-d306540da5b6", "comment": "Malware payload (AgentTesla)", "value": "b068ae30fdee1c15e5946fd39521dfcd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647871873, "uuid": "4b056ead-4a07-4520-aee6-70ec7c5c4f14", "comment": "Malware payload (AgentTesla)", "value": "693b0d41099cbc709eef38852db83041058d6351d86a9457ad0fe34b9e738c39", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647871873, "uuid": "c482aaf5-fffb-4b97-8135-7e65019033fd", "comment": "Malware payload (AgentTesla)", "value": "8349e24513f617e3d4c596353d9baa057afe8e55", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647871873, "uuid": "4f83c048-1b8c-4f51-89f1-e60c12d1cd78", "comment": "Malware payload (AgentTesla)", "value": "29c42d4782bef6eeb99c9dfd0e42d58d4cd99b364b5d0ddb0e9778b27452ed75334d33a868e5ba117c3984e4937be7aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647871873, "uuid": "1d85d138-eb12-4548-8f96-8fa1e3748ae8", "value": "T1DF45E0A021FF5EB5C17B67F1F851B7BA1EA17F08D301C2B9497368C6A2E5729343450A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647871873, "uuid": "c3e71fee-d260-4607-8885-99befc396dce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647871873, "uuid": "bca91373-1ac0-47bb-9dfc-d5993633e917", "value": "24576:d99l42m477eVWNNTBMmaToxIya6GsCmRTJULMwDWRkP:P02mASVWN41BKCmRTJgD2W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647871873, "uuid": "a0fd68a5-c28d-4533-aeb9-7dbe2308973a", "value": 1199104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647871873, "uuid": "92729b76-4959-448a-ba18-572a1be11b84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647871873, "uuid": "45af0684-1284-4a2b-9a49-2be9fd02781d", "value": "NOA and HBL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7fa2f24-a92c-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1647877087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877087, "uuid": "454b4579-6ff9-4cc5-8c87-9bf0d1d6cb39", "comment": "Malware payload (DCRat)", "value": "4e287af320bc81f985cb373f5c4a18e5", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877087, "uuid": "3945b7e8-3ece-4d89-8bfc-c00da43e2996", "comment": "Malware payload (DCRat)", "value": "6955cfaea5b8a5781a1a8bfa69d07350269c5ed723165a29034aa70aa71da38f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877087, "uuid": "96ae2869-8e8d-4bcb-8e8d-73805239f982", "comment": "Malware payload (DCRat)", "value": "aa27971372365d386d94d8e9286198d5604719b6", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877087, "uuid": "d3ffad50-f2b6-4152-8f7b-80173da000dd", "comment": "Malware payload (DCRat)", "value": "62dfc56aabd9dfbfed515e67f8046786cb12101167d7aca3568b0d493c156d0f1977def1578d3a9f7ea74bc600cb3dac", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877087, "uuid": "19a8a200-aea1-45d2-acd8-1376e70736f9", "value": "T1C4959EFCF2EB0CE3CC092AD444119DC78B345637A7AC44B8154769CD4667BE5A0A8EAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877087, "uuid": "53e40c0c-6e89-41ee-bc66-4fb36bf6ea1f", "value": "24576:y9gVOScvYg7z2bO5DWMHduf5VDmIjVM/K60iOLa:yp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647877087, "uuid": "7edd73bf-f9fb-491f-8f0c-459667b5d504", "value": 1911325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647877087, "uuid": "78ee10ec-7204-4112-bb40-4d2169146d2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877087, "uuid": "cc91e763-4ba0-46bf-8351-cd4ce99ea98b", "value": "4e287af320bc81f985cb373f5c4a18e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "811ab963-a8fe-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647857158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857158, "uuid": "637ce76c-7461-4642-a456-11395c30fa7d", "comment": "Malware payload (SnakeKeylogger)", "value": "dbd57e850844876b8118f5cd06fd28e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857158, "uuid": "e793191f-ab72-4083-8ff7-99b4302e83a8", "comment": "Malware payload (SnakeKeylogger)", "value": "697ebca509eee3c54c998cc178ba309955cda8ac996f1669366da9b7b8a64a08", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857158, "uuid": "84acace0-876a-4ad6-b61b-ee004fa56b85", "comment": "Malware payload (SnakeKeylogger)", "value": "bc5ec7b64103ed899059a7a7589e1cfc6a39b091", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857158, "uuid": "fd78cc17-5da7-428a-84d8-028bfcd880e5", "comment": "Malware payload (SnakeKeylogger)", "value": "db18ed901e07c3441145b12669192e8d94dad1d88020ce24b6198dd06994b7653f19687acb6f5a58893984afb808155a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857158, "uuid": "8c2adb5e-2cbe-448c-bd9b-7d87811ab277", "value": "T1016533D2D9AE5B82CD364BB3212086AEDF70D7D1AF58C338F9E13499254B370D28E615", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857158, "uuid": "2c815e45-3c96-4454-852d-6124c86b6027", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857158, "uuid": "3ab1341b-9a90-4bd8-98be-21977813f0d6", "value": "24576:DYjk1CZQI7+GI21Ha5PG9lrkiS8RomxmxlzdPhIEGuYQS8bZJB0bSmfy5pTs/i:QkwZl36FG9jmjzdPWEvtPWfyT8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647857158, "uuid": "53765b7c-9ed0-4ec8-9113-0df27835eca4", "value": 1532928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647857158, "uuid": "4ae762f2-d56a-4366-b78a-36eb37a1d80c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857158, "uuid": "228be88b-ddb5-463f-b24e-9f036e3072b9", "value": "dbd57e850844876b8118f5cd06fd28e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0651d5ed-a8d6-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647839772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647839772, "uuid": "542ce861-d401-4701-a238-8f6e74dee49c", "comment": "Malware payload (RedLineStealer)", "value": "f037b1551c0c592947cf3c42c26785e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647839772, "uuid": "9ced03c8-4ca4-4bf1-9790-4a5480cd89d7", "comment": "Malware payload (RedLineStealer)", "value": "697efd2047357081f70b698da5a259ab714a4827e440815b8e835d2decb5008a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647839772, "uuid": "9c9adadd-22b3-4f06-becf-61f03626e10d", "comment": "Malware payload (RedLineStealer)", "value": "10c46728541bcf1f953dfbb8daf7b6eb28a92894", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647839772, "uuid": "f8e20116-114f-43c0-8e86-e8dbfb120aa1", "comment": "Malware payload (RedLineStealer)", "value": "f55ff6384d013af785c94a684bd8f0ffe2ecde8ce7825b38cae969b8926be866bd228bb4ffd3dfc3795c87b2dea692ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647839772, "uuid": "f070495c-b114-4589-9dfa-5f4a43f89abd", "value": "T15294CF40B7A0C03DE5BB11F4797A93AD752E7EA15B2160CF22E66ADE16342D0ECB1317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647839772, "uuid": "da0500ab-6b48-4c09-9277-570aae7610e5", "value": "cbe2a3d9f5bb4fa7c1fbeb2b00df447c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647839772, "uuid": "240cb856-a084-4b66-9cbe-3822a3e23027", "value": "12288:AdPC51kOL3y4Qc6uuU/xnVuqHSk4iSm0g:es1NDmc6uuuxHS2Tx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647839772, "uuid": "f3429386-7200-40c6-95cb-616de4d95ee6", "value": 417792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647839772, "uuid": "8127f1fb-e861-4636-85f1-a866e3f3e8f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647839772, "uuid": "a1c5d7fa-ff91-452f-b417-b5dc8f8ff664", "value": "f037b1551c0c592947cf3c42c26785e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1951ba78-a8f7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647853977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647853977, "uuid": "83a6add8-12fc-4680-bbf0-00fedc003b7c", "comment": "Malware payload (Heodo)", "value": "cd7cfe886d136f3a71ca012cc498de23", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647853977, "uuid": "ac85e1a6-7e1f-4abb-b170-1d999c84d26d", "comment": "Malware payload (Heodo)", "value": "69e371bc83d8e92f6abaeed73289df032a951613044348d8e3413babac06de38", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647853977, "uuid": "c409aeda-87d0-4bb3-b486-9861c5748678", "comment": "Malware payload (Heodo)", "value": "f1663fcd189faf5fed66d578e784d34a096345e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647853977, "uuid": "288b649a-94ce-4fd0-8071-9e3601ba231c", "comment": "Malware payload (Heodo)", "value": "16e68ec8729b48ccdbb1c48d3bf66379f2f65d12c12e12de5d06f921981b94abd60216750423c0686acee7f9620df27b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647853977, "uuid": "9240d79b-c27d-4adb-bb22-36f11f1364f9", "value": "T1F9056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647853977, "uuid": "d6028e46-8aed-4c34-af2c-cadc6b8afb8a", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647853977, "uuid": "41ff1d9e-349a-4a4a-af3c-be6a95ce92bb", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/ro5CGNHrH2tZ+d+:gMV/ro5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647853977, "uuid": "8c903f16-94b7-49db-b24b-d803cc4a656d", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647853977, "uuid": "b64c35eb-3f4f-452d-8444-fe610caa75f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647853977, "uuid": "722ebb57-caa5-49d5-9e21-49e9166aed40", "value": "cd7cfe886d136f3a71ca012cc498de23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b65eee89-a942-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647886453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886453, "uuid": "82c873cd-7aff-4f73-a00b-ce18461d2d82", "comment": "Malware payload", "value": "3856eced9124629766b4c0c20d87b8f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886453, "uuid": "ba4c0016-f79d-4181-ae9c-3a6fb903116f", "comment": "Malware payload", "value": "69f5ce5a4c0fc120b1eb34c7dd87eda67b7848b7e242ea5c4a7b28f31e4b540d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886453, "uuid": "7551410d-a170-4e3b-b097-fad980e00771", "comment": "Malware payload", "value": "b1f9151ab5f79fefdb2d16ebe13d6d0ce66d6ada", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886453, "uuid": "b68b5bd2-0fa3-467d-ac41-f6d641b62301", "comment": "Malware payload", "value": "277f08c1222bf1487a4cd463c68d4dade62f540ee9f274d47b282e0ba8919de3486eaa1ab2048cff16c4b652386cb30c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886453, "uuid": "f5c49f65-db22-4c12-9f26-4e8a1d17bca2", "value": "T159832B5EEE963F93C8C5D97960B2F2AEC57E95202F0440F3DB95C5250ABE580E83281F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886453, "uuid": "3067cb0d-629b-4689-8d7c-623a69b4d4e4", "value": "c111a059e3e51988f180ecc486bdb091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886453, "uuid": "ee898307-e52f-4a00-8f39-943d18a093f8", "value": "384:mThLq/rcGi17xBs/pOW4rJhSTdsE70jhfak7HxFMwuUC:RT0Bs/pOnrydsE7fk7RFMwuUC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647886453, "uuid": "86635230-47dc-46c5-a45d-b843776f3ef7", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647886453, "uuid": "82fecb96-f260-4b3c-af24-6533df8562ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886453, "uuid": "26036ccb-91e2-469b-8507-a675ad849e20", "value": "SecuriteInfo.com.Trojan.GenericKD.39271822.6231.3891", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d78cead6-a8e2-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647845277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845277, "uuid": "b1e5d4c1-82df-48c2-be92-862a2633f52e", "comment": "Malware payload (RedLineStealer)", "value": "dc1fdecb1a2354ae27f9f866b6d92d7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845277, "uuid": "00cece64-16bc-4cdb-9f7c-11dd01f99e6e", "comment": "Malware payload (RedLineStealer)", "value": "6a482f6099fef61f46226e98eb8716e800762dd1bba8cfe5d90989b81ba554b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845277, "uuid": "e811ec6d-20c0-4db3-bfb0-e92174da79a7", "comment": "Malware payload (RedLineStealer)", "value": "bad28245c8aba947b21d3ed0837906c139d6bb8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845277, "uuid": "328b6ade-4a11-4f13-bcf1-201303af0501", "comment": "Malware payload (RedLineStealer)", "value": "ce13a9ed438b8bf9ce2484a7a8441b32c027d47a183facf9abe7d6fcee2c38ef272744b8d59167b2409b221018d8d528", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845277, "uuid": "4d44cb4c-26db-46f7-8075-63a14b14b849", "value": "T1083633BB2DB42D01E44C16717DBF74BE40CAE139D8EFA98EDB8AD5A8278443740719D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845277, "uuid": "34cbeafd-0d45-4f9b-9906-d9d1ea2b14a9", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845277, "uuid": "e346aded-3d86-482e-bfe5-ca21e603417b", "value": "98304:dN0/HlVhztP3ms9fypPA360ZSvqeAfx3g4AWa5ylBrCZPuyycgiyoJKbKhcP9u:0/lVZtP2Yy10UqeiaGrCFOc6bKh6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647845277, "uuid": "dee74dc4-6003-445c-afa9-706058eb5bec", "value": 4913664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647845277, "uuid": "c5f2c897-f387-44cb-8ad6-239a63410640", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845277, "uuid": "c9efef77-ee4c-4e77-bfed-f4a748c49cd1", "value": "85399878.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38127218-a959-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647896119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896119, "uuid": "3a6c77a9-a05a-4ca1-9d0b-b0bfd76f66c7", "comment": "Malware payload (Heodo)", "value": "2e187c01e1fce51b7e488db537423f9d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896119, "uuid": "e2fefd71-34a8-4552-b192-8e249884603e", "comment": "Malware payload (Heodo)", "value": "6a6a6c8cd52bc7fc213c43afce31d787133ea9154234859dda07d57040b05cca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896119, "uuid": "86a33e83-0a5c-4259-bb66-e9b7529bf15d", "comment": "Malware payload (Heodo)", "value": "790e8369de3a68d5398f9e9936998b2127d4e24a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896119, "uuid": "7b301f5a-65fd-410d-bdfa-acc7965000d7", "comment": "Malware payload (Heodo)", "value": "70c1a10097a68b156a49525b5169eebf0add07dc1fd674510b1583244e0882d0344ebf0353487187f3b8bf01cbf22a3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896119, "uuid": "e8cfda25-884f-4fd4-b2a6-01b62fd939e4", "value": "T173B43A11BC916832C36FAC7456073262588EE7F0DBD1F26FA3E0495C9A7C5E36624BC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896119, "uuid": "cdfdf7b5-743d-4f44-9c18-be236cb11b2d", "value": "14e6ae8d1400b6271725b3f01025b85e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896119, "uuid": "ba9ab48d-58f2-42d5-b91c-a9f10e41e054", "value": "6144:VikzyaB9eoCyx/mEhHB5RYSJ/xK+qiCjzQNPj79GkqbscgCG5qH6scI:VNnCGmyHB5SSJpN0zQN39GkUGQSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647896119, "uuid": "a85720c5-930e-4141-ae31-73c110c3b51b", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647896119, "uuid": "e54f9cb3-2026-4fde-841d-504aafa13133", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896119, "uuid": "ba61c536-0012-472f-9d4d-3c2ee622d124", "value": "2e187c01e1fce51b7e488db537423f9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc9ae5d8-a8f1-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1647851728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851728, "uuid": "e28ed007-a6af-4160-a1e7-e6f1b897fab3", "comment": "Malware payload (RemcosRAT)", "value": "99e61a30dfa834f16ee89c3caf559b45", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851728, "uuid": "6be64a83-f6da-4b7f-95ca-2307aafb728c", "comment": "Malware payload (RemcosRAT)", "value": "6a7619f616afe8a62c665e42901c8f4776930a17563ab8aa53a4a1e36e59e610", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851728, "uuid": "d650f391-292f-4f6a-b611-39aa650ad1d1", "comment": "Malware payload (RemcosRAT)", "value": "ddeea86fbb2e4f1845ad450905c6170aa8658289", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851728, "uuid": "3da44f57-f98d-48bb-b533-83186bf9ab4f", "comment": "Malware payload (RemcosRAT)", "value": "19a659bb81b5a7519034d8ce5b5fca2fc85fd76d7279791f5518fb172e62b2c78556829b74dcb14ec0def9edb14fd70a", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851728, "uuid": "f923523c-0151-408a-99f5-ab1c6d3b749a", "value": "T13151014E754B64A852362EB2D90F041D967347A7B57842A0390D8BDACE361BCE2C686D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851728, "uuid": "fe440aa7-5d9b-4d99-8b10-a44a339ddce2", "value": "48:5djWu7/ftCz2O0t+nwFSDswBJv1rS30N9uSmve1of0Bdg/:y4tCzp0t8BswBJv1rS3q8Smuofz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851728, "uuid": "b08167ad-2925-4d10-b542-665b0d9b88ff", "value": 2542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851728, "uuid": "228c0d20-aa1d-4429-a8ac-6ceb0f444d0f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851728, "uuid": "f62215aa-4d00-40c5-afa2-32314e6c4392", "value": "Protected Client.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58784b8f-a8e8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647847641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647847641, "uuid": "acaaf384-d35a-4aab-8f6f-d62ae30deda6", "comment": "Malware payload (AgentTesla)", "value": "b41b2ec25d6d736916931859074a676e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647847641, "uuid": "c70e8be6-e9b7-45b1-a4c8-0d7afface4b2", "comment": "Malware payload (AgentTesla)", "value": "6aab911506a74178cc79f3323480adb05445e744728515f047246ecf609a4c91", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647847641, "uuid": "4000a039-b3f1-4136-9972-cb64e49380d9", "comment": "Malware payload (AgentTesla)", "value": "0c6b84ee7ef48749f1757461c76724651a27a3b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647847641, "uuid": "8be956b1-3262-4275-ae5b-f1467ee1b4aa", "comment": "Malware payload (AgentTesla)", "value": "25e2ec0623f5ecf317db0529e4ecae18639f78940a7a8c58f41522b828fb654611fc413cfc2687811eb0d2b3b37595c5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647847641, "uuid": "dbeee121-00e6-464e-94c3-551e878ee20c", "value": "T151718EE3889D9E030D5E0A22F654D94654222F78AC73D8795C170BBAD604C0CF58D1D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647847641, "uuid": "c31be82d-ec00-49c1-8081-f6b566b67c63", "value": "96:VULbC++h1mBmv2lA1VsVyrAlt/D8gMgc2YuC1V:iXC+7mLuCEDKgc2eV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647847641, "uuid": "01f15aa1-5a5d-47dd-9f3e-d5ccf1747ee5", "value": 3693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647847641, "uuid": "f208245f-c55f-4c02-a884-d2b30791828b", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647847641, "uuid": "3378c41a-3158-445e-960e-b4b6f6819860", "value": "DHL Delivery_BL.pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "556c9432-a8e0-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647844200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844200, "uuid": "79d8cb79-9b2c-481b-af33-0ce453c030b1", "comment": "Malware payload (RedLineStealer)", "value": "099e5b3f10e34e9fe420adb2e3ecb5be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844200, "uuid": "9dac6d83-069c-4890-8dc7-431365143380", "comment": "Malware payload (RedLineStealer)", "value": "6ab870b8508984b5b6b2739cb07f84b3dc3205c0fd7fd274d8965b0725eb9b41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844200, "uuid": "8dfb22da-db7c-4a07-9df6-a6deafe7e4bd", "comment": "Malware payload (RedLineStealer)", "value": "24773568141d221c9f271bd62fe7f8dc557b6dde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844200, "uuid": "96af331a-234f-4a17-894b-2fc28555d971", "comment": "Malware payload (RedLineStealer)", "value": "69f90884d3965a2dcf041ccec9c8e532604e698aac5c57f9ee1a6d8e77be90cd951404f770f9b08f30a0ce7d794c953e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844200, "uuid": "758ba068-36da-439e-a033-6780cdcacad8", "value": "T14F3633EE44D4E6BAE6019CF41AF68AE4F9B7735C88411411D0F6CD09EFECC9806AD53A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844200, "uuid": "f33abf25-ec1e-4e3c-af40-f9e0849fd28a", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844200, "uuid": "22e037bf-04df-4c02-bbd9-ceb2a286f175", "value": "98304:FDiiHqPBR8WmkUMfIlu4tlvbM6x5Bukf05fwvnF8SInuRRyrArSK:FmNTYtlnxr46vnFbrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647844200, "uuid": "b290c7cc-e514-4f2b-83b5-0d0f3ac28a1f", "value": 4897072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647844200, "uuid": "e4a26bec-28d1-4d75-b178-3b36435462aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844200, "uuid": "72ec4dbb-9912-484c-a930-53b1a88e7ca3", "value": "36122942.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfd56acb-a8f4-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647852968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852968, "uuid": "0a3de47f-0e18-46ca-8f73-c362fc518742", "comment": "Malware payload (Formbook)", "value": "3a0e7d31754518728d12ba1c3135ab25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852968, "uuid": "2f61df5b-4735-4eed-a4a2-a823281b21e3", "comment": "Malware payload (Formbook)", "value": "6ad6432df32325521d773d9f2f127388743036ec0b0580ef967e88ccc0b38e67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852968, "uuid": "e187845f-4b81-4434-8b44-03db3d46e6bd", "comment": "Malware payload (Formbook)", "value": "92ce72234ba5ac014ac58f6136ff9e60d9f39ab0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852968, "uuid": "77aa2344-0ee7-44b6-af4a-55f2f78c9553", "comment": "Malware payload (Formbook)", "value": "57401b404d9bcb9981d5b04ab22ec593464259666dd0444b8dc704dbc1f1e3edafead82ba8b4e618d3fe7ccc8ad35b1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852968, "uuid": "981b996d-9070-4014-87c1-91ea4de079dd", "value": "T125341207B8C067B3D6844DB146F3E779C7B363D85245679B8BB4AEAE1EB00D349143A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852968, "uuid": "b4b8afa2-cda8-4f57-a019-f5e8cfd029d4", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852968, "uuid": "3a32622b-9229-4b5a-9714-9c790d218fb9", "value": "6144:rGiGCjKhCmnaXv94siIt1i1/xrprYJ8wSHPi0wqkRLy:KCmkmaXv94PIt1k/xrtYJKHPVwdLy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647852968, "uuid": "4d86944b-99e4-4763-a25f-987ae6680258", "value": 247207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647852968, "uuid": "946fde68-e513-46d7-95a8-12fbfaae680f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852968, "uuid": "913f93c2-c601-4949-a865-afe627419b90", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f1bdeb-a8e8-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647847606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647847606, "uuid": "f83fbaa3-0ec7-4604-bade-67ef4e717326", "comment": "Malware payload (Formbook)", "value": "f0dcace3bc90d5b4a5a5c941d7767db0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647847606, "uuid": "32714473-2fd2-4efa-9f23-17849779b03a", "comment": "Malware payload (Formbook)", "value": "6ae248dc5b8ae4aa77928b4847ebd4f815d8d67d19e6deb50e2ee62cac61ea34", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647847606, "uuid": "5ad36eea-666c-4733-b97c-dbe2a529a8d2", "comment": "Malware payload (Formbook)", "value": "ed112eb027d6e1e722ed45351df10a8c883090d1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647847606, "uuid": "5f6b348f-9305-4e96-8a6c-0b1ab5cf735a", "comment": "Malware payload (Formbook)", "value": "d3cc5538f3ec751a02cf3b458a9df1251389170766cf79a2bd7337c9564533bf10515b988299f56a8c83fd3e02bed337", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647847606, "uuid": "2f864bf4-28bf-4eae-9e2c-ad033c19da25", "value": "T1A6B4239B58801D4A3012379F4DBB172F801E50B13057AFF9BEAAB8D2379F66B0D93954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647847606, "uuid": "6abc515e-af14-4b11-b566-6c766be2e6ac", "value": "12288:fBIu2gkPLUhyoN8+eQU8uYPCf1xO03Kp94pH:Wa8oNyioKH4h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647847606, "uuid": "3214a1b1-4217-4414-b417-aa47a7c2a3bc", "value": 526946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647847606, "uuid": "27d01998-fd18-42da-b729-951111317030", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647847606, "uuid": "b549a4dd-ab38-4dbc-aade-e0a8ca5e8689", "value": "MJ 00000178263783400.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53acf0d5-a8f0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647851069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851069, "uuid": "650d2941-28b1-48d3-b9e6-a2e39a71336e", "comment": "Malware payload (Heodo)", "value": "d4d598764a1f2ff1fa14c9ba309b033f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851069, "uuid": "b8c8d596-f405-4671-9656-6c0e7650744f", "comment": "Malware payload (Heodo)", "value": "6ae895fb32c00e14109ea238051687a3f8809411143d634860ed435b2e7f16ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851069, "uuid": "53040097-59b9-472b-b01f-ec9c08dc6bb2", "comment": "Malware payload (Heodo)", "value": "95e7df4a7dbf10c49068e7bc92baf79185f38892", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851069, "uuid": "ba36cb49-b293-45c8-b65e-d858c2a27a25", "comment": "Malware payload (Heodo)", "value": "5b607034d3f92ec909c2bfaa9472a4b4ade64e67686112fd75591d1a90cb1583afaeaf554a882462875c4162f5debc79", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851069, "uuid": "29ccba40-bf16-4bf2-9b9b-d11f09bc39c8", "value": "T140056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851069, "uuid": "71a30a9c-22d0-4b1d-b9f7-ed588a55e10b", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851069, "uuid": "5442aaa4-ed13-446b-9a78-f37696edfa63", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rb5CGNHrH2tZ+d+:gMV/rb5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851069, "uuid": "c8eba1f8-c0c9-4136-8766-7f1aa0a7ff75", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851069, "uuid": "28fd7243-e7fb-4f0b-bfe5-2fdc06292d54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851069, "uuid": "579e67d2-ee4e-43a2-9a17-692d5e63048f", "value": "d4d598764a1f2ff1fa14c9ba309b033f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f143dc-a90f-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647864548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864548, "uuid": "3a7f42fb-e78b-41d6-81be-2f9d78d9bee8", "comment": "Malware payload (RedLineStealer)", "value": "31af2279e8199392b543d39d8c411446", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864548, "uuid": "f90f0f88-dac2-4ddf-8c1c-0d00f402ae32", "comment": "Malware payload (RedLineStealer)", "value": "6b93e83b794d2129fdf6e639a522305651c614795abf593698bd9541a909f7a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864548, "uuid": "23b13493-e59f-4fb1-be53-54dc0836e37c", "comment": "Malware payload (RedLineStealer)", "value": "43ed71fb231d29cbd4a6075da1f9519ea0fd87a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864548, "uuid": "da3948e7-7040-43e5-af26-90da02e53836", "comment": "Malware payload (RedLineStealer)", "value": "f0616b3a5c3d4ef0c661be2a7f109e92e14a18ec87794acac8809663b0fd8ea0433c1d4085fbe10f288f5dce137a0bb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864548, "uuid": "4e219568-d1d0-4b6d-b767-010f6f88df86", "value": "T15EC423F33240E91FC34A36F0C67017CAA9AB96D4D6A47283B2BF5D879B5C0E6D16C190", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864548, "uuid": "9f8a9f88-547c-4156-914f-bc72e71b3ae3", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864548, "uuid": "702e6c80-ba76-4c9d-b1f3-3a197d8a50dc", "value": "12288:dic8PeYfWwv47Ld+z6cQS03ULaHNqrxlKIQNowcd/BlZk8gyyv:dl16idY6ckEaHNYK3Jcd5lgF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647864548, "uuid": "47e6da77-5156-4d3f-9449-dcad050491d3", "value": 565760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647864548, "uuid": "57697edb-09de-4905-ba11-138cc937dfa2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864548, "uuid": "4e9acb91-c1a7-42f7-81c6-ca25190c0634", "value": "New fortnite cheat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a558a7f1-a90b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647862802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647862802, "uuid": "9e2b077d-528e-4f2d-bb12-2b59fe7dbab6", "comment": "Malware payload (Formbook)", "value": "b2b555a4857d7e86a80da55f1c058b79", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647862802, "uuid": "9b0cbf85-ca81-4bfc-b548-b5a751781d90", "comment": "Malware payload (Formbook)", "value": "6bcccc3de5b157d19a178269d21bdd75258dc9b986fdae7173d43594ddcb3259", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647862802, "uuid": "a2ec68e9-5254-459d-a497-a76431405c92", "comment": "Malware payload (Formbook)", "value": "420c6f2410fb968bb7d27d7947a1ff9a0dfda2df", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647862802, "uuid": "edcaf60a-f0a1-46cc-beaa-511c71215cff", "comment": "Malware payload (Formbook)", "value": "eb0ae79dc2d153f94f842907200f8b5abd1a746a17ac5b36b41ff440d06b7caff5d55e264c92a5d918af62d67351a78f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647862802, "uuid": "146dc089-339e-4323-a08f-2c0c4fac7b23", "value": "T1699533A4F3322026DBC2C1F9D585B041E08F636FA029A5DE3D777EA2FB6D89174A4117", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647862802, "uuid": "500689cf-9a55-47a8-a4a7-4f8689ec41d5", "value": "49152:4zgKzXgZl1YjRwIKkXAt/SDnTmmmx0tnWnxKo7:4zgueyjRw4QSnmmmQWB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647862802, "uuid": "1749ab73-2f83-4731-8f3b-71aa7a87d7ea", "value": 1899565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647862802, "uuid": "3775ed28-222c-4beb-922f-cca422c8ac84", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647862802, "uuid": "e55ad0de-df2a-4f0d-9722-4516677bc055", "value": "Proforma Invoice No - 451 & 460.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d575f05-a8e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647848105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848105, "uuid": "315b1d76-0fba-4d9c-9db0-d460cea3f8ed", "comment": "Malware payload (Mirai)", "value": "a0e4962b59c8e8f834201812f3852615", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848105, "uuid": "6b99db9d-d5a1-4581-b0e8-af2bf30f19cb", "comment": "Malware payload (Mirai)", "value": "6bd32f58d54ff518ab2e141685b4d91780c50b8295c08bf2d667762c4166191a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848105, "uuid": "95772af2-8da1-42dc-9a90-0d98552f2460", "comment": "Malware payload (Mirai)", "value": "98c3b5770e64c7692699fd9bcebe604c2a468c6d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848105, "uuid": "cbc37411-e3f9-44e3-a1f8-16ebfa29dea1", "comment": "Malware payload (Mirai)", "value": "3fc2ec5f53a05d7942dd5cc4bea45d675434718eb7438b06911d52813909e18e7c3a0b20abd4c2047e8069c7580ac2d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647848105, "uuid": "119066b4-fb02-4065-b424-b081c3165262", "value": "T136B31993F801DEA2F40EAA7605D70721B630FB760F432A7263577966AE362D53427F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647848105, "uuid": "b0e83c9a-303c-476d-a238-832d63600bcc", "value": "3072:0ZXI+LeYgTCiRGbz8yEmFJgJ3bqQ1Z5mFZ09DRAoQfgm:0ZXIMeYgTCmFyExJ3bqQ13mFZ09DRAou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647848105, "uuid": "0735a529-401f-429d-b710-a4e24b59b2d4", "value": 109373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647848105, "uuid": "83411fff-a9f1-480c-a3cc-50651d29dc0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647848105, "uuid": "756d52c8-aec0-4ee1-9c04-8716da143b56", "value": "a0e4962b59c8e8f834201812f3852615", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e16ab333-a968-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647902846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647902846, "uuid": "d3118495-6354-477b-8bc0-abed40538c36", "comment": "Malware payload (RedLineStealer)", "value": "66f41de52c2448d6ef179484fdbb766b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647902846, "uuid": "d91fdac2-cad9-46f8-bbee-97e039f0dff9", "comment": "Malware payload (RedLineStealer)", "value": "6cb1b804e1b48f6a4e8b1f4ecf00d4cbefdf96c19ea2aef5f3aea04a55c51d5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647902846, "uuid": "39256c25-e5f1-4ceb-b1e2-8abd4cd8b5ba", "comment": "Malware payload (RedLineStealer)", "value": "92186af78daef0556ab490bd8a471e89de851127", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647902846, "uuid": "496a912f-1fe0-4f47-8d82-6217e6c2f12f", "comment": "Malware payload (RedLineStealer)", "value": "efda77e35587e499523f17046700a7284036e0b632385d3c435b146cc340db542fee04ab43dbd0d42d68a7b92b47a08a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647902846, "uuid": "33cc70b5-f37f-4b2c-ab2a-3dc22e94bef1", "value": "T19184C010BBA0C035F1B702F8897A936CB53E7AA15B2561CB22D56BEE16357E0EC71347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647902846, "uuid": "2fc6a2d3-ddab-4ee7-a0d9-dc2f6830c68f", "value": "42499a002b9d8635fd26126765c4da68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647902846, "uuid": "beb190ff-68cd-4493-98c0-31e9adf05580", "value": "6144:U7wq86SHkpU4+6fVqF+RceFL3gfxgh6sZtk7G9joRgK0oV8888X9o:Uf86SHkpU4+SSCceJ3V68j5K0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647902846, "uuid": "c785333f-202e-4c85-ad0d-bc475ca7d131", "value": 375808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647902846, "uuid": "2197c3f3-3398-418e-a181-cda3cdb23243", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647902846, "uuid": "4d39fa24-c346-4f35-a7cb-68ee374884ea", "value": "66f41de52c2448d6ef179484fdbb766b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea6b83b9-a92b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647876662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876662, "uuid": "6b6f8ea5-069a-468d-938f-39b920073084", "comment": "Malware payload (Mirai)", "value": "b8def72a0bab2724819319cdf0a58f0c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876662, "uuid": "b6d86aca-efed-4845-b1c5-8ce4b8701a50", "comment": "Malware payload (Mirai)", "value": "6d12064acd64d032f30d036cc1c122fe1a8609949c4399f030cd54ce31f4397b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876662, "uuid": "dd1539e0-789d-428e-a172-f0fce86bfb8c", "comment": "Malware payload (Mirai)", "value": "b0532eb745526308719a1a158c262337f0faadbd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876662, "uuid": "fb5e3c9e-0bcb-4668-ae30-83096937ba62", "comment": "Malware payload (Mirai)", "value": "803981ad06a9c06614b182c9994452a62a67ef355c486fbb7fccc171875af051d729bed9acd1c68fd49613c143b07acc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876662, "uuid": "a963345f-3980-41a2-a2fc-2f3ac3ef3913", "value": "T13ED2E11251051C55CCE71936AC3FBA0C0A28164EC2AC99F6CFD869296EA1F63B774396", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876662, "uuid": "18c109ae-4e5a-4db7-a01a-d3901ee42f55", "value": "768:tyq/1MgZnPAhEvQTn38TOB5qZBnHaARv27eEuYVnbcuyD7Uryqgb4:tyq/1rP4r1B4Pzv275uYVnouy8mqgb4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647876662, "uuid": "4a4547e0-4956-452e-bec9-442ddc214aca", "value": 29516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647876662, "uuid": "84b1dfac-bd9d-4264-911c-cb652a47c73e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876662, "uuid": "00690bd1-b76e-4546-ad05-a160e49fe022", "value": "b8def72a0bab2724819319cdf0a58f0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6aa0acd-a942-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647886480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886480, "uuid": "ebb5e880-e6fe-46eb-8bbe-b7e8a9332a61", "comment": "Malware payload (RedLineStealer)", "value": "fef6956a34cd30d4bdca2f5f98ee669d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886480, "uuid": "e47b5403-1920-4f6b-a8e1-e1b56c07cad4", "comment": "Malware payload (RedLineStealer)", "value": "6d24f1f936020c8a6359ec2c5ec438589ad50630eb56d3630f871ac8f657db72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886480, "uuid": "d746d4eb-2be2-461e-ae5e-4c32d57acd91", "comment": "Malware payload (RedLineStealer)", "value": "3917d272d4a40125cc408ec858a15d52658803df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886480, "uuid": "ab337b1e-7671-4e59-8e26-c30b1d166fac", "comment": "Malware payload (RedLineStealer)", "value": "1afc26fa6c14a707f48a2a51fca2e8272ce85badc78ad043431b6b2d6579fef02ad54ae71e6cdaaa6f25d03134e4faa1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886480, "uuid": "93212d01-4d0d-438c-bf92-d63060c3f676", "value": "T1CA163329CA80BE4DC455237748031D768883488DED5CF06F498F6D73BEA7837D6A4A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886480, "uuid": "adb4e23b-9e30-4b72-82ba-e67a311153f6", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886480, "uuid": "fc4055b9-8887-4f1d-a5ed-0b7aef94685f", "value": "98304:KINSqU0V5TgDJNN3UQ/x3CwgTTToSfwBwBdNYGVUPSLA4vHql:CmV54Jv3dmPT7wKBdCGCwS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647886480, "uuid": "42d7d0d5-eebb-4e65-85e4-50ccb0fac2ad", "value": 4130816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647886480, "uuid": "05e0b7c8-0d5e-4dea-9c06-a188fed360c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886480, "uuid": "4d4d84b7-23d4-4e27-a0c8-ff9e9ca6d574", "value": "SecuriteInfo.com.Trojan.PWS.Steam.27023.30430.2487", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dab80c5-a8f7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647853984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647853984, "uuid": "018ff74e-9773-48ff-adac-72cf39337914", "comment": "Malware payload (Heodo)", "value": "59ab8528b94f795868e7a792267a9453", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647853984, "uuid": "ba4bdf66-9e58-416c-af18-1c802258b1b1", "comment": "Malware payload (Heodo)", "value": "6d2b35ef3f6a23079134ebb43230995df5c41a27d8ebb9f862e0ec9ab9a1f467", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647853984, "uuid": "af0edd72-9aa1-41a8-be79-b40c7ebddc2f", "comment": "Malware payload (Heodo)", "value": "cfadf1cc845a9905809d21710e0ea2025c5cd26a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647853984, "uuid": "a8ecba50-1c29-459b-afd9-d5e6f1cb1e19", "comment": "Malware payload (Heodo)", "value": "26677177b3426d7e55c97b019f4f888cd565fda65ed60f8455dd085be0fa4c8da8af90f678691924e37bec630961abf8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647853984, "uuid": "b544f804-d62d-40ec-8b01-96f0955ef04a", "value": "T1D1056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647853984, "uuid": "4fe1b194-97aa-4122-9dff-90e65e8978f6", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647853984, "uuid": "7951a508-2619-46be-a25d-a08843f9e1eb", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/r+5CGNHrH2tZ+d+:gMV/r+5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647853984, "uuid": "d538c78b-0eb0-469e-9745-15c56b7b7064", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647853984, "uuid": "bc5a2fb7-f4e3-45d0-8604-9da1ca7f5a3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647853984, "uuid": "4f6f6621-99fb-4835-91ec-4730b62ed08b", "value": "59ab8528b94f795868e7a792267a9453", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad4f7fe-a8e0-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1647844101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844101, "uuid": "6658b464-bdfd-4790-868c-190522dd1a59", "comment": "Malware payload (AsyncRAT)", "value": "914d436bfc9a42a53b68696135d0be58", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844101, "uuid": "ba8ae301-3222-48bb-af48-465db62ce9b8", "comment": "Malware payload (AsyncRAT)", "value": "6d76ee6d63107ef193f89c07ece39e9eb75fb99f0c08e1fe516b8a85c3e4c5c4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844101, "uuid": "3dec394f-46c5-4a6f-b095-df56cbc81522", "comment": "Malware payload (AsyncRAT)", "value": "b1d661a00395b15dd5c3f67aab7497b983d02150", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844101, "uuid": "a23604c2-6a80-400c-b46f-d9bce7f5af16", "comment": "Malware payload (AsyncRAT)", "value": "164c12a9bf2a8ab18bd5c357d7fe1c7798024bd85c4532b2045c4bd8ad9dac544368beae81a052f7de9135b954887d34", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844101, "uuid": "b5f69444-9573-43ab-93af-df846eb206af", "value": "T16EE40214581CD737C5682331C1630AF36BB89D13D854F25FBB41BE89BC79B1A68F8A86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844101, "uuid": "907d091f-9bcd-44f3-9f51-ace42ba4158a", "value": "6144:sqBQK6ZNZ949FuPxnaq+CEN3WyOisUVuKdn/yykYAGuDUWBgO1ClKIzl+JqM:srK6ZNZm9Yx9u3POa/yyk3GulBAl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647844101, "uuid": "84e29764-9a0c-4174-ab8a-dd900d7a8470", "value": 706048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647844101, "uuid": "d336b09b-111b-4363-b052-2e207f358a8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844101, "uuid": "cacd70b7-a579-4c7a-9163-d3c3d91243b9", "value": "34505151.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5efdd7e6-a900-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647857960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857960, "uuid": "50ccc4f2-9e0d-4be3-82f8-c51aaf157636", "comment": "Malware payload (Formbook)", "value": "f92728aa3926d53962f7511d8efd0cd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857960, "uuid": "6aafb712-b845-402c-af91-58941fb1a40d", "comment": "Malware payload (Formbook)", "value": "6dc793d16688060c0db0592784fedaac1163fcc195cd2cb461115d69d17ac3ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857960, "uuid": "0612df7a-d92d-40a3-8ced-cf5460417ea5", "comment": "Malware payload (Formbook)", "value": "f446f1470282b28d0a3c83080f5b9792713bc693", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857960, "uuid": "3fa74a44-9be4-4aa9-8af4-c44f9ef10071", "comment": "Malware payload (Formbook)", "value": "c1ff22e68b6699872d794c347bf8959b29187e600b4ff09542e41ffed5359dcc3f73caaa74976f60cdb4c4b162f453e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857960, "uuid": "4fb0d97b-aaa0-40d9-837c-2c285d3b38cd", "value": "T1F635AE66F3A05877C47726384D1B56A59E3ABE002D79CC8A3BF55D0C1FF86817D2A283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857960, "uuid": "984aeac4-483a-42fe-9dd8-9e639f790e20", "value": "ecda77ba4b20deffbdfcdb24b1b9910f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857960, "uuid": "c6acbb7b-06c7-48d2-a793-0ad7e1717f28", "value": "24576:PolcmxDQ6vSWIqAk3OOJDnVinDHCP9iWvjXf:PA2J9OpVinDiP9is", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647857960, "uuid": "b30586bd-2c95-433e-bdd6-1edf0841bbc5", "value": 1065472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647857960, "uuid": "02733744-57f8-4ae1-b4c2-97aeaf49f366", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857960, "uuid": "b8f91f92-7170-4d82-a75d-1802cee4b95c", "value": "FedEx's AWB#3366674038005.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8daee728-a8fd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647856749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647856749, "uuid": "2aed8813-402e-4610-bb18-cd951042a528", "comment": "Malware payload", "value": "81a3b30c136b2e84c42828354f1b4ebc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "syss", "colour": "#AA18E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647856749, "uuid": "4414711a-226e-45b7-8f61-9a132702604e", "comment": "Malware payload", "value": "6ddc004fa65f2e9d0dc5b74ee6744d9cfbe5d4df174b2d14522a49db0ebd7691", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "syss", "colour": "#AA18E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647856749, "uuid": "501baf10-e0c3-4444-ac18-d68dee4468d3", "comment": "Malware payload", "value": "75cdd05be6e4188bf2c5f9c901246b8a37d694c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "syss", "colour": "#AA18E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647856749, "uuid": "78b853dd-be65-4c6e-be86-e50d7c22a175", "comment": "Malware payload", "value": "a325c6a1057ff241a166ca6626eba920299f7be508f2723eabb5530767383cb42886ca9eb91619ddefc0f04254e39d39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "syss", "colour": "#AA18E7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647856749, "uuid": "cad63121-4ca1-4665-b5a7-bf86a06058be", "value": "T12B1408E2ABF16CB1F0A22176BC50B13CB7EB7D089D2055299B5BE50D3D298C115ADF0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647856749, "uuid": "2de1249f-5441-4db6-8e50-9845f1b7b303", "value": "26ea1b45766fe26f9c40750d36f4cf7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647856749, "uuid": "e5ed52da-8e1d-4902-ae10-b040535fbc04", "value": "3072:+JVD1zx0HrJvtuKm8wVKQ3+nBgBDuQQID3RjfpbYMiTWNLkkN9:8WFvSH5LQ+hjf5YMuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647856749, "uuid": "696b1b88-acb6-4025-adb8-564a9bdaf3eb", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647856749, "uuid": "b7eb4c4d-1587-49c3-b5e1-e9edf46b9365", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647856749, "uuid": "2a8ec44c-5119-425d-9121-e0dfec88319b", "value": "cache_mxrs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4ab788b-a942-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647886450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886450, "uuid": "15697fa7-a8a0-4111-b700-22f470788924", "comment": "Malware payload", "value": "3b802a88524bc2e04d6cba6b7f51e756", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886450, "uuid": "f0395078-cdca-43cc-bd67-260e9207581f", "comment": "Malware payload", "value": "6de745b9931dcc78905b108a9c6d60fe6cb1f1578400f1bc46894c2bff551023", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886450, "uuid": "929c85ce-83e3-4ae5-9f15-4839e338127d", "comment": "Malware payload", "value": "58150f769af8399b40d7af5d77da499484464c04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886450, "uuid": "066da69d-1329-443a-855f-1a76237207c5", "comment": "Malware payload", "value": "0b658c7a7381ec83fa625b37d5ff990c610e2ac9b286ae8cbc6a15a7136b9881926d98d902fb876c1f850181ed0d13c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886450, "uuid": "cdd80b48-b779-4714-80e2-64ad49f6dcf5", "value": "T1580623997218B9EED3A3D836CE580CB07BA0B976572F860F504772BDD92D446CF344A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886450, "uuid": "9ea7428d-55d0-435d-997a-9e3aeaba2d00", "value": "98304:pTsM6GGDZmB5lPcvSuUOG46d2i7LFueopsgQR8FA9coM3rCMvkj/Kx:pT4GGDZmpcPUO/6Ui7LHoegQRgAioMOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647886450, "uuid": "ec6e7bbd-2345-444b-9e8c-5100e2d5777c", "value": 3867136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647886450, "uuid": "412ee7b6-8d15-4fbb-ba38-d32d03f3ec7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886450, "uuid": "f72df326-0ced-4de0-8de5-8c3b0c9a1b7e", "value": "SecuriteInfo.com.Trojan.GenericKD.47202694.15414.13598", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "456d67d5-a8e3-11ec-9275-42010a9c0029", "comment": "Malware payload (Babadeda)", "timestamp": 1647845461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845461, "uuid": "3ef77d97-c736-4465-9b53-d8357ba648c9", "comment": "Malware payload (Babadeda)", "value": "0572dadb863614d866f14d0c6afaf2f8", "object_relation": "md5", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845461, "uuid": "16a81ea5-3e90-4ddf-ba9c-450129f44d1d", "comment": "Malware payload (Babadeda)", "value": "6e34f951634493ec7a71e5c3418ed7d973ffc87351a5459722e04016c94b1471", "object_relation": "sha256", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845461, "uuid": "bbf6d849-b79e-44be-9da3-16375e6e906f", "comment": "Malware payload (Babadeda)", "value": "f5f6c26e8c88935bddd0fd7ebd63368814eabe9d", "object_relation": "sha1", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845461, "uuid": "f8817241-8852-49db-b1c0-f43980e8b0be", "comment": "Malware payload (Babadeda)", "value": "273685aeaddfaf656544b98a90e948593f5b578487c4be54bd447dfcea70f4ad8e21d967e1b2398e4d1aa3829fbe3fbc", "object_relation": "sha3-384", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845461, "uuid": "cc8d4128-b80f-42d4-97ee-d1f30a4213d9", "value": "T157740245F6E340F6FAE2067110A9B37BA33566349B24A8D7C34C3C429953AC09E793F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845461, "uuid": "ab04f62f-80ed-4f10-9d51-4e4296b919b5", "value": "5877688b4859ffd051f6be3b8e0cd533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845461, "uuid": "ad6630c9-97c9-4872-8a64-7291837420f7", "value": "6144:bldk1cWQRNTB4l+8kJkbl+EFs1lVJ7+wjLzylPagB1UvnpNucpZ6/DAlcAgp:bcv0NTuV1i1Bywj6lv4hpZ0DAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647845461, "uuid": "9c1b33ed-61c0-48ad-a923-88f092b197d4", "value": 355328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647845461, "uuid": "6c0afefd-93a4-4819-9407-7a872eb953a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845461, "uuid": "aec8e8a3-265a-41f6-981d-5f9e5d99d8e8", "value": "80100072.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b59a620-a93c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647883696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647883696, "uuid": "9d5725f4-05ac-4f2a-b235-9820ff233b12", "comment": "Malware payload (AgentTesla)", "value": "4824c1060ed7e21b3828680177d8e1f9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647883696, "uuid": "c978aad0-4560-4a3a-85be-afd591950def", "comment": "Malware payload (AgentTesla)", "value": "6e4fe9b9b0cffb16b141b9f53cbb49645a67fb1ff7f10d38b63b75f05423ffa8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647883696, "uuid": "4c085964-91a5-4f17-a74a-9e88939512e3", "comment": "Malware payload (AgentTesla)", "value": "e553f328e2fe74b33062e9b16e2ad9f5f64cf7a9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647883696, "uuid": "73e7d956-5587-4dc5-bf2c-110a3121d752", "comment": "Malware payload (AgentTesla)", "value": "3c29e334022e0124f0a890aa65830b503fa74dce2e56f23c8c54ce851b08968070bfe65a9b8cad503c3231e19bb73407", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647883696, "uuid": "9151374f-ef2d-44e0-b5b5-d6fb71b716f2", "value": "T1E005BEC435499F1ED2572FB1BFB6D4A76EB626B6D194A8CFFE1C2CA00193E42611031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647883696, "uuid": "201d53d8-004a-48d3-9ce5-6968173e6941", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647883696, "uuid": "8f2d3f6d-e599-47a8-ae83-e8b576c4cf76", "value": "24576:eBVRF3WbHfWk5HxXV0bWnayzRUS/mT/uV+Pn:epF3xkJDxiLDn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647883696, "uuid": "6aec5689-7573-42f2-b2ac-dede1c9efdfa", "value": 827232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647883696, "uuid": "cab0bdb0-dc97-4129-ba14-89b6b238ee60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647883696, "uuid": "ce6dd5e6-5626-4b64-80cf-2de2bdf25819", "value": "00986720220321_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca78e0c4-a902-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647858999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647858999, "uuid": "c22aaf7a-9496-49ab-b2ee-010cda3085ee", "comment": "Malware payload (Heodo)", "value": "ec7870ad6007d345a1474f11441b4f18", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647858999, "uuid": "f05505c8-485f-4c50-9f9f-e264ad0a525f", "comment": "Malware payload (Heodo)", "value": "6f7f016c6c79fc0af7b5bfc097a3d3fb4edfd1f69c586a82b0bb19adc3d41cc0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647858999, "uuid": "e00f6bf0-0e9a-4f06-ad33-6b2121981b24", "comment": "Malware payload (Heodo)", "value": "fe4a3916157d17533518f7700b8ecbcbbf5e2f85", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647858999, "uuid": "1308af9c-0d8a-4dbe-a159-16f74cd4d703", "comment": "Malware payload (Heodo)", "value": "d0d457ba39d350bf5410760a85f48ccf214d72ec0a6206b1f0a80eb13b7f71e1af146009f858757f1e7f4dcd2ce080d8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647858999, "uuid": "856d224e-ba6a-499e-9f29-f08202346dfb", "value": "T12AB43A317492B279C2EBD73408A35275B21AEDF157E274E36EE707CC4B366906E72602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647858999, "uuid": "f2d7a70e-1ef8-405a-8535-84c3973e451d", "value": "55cf9ae1e74cef637eafd17181390202", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647858999, "uuid": "69867b54-ddb3-4589-b649-fa75dafb837a", "value": "12288:7FFCpYDLbBHqKK85H3ja2VlMD4zeSvturG9+:7VDLbQKFVlMDOtv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647858999, "uuid": "e1a97849-287e-42d2-bf6a-dda63d1f4415", "value": 516096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647858999, "uuid": "c291e4b7-3f7f-4bd7-9ba8-a3dc0cb6fdaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647858999, "uuid": "23e4f56e-9d11-43ce-a3ba-14e0a6ebe509", "value": "MhjD0HX5VtY9ztgTokoOnW.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba469f6-a913-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647866275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866275, "uuid": "e136fd0b-806d-49c5-8987-2b4cce0b6c18", "comment": "Malware payload (Formbook)", "value": "4f330209cb5f706da6ac858c06f9ef48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866275, "uuid": "1db2ebd9-ebb8-4a00-87e8-dd9ae0fb2934", "comment": "Malware payload (Formbook)", "value": "704f63330e41ba5e17d5c0628e755ac3acd41392b43d72ed951900eaf78141cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866275, "uuid": "60049710-f1d1-4cbf-98a8-7c85920aa20e", "comment": "Malware payload (Formbook)", "value": "703aae256afa3bc08683f2332a06d5e11dd147aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866275, "uuid": "a1c758ee-a72f-4833-be95-1583f5518183", "comment": "Malware payload (Formbook)", "value": "da5ec8c447c612be71c4ca829b4ea4235015aa8c945ecab1f5eb4c025ee64389169f168a1bc4c8443c2e03ab196bb5a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866275, "uuid": "3b2db6a0-b846-4cac-bdf0-ce24c7f3f20c", "value": "T173641246B7928BBBD199C6B024FEE27ED737469103191A8727D10F51CE92CCB160F5A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866275, "uuid": "a423da97-be09-488e-b5ca-b5120e01736b", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866275, "uuid": "029c3b28-f7d7-4e75-bbde-4203c1603591", "value": "6144:rGiahiTLHk58HQIpm008LPywa5DMhYfhzyfsT2pOQT6A1dwmjqzl:OikFf8Lg5DMhTkipmA31S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647866275, "uuid": "62693bfe-07ea-491b-934f-972a9d23f9e2", "value": 308046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647866275, "uuid": "cf8ca180-1840-4aff-ba01-e6ccd862253d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866275, "uuid": "2ba66949-7244-463c-99b3-bd93268b80ac", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a00d7da3-a961-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647899730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647899730, "uuid": "4f0f6311-724a-4b7c-8885-d4817b7aa702", "comment": "Malware payload", "value": "c27d2535c2f3a511eb1f88d8f84fdf95", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647899730, "uuid": "d6ad1973-9bd6-434a-92ae-583ac4215a2e", "comment": "Malware payload", "value": "70a9c33eb84a265676ef3b1133a6f86520405a2e60f07c7ef840dfa3614e127b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647899730, "uuid": "85e7ef40-b3e7-440d-8e1b-ab600717f9a0", "comment": "Malware payload", "value": "c4fa2b1bd75709c356cbc6969157a00219a2d251", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647899730, "uuid": "f4eb8068-b8e6-45b3-9f7b-94df29379ff8", "comment": "Malware payload", "value": "048fa3d288798d20e7973c9534b9b5fb94c64caa71e73017f3acc2d89234dc26739104fe34641eb906a2dd6c3142366e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647899730, "uuid": "8f651f3c-b9cb-44d3-b273-7323142208e1", "value": "T17A85332587D99D9ACA87E179D90786ABB9F0B862301C1FF91204E83D6FF7C314C95893", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647899730, "uuid": "aee2f591-283b-49ff-b98c-b56c3efb03d7", "value": "316678da13121256e8f1ea418924287d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647899730, "uuid": "08570a9b-1f96-4bfb-b9d7-7cd745109102", "value": "49152:tTNIsf4Jurg60cyi3ni+e8vDqhIivkaQerjbbLtdp:tTNh4qg6GUnip87qhR8aHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647899730, "uuid": "20536afb-93ba-4f00-8eda-b42b58c34a71", "value": 1868496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647899730, "uuid": "47caac82-b586-4891-9c28-3d3234096cfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647899730, "uuid": "4ab0b50d-f6ae-407c-aab7-a5ae359faf73", "value": "c27d2535c2f3a511eb1f88d8f84fdf95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9e6db39-a92b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647876580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876580, "uuid": "af6a1c57-fa1f-4eb1-b212-1719f75f5dba", "comment": "Malware payload (Heodo)", "value": "1e2d8418d95ae8a396a8fcbc6fb2a773", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876580, "uuid": "9ca82773-26c7-432f-819e-49830ab615db", "comment": "Malware payload (Heodo)", "value": "70d3a8bfdfc39a2a0f64beb9e39574f4392ad44581702a6238ef4c2d8f4bc829", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876580, "uuid": "6ef59c55-8a77-4dfa-8983-258b49941eb7", "comment": "Malware payload (Heodo)", "value": "ddd4ea8a85872f94b65289e408d18c86d81bf24a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876580, "uuid": "49e5f9fb-4102-46e1-b5a3-e2bd1eb25802", "comment": "Malware payload (Heodo)", "value": "39b0cd5fa75a0af1a726153e437e3b0a41dd87491f80fc7fb597980413ba1e12dc7391d07f1964597d312e8b0e39b8c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876580, "uuid": "8e881393-a34d-40af-843d-907ea1f3365c", "value": "T151056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876580, "uuid": "a6b32186-6627-4436-a8fd-4e157db6e402", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876580, "uuid": "3844a493-0f2e-4508-90de-c077616046bc", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rV5CGNHrH2tZ+d+:gMV/rV5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647876580, "uuid": "e4641135-76fb-4137-a7d2-fefc17733f49", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647876580, "uuid": "8a3c696e-2801-426a-be4a-f24080954636", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876580, "uuid": "4f88789d-1ebe-4500-8e81-5a404f1c139a", "value": "1e2d8418d95ae8a396a8fcbc6fb2a773", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d82b45-a947-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647888652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888652, "uuid": "26727ced-8cd3-4a40-9a0d-7e970bf950bc", "comment": "Malware payload (Heodo)", "value": "af13c61d3a0fac9a5f089e223a63c476", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888652, "uuid": "62c8b490-e951-4e02-8673-ae76ab9732ff", "comment": "Malware payload (Heodo)", "value": "7102077b85013febaf36245cde1e9923dd046d66c0448529f18672c8e98401fd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888652, "uuid": "6ec17d0c-1200-436d-8ec7-c76aedc507dc", "comment": "Malware payload (Heodo)", "value": "b6e7abfad199cc31dc4ea1cf3128ffb39eda444a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888652, "uuid": "2dd35123-e5a8-43a2-9a6b-c2ffc8a6f0dc", "comment": "Malware payload (Heodo)", "value": "12f03a36cb3e06d4be02977171b834835f4e6d37445e2035d45d852fd5eb511d29ebdcadaf721eed270611017a37fa4e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888652, "uuid": "b9592398-214f-4801-909e-81d2bf7ce488", "value": "T182B43A11BC916832C36FAC7456073262588EE7F0DBD1F26FA3E0495C9A7C5E36624BC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888652, "uuid": "3aa27ec7-0d0c-46da-9b63-c4b33d6b487f", "value": "14e6ae8d1400b6271725b3f01025b85e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888652, "uuid": "18b238e2-9fc7-4f65-8667-5380967c3ff6", "value": "6144:VikzyaB9eoCyx/mEhHB5RYSJ/x9+qiCjzQNPj79GkqbscgCG5qH6scI:VNnCGmyHB5SSJp40zQN39GkUGQSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647888652, "uuid": "e11ca5db-08d3-4d8d-9a6e-05b02ca6e35c", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647888652, "uuid": "1b46485a-0cd5-48ce-988b-5fc072dd28df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888652, "uuid": "39570f62-0383-4cfa-9e55-eccc6869f329", "value": "emotet_exe_e5_7102077b85013febaf36245cde1e9923dd046d66c0448529f18672c8e98401fd_2022-03-21__185044.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab2b4704-a914-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647866677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866677, "uuid": "df840639-45e6-4427-9d13-1bedecf32413", "comment": "Malware payload (Formbook)", "value": "773cfd2a75ddcc582c9581fea74c84c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866677, "uuid": "c181795e-a55e-470c-b11b-33b38bb3a630", "comment": "Malware payload (Formbook)", "value": "714b48beff19144485cce78162fb1e8468e145271ed8a31b79d8a7196c48964c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866677, "uuid": "43126516-16d3-4f82-ac1c-c08858694244", "comment": "Malware payload (Formbook)", "value": "eae2ee1fbf8e1fa6fdad412f2dabd5d6287eb08c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866677, "uuid": "88d674e0-1f0c-4ac1-8635-f7ebd6f80c04", "comment": "Malware payload (Formbook)", "value": "da63cfdb515cf2a0c6f91fbbef658514582f6492028a607067a43c72a1a1de943a576990df7f48516adc7ef573ce48bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866677, "uuid": "4181b8af-aede-4134-9d3e-4b81102dbcb5", "value": "T1646423221FC11EE3CC47113A427BB763DBBA561482B99DCB9F194E389C5354B4E47BA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866677, "uuid": "f17347a2-4e97-4e95-a265-7e3737534f3a", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866677, "uuid": "8bb8d848-ab32-4d94-a843-52825a191cf2", "value": "6144:rGitmhAz1CbSLoArcyALHwsFujCRprINhXXWmlUG4+t:kocWLoArcxLbFujHhGG4g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647866677, "uuid": "3bb91820-0b5f-49f7-ba98-df3032b279b2", "value": 308661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647866677, "uuid": "00819261-bffe-4fe6-b745-4789a7e7152b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866677, "uuid": "e9a5b208-70b4-456e-b2f0-7339b8d43361", "value": "195399168-031522-sanlccjavap0005-13330.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e4e400a-a95b-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647896908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896908, "uuid": "af7c35de-eb21-4ed0-9366-ddd9e94faa19", "comment": "Malware payload (RedLineStealer)", "value": "d4dc829e5784d452784339de5775399a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896908, "uuid": "f49e17f3-15e3-428a-93be-10357a706ab8", "comment": "Malware payload (RedLineStealer)", "value": "71995b00a1177346060d8ec4dbc8fca6839be511cfd7896c583b4bd8b1a37923", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896908, "uuid": "10840106-5539-410f-8945-4ebf77a070b2", "comment": "Malware payload (RedLineStealer)", "value": "30d0cfa96328415fd282334f2e3bfbe56b8b9ce6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896908, "uuid": "a55211a9-1c44-43e1-8ec6-b9c689480810", "comment": "Malware payload (RedLineStealer)", "value": "5944ecfaf9906d87b34c18a277794016164fc763fba37d3840a1ed950675787598dd95129551381f2f8586715ece8b6a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896908, "uuid": "c62f4516-bb91-4282-80ad-7255686b265f", "value": "T129558D07E3FCA224F5715732477249D2182A7F228B3C959976CF792E523A131AA37363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896908, "uuid": "8ffa3d7d-0ec6-4252-999b-f25221a3aee9", "value": "39fa44c58668c2473ebb2467e9c69244", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896908, "uuid": "629c96b6-f7d7-4d50-8258-29c6eda45e43", "value": "24576:KDdoCVPoNC/AcgghimJFrB20v+iRYp3k+h4YEhNNTZGc6f/Q:MyCVPoo/gmrQn2Yp3k+3EhLZGZo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647896908, "uuid": "c332a22d-e980-494a-99fe-9d3a0a072e1b", "value": 1363776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647896908, "uuid": "b5c382bc-3fb8-4f12-82f1-cbfadff170ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896908, "uuid": "e7e752bb-96d6-41a6-89a7-b10ffb28dbf9", "value": "d4dc829e5784d452784339de5775399a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f1af552-a8e0-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647844108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844108, "uuid": "52e1de63-3ee0-43a0-8b15-5ee4e0ec00ad", "comment": "Malware payload (RedLineStealer)", "value": "0e6e902e14a0f21dec730eb4c24190e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844108, "uuid": "237aa16e-8a2f-4571-82a8-597d3db7dc7d", "comment": "Malware payload (RedLineStealer)", "value": "71f0deaa6bd2f59094c46497703789f143ddce36e1da4524546f8feba5d2fafb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844108, "uuid": "d6fb7c47-8112-4f0e-b61b-9f4881545ca3", "comment": "Malware payload (RedLineStealer)", "value": "9132bbaf87daf5c612743895384367a355b66713", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844108, "uuid": "5fc3d262-6415-495e-beb7-b72edef75efd", "comment": "Malware payload (RedLineStealer)", "value": "5a8dadbf020038510e2d564dcef83649a3d492b23d665fbac411ee15a6e55ba4aa250a2fd403d1d7228d5c647a859766", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844108, "uuid": "8afdc19f-098f-433c-bd66-2bb7ab70a1a5", "value": "T157C423EA0E986F79C1C55BFD7B18D29DDF686C80FAF03D62C67C4501AD58122D221AF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844108, "uuid": "8d08f5a6-d29e-4150-bcd1-5d29b837f750", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844108, "uuid": "1baf0d71-ba7e-4750-b473-c517208a0c28", "value": "12288:nHwfNbpPOl/+5XNXMqF9c1QS03ULaHNqrxlKIQNocKBYlSsr9I3PxM:nQfNFPOl/O194kEaHNYK3lEsCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647844108, "uuid": "853472c2-73b7-46b7-9432-44acd2107cfb", "value": 570368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647844108, "uuid": "6a67f8af-ac55-4e12-84a5-3ccda96947cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844108, "uuid": "390a573a-1968-48b5-8cf7-3d51291c6ac6", "value": "34667994.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810fd087-a8f9-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647855010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647855010, "uuid": "a64b0d4b-bf7b-4ef0-9539-a649fd128aa3", "comment": "Malware payload (AgentTesla)", "value": "e2b07241644fbf25abe5751b6087eab4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647855010, "uuid": "79fc626e-3d71-41ed-9d97-a9b580230adf", "comment": "Malware payload (AgentTesla)", "value": "722af212f7bf69ce63c0b89e69702960d9fcb25a5c625c43b97d55e59c669b27", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647855010, "uuid": "64bc706c-bac8-4d45-832e-42e8d837f06e", "comment": "Malware payload (AgentTesla)", "value": "b9e09753334074de6b7fe61abaa071d7791e9909", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647855010, "uuid": "e470a44e-b2f3-4418-988a-8d4eb7721c2d", "comment": "Malware payload (AgentTesla)", "value": "f91c1416202cdef3b366ac89948d5db9abe65ef4079e76eb831038bd811c1f7456dd522da44266c445016119c0121f02", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647855010, "uuid": "6390bb7c-c509-4c17-be6e-a72a4e3ea62f", "value": "T13725238D73708346E3FA97B100FD284D0F3605AA7912EB54BFD674CA48037965B62A6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647855010, "uuid": "7dec7dd7-05e6-4c0e-bbc6-3e46137a905d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647855010, "uuid": "56bc269e-24f9-48ae-a662-0bfeee46eaba", "value": "24576:EFYl99cVcMrHAT5R63xhLQucPWO0rG9txbM:EFGaVfs5R637spPWO0rytxbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647855010, "uuid": "29a0dacc-22e1-48de-a878-45f80c8dde7a", "value": 1047552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647855010, "uuid": "4fa7ea3c-f7be-4f68-b90a-b0690dd9bd89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647855010, "uuid": "a069ffb5-51e9-4083-b2c0-c8dd445611c3", "value": "Outstanding Invoices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d959505-a953-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1647893659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647893659, "uuid": "9edce484-297c-420a-a1bc-638b3df25f16", "comment": "Malware payload (Gafgyt)", "value": "bdcc27fee5131226259383ca5d6c6c9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647893659, "uuid": "3cbfb551-91df-4d0a-951a-b239e79e624a", "comment": "Malware payload (Gafgyt)", "value": "7233226d87dd8799c177c543e3620615aadc01a4b84321f0a473d0a3b451d0a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647893659, "uuid": "8dfd77c6-7490-4a37-aa0b-d156391ebea1", "comment": "Malware payload (Gafgyt)", "value": "8c2a7144f112dfaae603913f22a11e9c9a0b384d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647893659, "uuid": "e646bf3e-c6bb-498a-a569-17b5e3e3de15", "comment": "Malware payload (Gafgyt)", "value": "b4e7870adb4ce5ea23d0a2c3bad8ab8947de2b7560ac2c1c05db07f9216a2fa1a3f9a5fdb695eabf11aa5deda286285c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647893659, "uuid": "4dfa60a7-7646-4b41-9e1d-01d8ef4ae20f", "value": "T1E1D3E73B7B270A23C0CA507111E71332ADB5DF9B34B95393A9D17DA86F36A843416BD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647893659, "uuid": "c2e803cd-84b2-4f41-90a6-7eda9c353481", "value": "3072:F1S6vtvMzNPz8XTm87zYuTwmm/mMvrG1aRuNb:PSUtSlW3EuTwmm/mMvrG1aRuNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647893659, "uuid": "ec4221c8-56ac-4d57-bee7-8c9971d6e5be", "value": 135607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647893659, "uuid": "1c9d3f47-84f7-4e94-904c-e90e948d4f2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647893659, "uuid": "11468580-0bcb-4fda-9bdc-e45f97195ed9", "value": "bdcc27fee5131226259383ca5d6c6c9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "166bb6d2-a928-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647875018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647875018, "uuid": "b11bf9bb-5315-4b6b-a8ef-0bd5cd2e6b9a", "comment": "Malware payload (Heodo)", "value": "4d3757c4c972d7bb24ab8d2f4c3976a4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647875018, "uuid": "823ac45c-1a38-4c11-953e-4f6bef7ca67e", "comment": "Malware payload (Heodo)", "value": "726f1fb59ce71bbcaf90ac2e3ad76b72dbc3258cea332bccd9931bba1a67fc56", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647875018, "uuid": "7e45e994-a782-4223-993e-d774861d4a0c", "comment": "Malware payload (Heodo)", "value": "959cfd6dbbbce005a6fb3c0f3861c7bd3d984c83", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647875018, "uuid": "85598439-26d7-4eb8-8b2a-1b7f21d5de9b", "comment": "Malware payload (Heodo)", "value": "98c739cf8f0f4a0da43348221a0781385fd4080e02b4745c41fa551ec36348b09f8dd2f942337faa1943396313c80946", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647875018, "uuid": "1819dfda-c521-4710-ba25-add79b17964a", "value": "T152056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647875018, "uuid": "5a3b883a-def2-4d03-bcc5-b14a7fcb67ad", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647875018, "uuid": "28242a38-c283-4baa-9ee4-9651b3c5b8b4", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rP5CGNHrH2tZ+d+:gMV/rP5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647875018, "uuid": "f507d70b-1fcd-41a2-b62d-8438119e8550", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647875018, "uuid": "93214e6e-9176-444b-a411-b2d56801d2d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647875018, "uuid": "caf15737-faf2-45da-bf10-552fd106406f", "value": "726f1fb59ce71bbcaf90ac2e3ad76b72dbc3258cea332bccd9931bba1a67fc56.sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a125b19-a8df-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1647843805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647843805, "uuid": "c16bce35-579a-4fc3-85c5-7c22c621b296", "comment": "Malware payload (ArkeiStealer)", "value": "698a3e2c33868d2ecdeb4495c98ac085", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647843805, "uuid": "c34632b1-fd5f-4da9-8a3f-dddb276837f0", "comment": "Malware payload (ArkeiStealer)", "value": "72eba0a5ada2c4284004a42c3b3a4defe023932a941b9cd4918a65997d4752b2", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647843805, "uuid": "2182242b-9395-4672-8016-01d2d3c2a357", "comment": "Malware payload (ArkeiStealer)", "value": "08e8d2e2e9eae1f07ff44af8d20d63a38cf63b2c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647843805, "uuid": "60d786fa-2140-4011-bb41-b3f2343e9377", "comment": "Malware payload (ArkeiStealer)", "value": "c925f97f5d83f11355f9c61c18ff3c8c1b3c5bb5f2ed7fc94c4b9959c73f18cd643ed191603ceeb64b3c7111dc098212", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647843805, "uuid": "214b4820-94e4-4e74-855c-e5ea68cd4b36", "value": "T17FB56B052AEE8711FDFB1FB8A97685A507673C40AC7CE1AF6165325E0A30F43C9B1726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647843805, "uuid": "9c5a80f7-ea3d-4bdf-837c-fe7c036e39e5", "value": "2096dca323bd0a9dde32fc771206aff8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647843805, "uuid": "cc70e840-47af-4059-abc5-80e15048bebf", "value": "24576:3AdN3hP5PP8+E1SBkxGUUNA6CSVRQk6q0CM70CPAXkaUO59Au:3Ajh9OxdUtJzQR970ZaO597", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647843805, "uuid": "81513caf-59a8-4e88-8371-d5fff071a318", "value": 2329616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647843805, "uuid": "b621509d-e892-4277-ac97-73ab06dd4a58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647843805, "uuid": "f38f5c04-f60c-4825-b85a-cd1695ff5a21", "value": "32492258.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0685d26a-a8f0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647850939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850939, "uuid": "e911969d-28eb-416c-99ed-085ca1316dd7", "comment": "Malware payload (Heodo)", "value": "eafe5e250ba02d847265b341d4e10f2f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850939, "uuid": "349e9493-1f57-4988-b0cf-4e0c2cee3235", "comment": "Malware payload (Heodo)", "value": "7309f87ee796e12b2b85412da46453506d55d696dd8363695ae08551dbf33a48", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850939, "uuid": "e7885de4-a4e1-49ba-8143-194eb4fd681e", "comment": "Malware payload (Heodo)", "value": "c0b8fa2d44ec0f0390e7c06ef9e53e45464ce667", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850939, "uuid": "71796738-a6a4-4963-860c-f8e982e65f7d", "comment": "Malware payload (Heodo)", "value": "385e19a0a9462726037f1a6153762db33e1c9dc2e5c06c3825d6d4893fe2fda71b3ec348abf27ec5a440deee44a9ea3f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850939, "uuid": "0f81d149-9c83-4a4e-9f8d-0f09ee2d4242", "value": "T1C8056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850939, "uuid": "f2d873d4-3b09-4a91-8069-f85e7d303386", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850939, "uuid": "1f4a44f9-964e-4848-afa4-b364fdf770d6", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rY5CGNHrH2tZ+d+:gMV/rY5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647850939, "uuid": "ab5890a9-85a3-4d92-9507-27ef8c0c0ac9", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647850939, "uuid": "61de117d-2578-4cba-83ac-a9eded2131e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850939, "uuid": "de1ee44f-d518-4bd5-836e-dd46e109fa32", "value": "eafe5e250ba02d847265b341d4e10f2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df2ab370-a946-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1647888239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888239, "uuid": "98fca121-d941-4991-b161-1acaa9405fef", "comment": "Malware payload (NanoCore)", "value": "f7a8861b6f52cc69f09b92bf9e7a6125", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888239, "uuid": "1d95358b-b497-44f0-a7f6-7c67bdf0139b", "comment": "Malware payload (NanoCore)", "value": "7322d30c00e551257cc11e0d23d3620944b215c3dc8b48f2294afdcb605656df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888239, "uuid": "ab6a6503-648a-4624-a2ae-45a678ef22ea", "comment": "Malware payload (NanoCore)", "value": "67cbb1ea52dc240ab5e57cccd29b95cb54c61266", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888239, "uuid": "b0aaf428-cd4d-4f80-ba5f-a2fd4d6ea453", "comment": "Malware payload (NanoCore)", "value": "8d904e9ce6e9893aab3732d69a817602574ec9df09ac93b0b92a13431b1592b235cf1bb0c499562e0a9e554e5c804220", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888239, "uuid": "c4cfc3de-3a24-4eab-b7ba-16bf316c7e50", "value": "T15254124BF6E6E977C923093109B2A7B1EBBB978404545F030F347E6E7A331524E1A6D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888239, "uuid": "1e1b4294-e4cf-46c4-bf3b-22028a6c288e", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888239, "uuid": "c005590e-3de0-46f2-9804-6d53f9389a18", "value": "6144:rGiE+UEdCzZaReSqzMQD1xVBHiO0U8LHscyqGvgPrIhqkWZ7tkzC0IJlcgsD0:Qt0wSqzMQD1XBHDM7seGvgDIh/WZ7+23", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647888239, "uuid": "51a2a9b5-ab17-4557-a31c-2539edfbf5f1", "value": 303830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647888239, "uuid": "e06942a7-ce09-441d-9121-dd7c11794a3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888239, "uuid": "9d378c3b-764a-41e3-b988-42cd30ed1851", "value": "f7a8861b6f52cc69f09b92bf9e7a6125.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bd8b90b-a8f5-11ec-9275-42010a9c0029", "comment": "Malware payload (vkeylogger)", "timestamp": 1647853203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647853203, "uuid": "9e8b6f24-221e-4553-a8a0-528571b28f1a", "comment": "Malware payload (vkeylogger)", "value": "41d46166752bc1ca3251f45caaab670c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VKeylogger", "colour": "#FE96F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647853203, "uuid": "2eff89e7-17c2-4435-82ab-08562d76476d", "comment": "Malware payload (vkeylogger)", "value": "7325d304e8560ff643a656fd3689adcaec39650840efa8273c4556f6532e98d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VKeylogger", "colour": "#FE96F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647853203, "uuid": "280eae87-7073-4f76-a4b8-c47b0873ff52", "comment": "Malware payload (vkeylogger)", "value": "bde17b99bd1502e04c644548f40fdb6212db2aa7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VKeylogger", "colour": "#FE96F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647853203, "uuid": "a0893743-5464-48ed-95cd-b01b26c54f02", "comment": "Malware payload (vkeylogger)", "value": "d291aff2895c83345def8d76b63c9b58697061013a618d5f6ad74458345fe3ca9b73c74a4433edc19622fae2454710f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VKeylogger", "colour": "#FE96F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647853203, "uuid": "58fe0130-b418-4fe0-8360-2a4fba3f54bf", "value": "T1D4749E107BA0D035F5B326F846B592B9BA3E7DA1A76450CF22D52BEE56746E0EC30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647853203, "uuid": "e3e5c1db-5506-44b9-aefa-10016d94affc", "value": "4c21834df97c6c7299aeac0fa46461aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647853203, "uuid": "66e8a90c-3deb-4845-8242-e0adefece6f8", "value": "6144:09eEEMNcnDnHVlSJF/2dLi6qcvf9LVgJE8c:MGycnDnHVl8t2dLMcH9LM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647853203, "uuid": "0cc716d1-f183-4081-a841-0f309f3dfefe", "value": 345600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647853203, "uuid": "50979a1c-88cc-4d9d-b4b5-c40c49abb795", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647853203, "uuid": "8f17a089-cfe9-4701-b532-c752c1fa58d2", "value": "41d46166752bc1ca3251f45caaab670c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c618916-a8e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647848130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848130, "uuid": "4d2b149c-4c90-4eca-b6e6-194ead318753", "comment": "Malware payload (Mirai)", "value": "212c77e7b0e3b5ed2b6ab103f92fe8de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848130, "uuid": "5608f9cc-a7f3-4359-8afe-7359cd8177b6", "comment": "Malware payload (Mirai)", "value": "732c893635675ad7a8e9ad4c1d015b87d546d4749395a963c74e1c6453240600", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848130, "uuid": "02dc57c6-f5c8-45e4-8859-7a6e473f95e7", "comment": "Malware payload (Mirai)", "value": "18b92b306782eec0f35718d411c425b0af31e40b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848130, "uuid": "6d1a8ecb-1c09-4bd9-9c61-21ca6936796a", "comment": "Malware payload (Mirai)", "value": "546511637f09487035bd4aa8b4e81c7bb9ec5d64cc82c1a271d4dba4f8ef7d36a707bbb1c6bd5540398e3e11d1f98569", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647848130, "uuid": "4ec97e25-1a65-401a-81b4-26ce44cd3e63", "value": "T181D3B76A3E11AFFEE268863007F75F70939525A32AA19741F26CDB085F7128D1C5F7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647848130, "uuid": "b82068b8-7602-4a6f-99ed-e3cbd0ab48ea", "value": "3072:dfW4ANm8YobHxVKMc5P9Oy3+EEhXiq92kSyP28C7MK+emuC5hmv6r3FdU+F3xemG:YY4KDXC5hmv67U+F3xemqY1fuBmvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647848130, "uuid": "b7574bda-7416-4739-bdab-b40f7f7dad78", "value": 137917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647848130, "uuid": "0b598e24-dfa6-44ce-832d-84ad3f174f42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647848130, "uuid": "c81e1388-74c6-4909-bc46-8b68122fc923", "value": "212c77e7b0e3b5ed2b6ab103f92fe8de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae38ff6-a940-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647885333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647885333, "uuid": "9d48b7fa-370c-4b67-aa92-64898e60b922", "comment": "Malware payload", "value": "e5856328796a8606fe2549a5ee820c57", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Facestealer", "colour": "#537D39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647885333, "uuid": "c3668bee-dada-4b99-afde-3092542e02bb", "comment": "Malware payload", "value": "73b5b1bc3ba4c80750564d01f5fcc42289f33a17ab27d4f120d562b464ca4852", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Facestealer", "colour": "#537D39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647885333, "uuid": "36d3b53d-db5f-47db-84a9-8f0b180ffb60", "comment": "Malware payload", "value": "493e2cb4ab5475fcbd24fc6a065b66234c946961", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Facestealer", "colour": "#537D39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647885333, "uuid": "11f267ae-b077-46ac-a52a-f82e07ce44be", "comment": "Malware payload", "value": "a0620fe8f4a0875ef5b2860ea25783359ddba28d845087848fa47dfa715e9c8332324920aad1e73187e3459eeb6f1893", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Facestealer", "colour": "#537D39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647885333, "uuid": "364590a2-c900-48b7-b4e2-37e7d4443344", "value": "T18F072385E315603BDAB296331976072521E74E46C8C39B476B407B1C1AFBE885F7EF88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647885333, "uuid": "6b7a21df-e120-4d8b-a572-b082a54773ad", "value": "393216:9+y1w5+mDB82WftvGKz4AQ0QyndqOhXiVEUo7hSiq6k:9Jw+mDGHs5NH27htq6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647885333, "uuid": "4083d24d-61b5-4d50-ae06-6c30a54f7757", "value": 16795728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647885333, "uuid": "82263bb4-57a2-4307-a2a4-af964dd94499", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647885333, "uuid": "2dd9cd6e-87eb-49f9-a789-46c82df667ad", "value": "Papatoon Face Art Editor.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be288a4-a8ae-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647822736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647822736, "uuid": "670bb679-d2d9-4e75-bde9-873b1625fe02", "comment": "Malware payload (Heodo)", "value": "5f51f579d81f05c9ad9a8347bcb0b15c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647822736, "uuid": "38074e4b-15f3-4f08-9166-dca61f31cd5b", "comment": "Malware payload (Heodo)", "value": "73f44f94be1ce374a50040a9dfbfd33f63cc03b93bb79844a7c1459fd6e2cbed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647822736, "uuid": "a58364ec-3b83-4154-ab4a-e185046b9739", "comment": "Malware payload (Heodo)", "value": "3e547f625bba5db872c94737f0d8ab2e8bac56b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647822736, "uuid": "cf5d26fe-630a-4ebf-acdb-845b0afb2eef", "comment": "Malware payload (Heodo)", "value": "bbc40021fcfe16cf08d7c078707e00ae55de5e42b32f2b55ba0412a1fa5892d0357a3be4299eac9e1a4133d87f7a2303", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647822736, "uuid": "e5894eba-57c8-4d41-8e96-f4c01a704bb8", "value": "T16BA428123CE2B072C89BD0348FC56164855FF5F5AFA6727E62FD229C4B24DA18E17B02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647822736, "uuid": "139a418c-6e86-4bf1-87d1-6e70ecf8d5e6", "value": "3881d76bffe56c7cefb6ec7d56cb4aac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647822736, "uuid": "48a92ac1-b2be-4082-b62e-e5b151fa802e", "value": "6144:2zP28Xoxy3TAaZOO+k1EWKdguBw423quMsLh+tEgrtenN6YlXmcwT:2zxTlZP+s2x/23q7sEbEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647822736, "uuid": "9ccfd6db-7c31-4f59-acd6-7af642ab4b8a", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647822736, "uuid": "0f0110f4-b37c-4737-8058-e3c345e5d504", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647822736, "uuid": "9ea79b8d-ddc0-43a4-b58e-5b71ccf12e9b", "value": "5f51f579d81f05c9ad9a8347bcb0b15c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c12c78-a947-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647888593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888593, "uuid": "95701255-8443-415a-b810-ecb60fb461b4", "comment": "Malware payload (Mirai)", "value": "640685ad7c029d11b05bfe2149ee16be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888593, "uuid": "5f741969-c692-48f6-ba36-ecb90834a6ef", "comment": "Malware payload (Mirai)", "value": "7410b4700eef88d47cfc503077d81f6c76e1a31d7603495c1fcb7c4ddfe818c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888593, "uuid": "28e7fd79-ed51-46ec-ae08-f44811959d3c", "comment": "Malware payload (Mirai)", "value": "273da585e98be18d4db435ffe59ad795a6b667e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888593, "uuid": "ce3e5b54-e25e-4c61-8d2e-8a3905da568e", "comment": "Malware payload (Mirai)", "value": "523f567ed43a8ba2ff4c0dd437a898614900066f7efe6f5abdcf1ce445ea83b84a6ced509538d5147d7082063cd18c2c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888593, "uuid": "deef392f-1c48-4d98-b114-5bf8a5b3186e", "value": "T1BAF34F8DAF610FB7E4AACD3B16D92F40216C021755A87F267E30F914EA1919F16E3C72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888593, "uuid": "5618d898-b5c8-4dfe-8c43-f1f3dc813e89", "value": "1536:ow/EP59vq1ygejMaz/iX81AsnZH8ymJtO/OB0oRiAm7AMgOf0YKMI+JlXqTBS8S6:vq59s6YaziX+AkH8ymfuAq0YRIe8S3/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647888593, "uuid": "c47a187d-cc0a-4082-abac-707b35770e22", "value": 170176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647888593, "uuid": "1824d276-98c7-4dda-9cef-9bfb47564064", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888593, "uuid": "19dbebdb-d344-4932-9c1e-d2726ae27e50", "value": "640685ad7c029d11b05bfe2149ee16be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "facbe8ca-a8b9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647827727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647827727, "uuid": "829a986b-dbfd-4a9c-995d-3f1418822f49", "comment": "Malware payload (Heodo)", "value": "4c7f1a1e9e519157804be9947203b4c5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647827727, "uuid": "49636e45-d7e6-4d37-b2b7-894c0f76bc55", "comment": "Malware payload (Heodo)", "value": "7492725ec8005fe791fdba8cc2f96cb4af145a46884f167a3d7acb2404983e3d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647827727, "uuid": "ff74efae-3612-465b-a4bd-1c1f72af4c45", "comment": "Malware payload (Heodo)", "value": "2a4c4024b3e73f067525924096d41c14c0c70364", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647827727, "uuid": "05264f41-a795-4c62-acbb-739ecbbe14dc", "comment": "Malware payload (Heodo)", "value": "2da42cb08405a894b4e7c89fb9fed97f8706cd98e7a3f2739edfea0baa4423d3e022a411b549443c4d253a621fb1d48f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647827727, "uuid": "88f5198e-3bde-453f-9144-36b36b5cd4b1", "value": "T13E348431389672B9C6EBDB3009A31135B212EDF117E274E26AE746CC4B366917FB3641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647827727, "uuid": "594e88aa-0972-4da4-9a90-6bd4b337a234", "value": "3072:/RlP+RsA0FCISMrdaGNgjA6K8qmYbSob1cY8qKqswkwn+uNIR85H3j2AWR2:/RlP+SA0FCpMrQGPhbLbBHqKK85H3jF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647827727, "uuid": "4c19b6e4-0486-4dd7-81fb-4973bd340866", "value": 252448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647827727, "uuid": "8be88682-c10b-4e69-a206-8bfbb4bb2cfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647827727, "uuid": "7a506277-ed72-4581-8a8c-27aca336ad5a", "value": "emotet_exe_e4_7492725ec8005fe791fdba8cc2f96cb4af145a46884f167a3d7acb2404983e3d_2022-03-21__015521.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "605939a8-a908-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647861398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647861398, "uuid": "7418a232-38f7-4925-9534-e133cc34bb37", "comment": "Malware payload (Heodo)", "value": "16f0c6a54fde894a314d6ac4289015e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647861398, "uuid": "8a270f82-97ff-4d02-8e14-6cd45904c1e5", "comment": "Malware payload (Heodo)", "value": "74ddfc732b61473839faaf083d3fb654fe0622fc862f08b91fee7f0210a86309", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647861398, "uuid": "e33d71e3-6532-4a8c-a565-e9caab2b95dd", "comment": "Malware payload (Heodo)", "value": "f0753192d6120bc26f780cfdcd5ed7052839f7aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647861398, "uuid": "1e9354da-784b-4532-936b-f2c706dde8ca", "comment": "Malware payload (Heodo)", "value": "7c921bb596a9f532dba8cdc2646252be68443206399d48a4f84e99b6c060a1dfa95361b38b340f8756ddb69ce8116f07", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647861398, "uuid": "35ab22f2-a9bf-40b9-a512-f9861c430940", "value": "T1F3B43A317492B279C2EBD73408A35275B21AEDF157E274E36EE707CC4B366906E72602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647861398, "uuid": "55ad3eb6-552d-44d8-bf65-2ce0b60f9fbd", "value": "55cf9ae1e74cef637eafd17181390202", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647861398, "uuid": "328bc75d-2216-4136-906e-2b4beb4871b7", "value": "12288:7FFCpYDLbBHqKK85H3jQ2VlMD4zeSvturG9+:7VDLbQKrVlMDOtv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647861398, "uuid": "3a0093a3-378b-4939-90a0-e3792caadf0e", "value": 516096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647861398, "uuid": "46d89909-065a-4334-bcb4-c2533a43cef1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647861398, "uuid": "7c9df1f2-d5cc-45a1-b5fa-d34ae111578c", "value": "16f0c6a54fde894a314d6ac4289015e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb709d1b-a8f2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647852129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852129, "uuid": "deaadb25-f307-464a-8850-ae4714fffb4d", "comment": "Malware payload (Heodo)", "value": "8672860f9874d8423f934c56c7beec37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852129, "uuid": "0a87df12-5369-4119-b90f-3766f170a4e8", "comment": "Malware payload (Heodo)", "value": "750253948196747010cd6c0b1034e02796c42d7b99d133fdc2dba68b100b1ec6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852129, "uuid": "b5c59a7d-b673-469e-bba0-6d67f6ee5830", "comment": "Malware payload (Heodo)", "value": "29cbce6a55d5bc5600227ed9cd1918fcbefe309f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852129, "uuid": "9b8f1bdf-53bb-4445-b312-50c092e93ef3", "comment": "Malware payload (Heodo)", "value": "2865ea3d8b734054f168d4963cf6d829edf69ca336976466d495e87b04b411f95edd3c4e047819cf505e90283f1665f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852129, "uuid": "4157dc7e-2386-4677-9d74-224d72181484", "value": "T19A056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852129, "uuid": "53e93aca-3bbe-415d-90d0-f99c10379b59", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852129, "uuid": "44337d9d-a23b-489a-8e9e-36d03431f415", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/r75CGNHrH2tZ+d+:gMV/r75tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647852129, "uuid": "a77c3d98-88c7-48e3-b36c-b5747f7f5d1c", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647852129, "uuid": "6b434618-b132-4653-99e9-9eeafe9cd880", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852129, "uuid": "a7209c65-3a4e-45ff-b976-efbaf6dc67f9", "value": "8672860f9874d8423f934c56c7beec37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8fca931-a8e1-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647844769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844769, "uuid": "2fc84444-cf29-4bcf-9a4d-a916e0d3c569", "comment": "Malware payload (RedLineStealer)", "value": "c164bbf32c9046b80d3760b56dff3b66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844769, "uuid": "82f0c9b6-9b7c-4043-9599-b3f5167c52b6", "comment": "Malware payload (RedLineStealer)", "value": "75ad9270120b9f18ae59d2b1ac5c041edbacd0fbbb711d5a0f3c1ba4f1d8b075", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844769, "uuid": "8dc891dc-824b-4928-9825-160782d70ca6", "comment": "Malware payload (RedLineStealer)", "value": "847acee90d80d2bb924c3b6f513720b9e6a8c8e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844769, "uuid": "6f96e6bd-2e1d-4f70-bda4-1219f23506a7", "comment": "Malware payload (RedLineStealer)", "value": "3e036baaa987c951f9a27a0e4467bdf2d50aeaa0f06399d0006ce1fbc61ca0f4c85e56691c526af9d3bb84aa73e1d284", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844769, "uuid": "43af718a-f38d-4905-917c-d3843be6d370", "value": "T18424C02171C1C2B3C4B7143185E6CB798A7A30720B6A95D7B7DD1BBA6F213D1A3352CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844769, "uuid": "b6160ef6-3d84-4fa9-bea6-873c6ec953a1", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844769, "uuid": "1abaa3ca-c824-4a45-a02b-0773ce525366", "value": "6144:hDKW1Lgbdl0TBBvjc/edtvPf/SOXwmohCES:Rh1Lk70Tnvjc2nU5cv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647844769, "uuid": "892df6ea-9689-402a-9829-1972ab671725", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647844769, "uuid": "da8ebd99-532a-4983-9e14-280a00c87f61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844769, "uuid": "e27bbe03-c976-4878-8541-d70efadaaf6f", "value": "98270760.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c22cb15b-a916-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647867575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647867575, "uuid": "77fabd55-bd41-4d9b-a2df-3d6425835682", "comment": "Malware payload (Heodo)", "value": "08591601ec7d6d79dac4fdfc0afc2d76", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647867575, "uuid": "09dafb97-33e4-4eb1-a391-dccb824160c6", "comment": "Malware payload (Heodo)", "value": "75bc3124a5d6c6fd0b26210dc9ced399168defc70c7c05dd7ab20a87a03292b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647867575, "uuid": "eefcee16-1348-4333-b617-4748d76f4ea5", "comment": "Malware payload (Heodo)", "value": "fd82dbcd64f27d403df687b6a36430a682afd2d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647867575, "uuid": "c73c3293-b7c8-4a5a-8652-3309efc031dd", "comment": "Malware payload (Heodo)", "value": "4085a5855fd30b0e933eebed9cabceee89a18f3077e1e66ecdb9e6c8f0aee0cc75af903ad9a9f9c22ef8b02708e62dd8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647867575, "uuid": "ed9834b4-fa35-434c-8bf1-e206e72feff9", "value": "T15B056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647867575, "uuid": "a04a06e6-0eac-45fb-9ec8-7afefa71945f", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647867575, "uuid": "f44d0664-d920-4cd6-b73e-93d86432fa41", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rU5CGNHrH2tZ+d+:gMV/rU5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647867575, "uuid": "80b258f4-cafa-4f77-a00f-ecec7a6bd122", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647867575, "uuid": "7a590a98-552b-4672-ac2b-d2ddaf6dd432", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647867575, "uuid": "4a87100f-83c8-459e-8740-3eba1c28229c", "value": "08591601ec7d6d79dac4fdfc0afc2d76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3128cbdc-a93d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647884082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647884082, "uuid": "9f8c57cf-2451-4e09-9ba2-ef6a5da2057e", "comment": "Malware payload", "value": "5b90b5af015a27b64084677f30a1a468", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647884082, "uuid": "232c08da-0235-471c-90a6-aff909a707fa", "comment": "Malware payload", "value": "75c79f2b4f098e587a7970e0c48ebe2a161bef5008e285b0647931d867fc0c0a", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647884082, "uuid": "ea016f6a-a07c-43d7-b73f-eb5df1288fd1", "comment": "Malware payload", "value": "ab4527e27f1669d6ff18be36c776b0b334a2f884", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647884082, "uuid": "811e2abc-f528-4386-967c-07aeccf52e86", "comment": "Malware payload", "value": "2beab55fa85968bedf5bf256f42748c96e6408f337670ecbb982d6bc9d45c0bd22b31b798d77d88b1e903d2d1e5ba5ef", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647884082, "uuid": "a9938dad-ebee-497c-bce2-6326770588d9", "value": "T1B9A4C0CD5226D9E71B529F807F113ADE67105273C9E046B0EA871E2A6FCA9F540BDEC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647884082, "uuid": "0dda47f3-6423-4d09-8f30-c07e6853e9e3", "value": "3072:O5BK8ZPSpXwH5Vimsb568ENK9IGgNnZTtMvhdmr0lxk6rz1HCCYfn:sK8NSpG5VimsV1ENKOGwnkvrk6BCCYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647884082, "uuid": "1d05d92e-9467-431a-8ea5-d8c102aba5bb", "value": 476928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647884082, "uuid": "dc192c4a-8658-467c-b453-194fd7494231", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647884082, "uuid": "74c111cd-91cb-4d4b-8466-e42b2d5c1a3f", "value": "roth1.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd69f732-a931-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647879217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647879217, "uuid": "c24ff184-2c6c-4aae-82d9-e0f36a151b9d", "comment": "Malware payload", "value": "eec056f3096875517b25fbe345e36bc5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647879217, "uuid": "2ad35c87-f761-4d49-b518-d2fa12b48e82", "comment": "Malware payload", "value": "763dcf41655a4f984a9a645fbad55048fe1bdd287502d0ebd33a7782355bb8f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647879217, "uuid": "5c144aec-89a2-4d5d-895f-7d4cd1cf5e82", "comment": "Malware payload", "value": "44d940ec2511b1e84b939ab12c3ead20a7ba6dbb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647879217, "uuid": "65688f52-a547-4b09-b1a8-96dd682d829b", "comment": "Malware payload", "value": "a0656710fe8d4f3b0c7a8e2792dc2b6c77968e5c68b198329870d15b8a97ecc3223273f41d5545c7c7e4da5357ceb093", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647879217, "uuid": "0edef394-e0c9-42fa-9265-6d9b539a86da", "value": "T134447C00BBA0D034E1F719F859799368A93FBEA19B3491CBA2D42BDE56356E4DC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647879217, "uuid": "cebe78c9-25a1-4c6b-8f2f-5482b724cf03", "value": "ec534fb98de7e8c1f3b452dd02a2ecf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647879217, "uuid": "6c603fb7-a1d8-488a-9fbb-f42682bfe319", "value": "6144:FyZlRjJ16kunUgHrZj/44Jsfo5sXq//7FqX4XkXv:4ZzJ16kunUgHl1JsBa/TFC4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647879217, "uuid": "7db7aee9-0a97-4aad-8e38-269990dcb015", "value": 260096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647879217, "uuid": "d9a4b1af-038b-435c-8b23-3d8dc3640785", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647879217, "uuid": "97e8e6a3-8e9e-428c-89cc-021d855a5391", "value": "eec056f3096875517b25fbe345e36bc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "894edd2d-a923-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647873063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647873063, "uuid": "72ea26a6-f747-4f68-8929-01bc16091314", "comment": "Malware payload (Heodo)", "value": "7f6ce8bde504bda89bace1b16373cfb2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647873063, "uuid": "cbf261fb-cae2-49a5-b911-74d69248de0b", "comment": "Malware payload (Heodo)", "value": "7645a25e17ffcbdcb941ae1932134088a104ce9054214f13764b5b2ebf655b56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647873063, "uuid": "ea1a8239-c669-409a-8eb6-331707424323", "comment": "Malware payload (Heodo)", "value": "f90997c4f1663c8090ace8fa43a0f99d70b3465b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647873063, "uuid": "7933649c-8a6f-4eb9-9cac-5c296d40494c", "comment": "Malware payload (Heodo)", "value": "b7c6bba7660ce5e63fa5adbba3d9ef31b9af90ad2917684d108b94dee7649dd8e86b50963615d8cd66efcc5e784f2041", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647873063, "uuid": "c548f0e1-c804-4c07-b882-40e1dfa217c4", "value": "T1A6056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647873063, "uuid": "6c067e01-56ff-4cad-9831-86e602985ab4", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647873063, "uuid": "d1a5eddd-9198-4748-813a-c4b141743405", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rU5CGNHrH2tZ+d+:gMV/rU5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647873063, "uuid": "f5d12780-d077-4803-bcba-fff211ede6da", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647873063, "uuid": "ce858a0d-42a1-4815-a39e-e40d8ed44fa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647873063, "uuid": "68ceb5ed-2bf2-4d2b-b105-841ac7aa7683", "value": "7f6ce8bde504bda89bace1b16373cfb2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37e29f75-a90f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647864336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864336, "uuid": "478ddc0d-d480-4e90-844a-2279de65e069", "comment": "Malware payload (Heodo)", "value": "acc603e546c1dba68067381bdbbca74c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864336, "uuid": "8baa8603-62e1-40d6-8247-4d3d5ecbe841", "comment": "Malware payload (Heodo)", "value": "76824ad896af4c5ca5eb778d7df844131891df1fbc0614f0cc2661813cb3c664", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864336, "uuid": "6dbe7200-998f-44bd-9fde-219319ad1154", "comment": "Malware payload (Heodo)", "value": "24b871239969c0478747bfe04999b45368c8263c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864336, "uuid": "1a904a93-32d1-4230-8317-47d425725b48", "comment": "Malware payload (Heodo)", "value": "716daf6cd57c159c83268be4e3ccac4efddffeb6941496c83cca1010504d72ba9d7eb3402d15a006be51180c6da10f9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864336, "uuid": "5ff59139-0ed6-468b-9f4a-8ec47ee9594c", "value": "T15AF46B936BC2C077E41F0279860A6228725BD5327756E6DF37C1D79FC9387A2AB38142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864336, "uuid": "f3bf1839-ca7e-4b02-af20-ec4c2110376f", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864336, "uuid": "e29c997f-9746-4df6-b0d5-6c0e54f81943", "value": "12288:wGOAWAyzLzHKwJrCf9dJJjI1rMpUsN+JinUqqOYJNOD7ZjAjKL7mYYlgV0p:w5aYJNwPHmngyp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647864336, "uuid": "dd2a8ca7-e0ed-4728-8565-bcd21ff7ea56", "value": 782336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647864336, "uuid": "92c6b827-9ea4-4662-8870-4cebc0d83118", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864336, "uuid": "34184ad9-03b8-4b8f-ae30-ac4d2f3d62a8", "value": "acc603e546c1dba68067381bdbbca74c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d9658ee-a91c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647870010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647870010, "uuid": "9d04aef5-eaec-4a16-a0fa-1a9fb68f2481", "comment": "Malware payload (Heodo)", "value": "d6579129de3aed2728c4ba9df8bfb712", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647870010, "uuid": "0c61e077-a5b6-4f6a-ac92-5831ede2700b", "comment": "Malware payload (Heodo)", "value": "7683ba57ae77721a87a3f9297f79fd7cc099d50269e168e9341f2cc97542d48a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647870010, "uuid": "9f9872eb-99bc-45c3-bb8d-51b807e2cc7f", "comment": "Malware payload (Heodo)", "value": "a798b73c10ddfda6875b190de9206e5a4bdaeefb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647870010, "uuid": "7404000d-05d1-4698-bbd0-8d92f377582e", "comment": "Malware payload (Heodo)", "value": "c26087cb04653841563416523ace47da57c812f7db76429b411bb877d63a1d2dcecf9d65b2056484cb99b7a6b6c0c914", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647870010, "uuid": "9f22449e-c906-4e23-b8fc-681e43395825", "value": "T120056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647870010, "uuid": "c4ee8e51-1e34-40c8-ad6f-2ebc6b7a5f69", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647870010, "uuid": "43c596cd-e735-4598-b2a5-7e34d0c5d4e1", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/ry5CGNHrH2tZ+d+:gMV/ry5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647870010, "uuid": "b63f4b2a-d9c9-4fc4-9dd0-30dd98eb861b", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647870010, "uuid": "06a62b92-4f3c-4756-96ea-1891568fa2c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647870010, "uuid": "0b98855d-3e7d-4da2-a62a-77aa1224dcde", "value": "d6579129de3aed2728c4ba9df8bfb712", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5aee3b5-a8e0-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647844388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844388, "uuid": "cdf0f585-0012-4ecf-8645-df6a713d714a", "comment": "Malware payload (AgentTesla)", "value": "e7d0b23a5c0fbb0a5efc2adc921a070e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844388, "uuid": "297e63d0-0400-4d03-b860-5fce9f4e8fae", "comment": "Malware payload (AgentTesla)", "value": "76bfbb524e921f7639ecbb2c7d40e072d5b45aa4b8521a45d82d85f96743afeb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844388, "uuid": "a132fad4-229b-44d4-ae68-82963e06cc85", "comment": "Malware payload (AgentTesla)", "value": "45aa0c0f44483b4b5f4b81ba88ed06a4f21978bc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844388, "uuid": "e6b7d02b-0966-48ad-b165-14b776ecd255", "comment": "Malware payload (AgentTesla)", "value": "66123c8794d3f5625ec726a794d2f431185472a0139a6db18e58369c10f4b96699332dac5aa9493b4810eebee7227ed2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844388, "uuid": "f45ed83d-d3f8-4d00-b279-e43d034a35e3", "value": "T12C44FA07B94485D8CE7845FEB1478190B7C9DCBFD248F608ABC933A34EE16A25D26B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844388, "uuid": "6679ec47-7199-4024-b720-67c7a4cf2238", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844388, "uuid": "753179f1-844c-4a8a-8d76-46c85a566063", "value": "3072:RQDbXF4o7OvfL1Qqth5qGzBivpf01dlLCP8UEKhQ6qKnoVEfd:aP21QqtkV0hmqKoVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647844388, "uuid": "8e66f7bd-40a8-4761-9c72-546eccae4026", "value": 257024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647844388, "uuid": "0d079a3d-60ab-44d4-b82d-fd0356779167", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844388, "uuid": "5b89ae04-1be1-4bf2-9628-8e49dbc04aa7", "value": "PROFORMA INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba24190-a954-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647893924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647893924, "uuid": "f76a0282-be51-413c-8ffe-9753bef8a17a", "comment": "Malware payload (AgentTesla)", "value": "bad1cc00f6b007ee452ab200400a8ad9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647893924, "uuid": "acdaf897-415a-4dd6-86e9-262d4de759bd", "comment": "Malware payload (AgentTesla)", "value": "772211d9f0f3afbce8377a7f90ade67511c3fae85a4cd8e624ba32b43586ba8d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647893924, "uuid": "17a73dbb-d2e3-44f5-8e8a-2c6bdbc495bd", "comment": "Malware payload (AgentTesla)", "value": "3376d2792a1b6b2fb8b736d3e6dff5431c159136", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647893924, "uuid": "1476d82d-af92-46b0-8ed4-44d1ca5a08f8", "comment": "Malware payload (AgentTesla)", "value": "43d39ba4fa052e454856df72fdf9047587500e6390f3600c21d5f5e914b0cb7237a72dfbb8d7eab5f81ff7d7a474702e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647893924, "uuid": "cff9c39b-93bf-47b9-8c9a-dbd50189f6c1", "value": "T1712523B93B704B3ACC7A63B1F4D479C9D63224D22583EB60DD6161D22A13366073A37B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647893924, "uuid": "cd295597-7526-4ff6-81c4-b948735927a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647893924, "uuid": "fe2381a7-5a58-4714-8242-55ead276135e", "value": "24576:dkOjl9JRDdmxwse0VQC2imsZJ77k4dU3RUpcdd4Z9NLbRfK:eOrJRsxwn0SC2imyn2BUpcd2ZjLbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647893924, "uuid": "6bee87b0-504f-4bb2-9619-d68bbe1408c2", "value": 1049600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647893924, "uuid": "7c641fec-a0d2-4882-9091-1a103dd3596a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647893924, "uuid": "aa3ecb16-efbb-43de-832a-584dfe2d33dc", "value": "Order Enquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dc5fdab-a8e1-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647844589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844589, "uuid": "6af76d2c-c5e3-459b-a378-e8093cad7663", "comment": "Malware payload (Loki)", "value": "0bb8a5002630ff6b8d6453fcf9389cd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844589, "uuid": "404a2922-4c28-428f-94f6-9c33649efe26", "comment": "Malware payload (Loki)", "value": "772586d97b16f582bd8a54e92a411cd75abc13cd6cd277013e9417528eb8c1da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844589, "uuid": "d26ae869-5678-4f76-916a-799a0c7f1306", "comment": "Malware payload (Loki)", "value": "95ed8f91921a6b471a4c7bf5285c83651a988c8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844589, "uuid": "16a9f84a-78ee-4ea1-9a35-a73b35a02758", "comment": "Malware payload (Loki)", "value": "abfbb8e4a6f14fa56c21ecbbfe0733a933b851331be941dc78eab95e4dc5bfb0c1fe17ceddc6a74ca5891359c13937b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844589, "uuid": "02f8a470-5368-44eb-8f51-fe1c34d0611b", "value": "T1D405C0F40256F135DDB7C93B05247AA9B1B23006FB23B565FF499CE5234063286FA2A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844589, "uuid": "2553e3c5-1fbe-4c47-9c26-d64dde79ac7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844589, "uuid": "d90f2a9e-5d55-4c8f-8105-99d16a6389ca", "value": "24576:/fK/k0/QzWJkaKSJFmxRs5o7hB0/2A9pdX:/fKdozWeFsQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647844589, "uuid": "fef29a9a-97cb-456a-926a-5ef138d35e3e", "value": 830464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647844589, "uuid": "e5e33b3d-af30-473f-ab3d-070ab7543c56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844589, "uuid": "22c4c729-3a5a-4565-859f-4e3758c0a62e", "value": "PO#2100131410.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ff25cc5-a8ee-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647850203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850203, "uuid": "d4d430d7-0d67-4a26-b8fb-9e53bd114051", "comment": "Malware payload (Heodo)", "value": "4bb1b4f5a64df7452bfb3051fe8c1651", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850203, "uuid": "2cdd9790-98e9-4a4d-9b25-a1f51049c229", "comment": "Malware payload (Heodo)", "value": "7771605331e847d3653724bf588ba9e2118dee76bd986bfacfef7d7ecefab8e0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850203, "uuid": "735ed605-9083-4f31-b57c-e7189143a03f", "comment": "Malware payload (Heodo)", "value": "639cd028a51980c04fc5721f2ff94e69cf6c1cbb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850203, "uuid": "8154b022-9918-4226-ba71-71019fea9bad", "comment": "Malware payload (Heodo)", "value": "36e91585e436a6cfdc4f5ae026c1c391a316bfc91ae2128ce514b260e8f31b30adedf380698b2f36aa314011aab3f645", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850203, "uuid": "f0da4960-f938-4501-96a6-d2735d9a4d53", "value": "T1C174B6526EE300B3DBA713304D832CE6719BEB52E32C16BF02D8C5AAC6727B5552D539", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850203, "uuid": "3f21f6a6-87bf-42a6-b63e-1b2d0a23feca", "value": "6144:gC888pkASCkOhkOS222EWLGGtoF9TOu7VjjD0iieqTxeMnAEEo3qi6fh6L:gC888pkASCkOhkOS222EWLGGtozjBynN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647850203, "uuid": "9bf13289-2f62-4d31-9264-88c741b911ca", "value": 359706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647850203, "uuid": "398ad2a8-57b3-4c4e-8c61-b9e3b2c31da1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850203, "uuid": "6d33585f-6943-43fc-aba8-8f6b78217bc7", "value": "emotet_exe_e5_7771605331e847d3653724bf588ba9e2118dee76bd986bfacfef7d7ecefab8e0_2022-03-21__080959.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ad69c2-a938-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1647882137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882137, "uuid": "dd86391f-4b18-48ae-8237-d58a9f3d2ab1", "comment": "Malware payload (ArkeiStealer)", "value": "55e02e00bf76ef7d0a9ca20aff3f15b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882137, "uuid": "1dd9665a-d92f-473e-a6b5-5ed6183a1d89", "comment": "Malware payload (ArkeiStealer)", "value": "777b699c44dfb549110c8fd8fbcc67ad824ccc051f74ba8fad4e3e601324b02c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882137, "uuid": "8810cbc2-0854-442d-9396-bb58663babd5", "comment": "Malware payload (ArkeiStealer)", "value": "b63d01a99ff1c30753288466e5c2f1f8cf76b980", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882137, "uuid": "506c6978-6406-4a6f-9e29-8ab707848ae3", "comment": "Malware payload (ArkeiStealer)", "value": "36fed36f7288020734b871be3226062debd1ba0fdb79d666570b419851e2b1df96ca6f1b992daecc68e0a9c3cd7fc5bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882137, "uuid": "791f0b45-1f5f-45c9-9495-b8339b998716", "value": "T1E6D40110BAA0C039F1B716F40A75D3AC652EBEE29B1458CB62D42AEE17357E0EC71357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882137, "uuid": "a30bed00-c609-45ba-a952-44954741bc5e", "value": "ddd4504dfae4a1c918f514bef93af10e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882137, "uuid": "af7429cf-e53b-4622-9e52-18670ac889de", "value": "12288:6YZOUKHb1eZQzhu0Wdq76u7iulqhOIp4jXpUtHwSYMf7i63Tn4p6ce:1KHZFhe4u/yHLUtHwRMfG6j1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647882137, "uuid": "3fb056f1-749b-4259-8be6-e92e507ba527", "value": 631808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647882137, "uuid": "e034d296-c564-4cc4-9fdd-c97defe66a5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882137, "uuid": "de9de2ec-a2a9-4b2f-ab93-83bf1b7f053d", "value": "55e02e00bf76ef7d0a9ca20aff3f15b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12eca225-a956-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647894769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647894769, "uuid": "7fa20049-57a4-40e8-9b18-a98a6d713fa4", "comment": "Malware payload (Formbook)", "value": "102a540303ec7665687ee20c6a6f3829", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647894769, "uuid": "3772f61f-54ab-4729-a944-9ad0ba1705ce", "comment": "Malware payload (Formbook)", "value": "77de2fa49e24c93e217088285cfcc816cf7ae40928898dc3e88c0d6a67a31c80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647894769, "uuid": "755795ec-2218-4dc0-b5ff-ef4c29eef41b", "comment": "Malware payload (Formbook)", "value": "dc5b7f0a3a72215e0fb574ffae9dc1ca80d8394f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647894769, "uuid": "c190c3f1-9021-407c-abdc-0f8669f4c612", "comment": "Malware payload (Formbook)", "value": "90d36ee91e5daa6edacd3ac120da533c59b067a885fe2e9101f8940871ae165dbedf51b3fd8827ed0691202ebe056a1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647894769, "uuid": "ab294e8a-1d4e-4e70-8d0a-660ded40d81e", "value": "T1ED35235673A29A75D68D6B32D6E6914417308FC2FA53CB5C79C1322D03037978F23AAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647894769, "uuid": "3599e580-0562-4a75-9d95-b26116100130", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647894769, "uuid": "e7e454ef-54c5-4725-bcde-6890f55192f9", "value": "24576:4Vr94W+fAEY/PyVvoieXaM0GGbr2lmmY0tVe68euC/:4VR4DfAlGoibM0G8tmls680", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647894769, "uuid": "368fd9b6-1b9a-4a16-949e-0b256d6cdeac", "value": 1062912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647894769, "uuid": "f3af74ea-8c33-46ae-a52a-84f0e4eff6f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647894769, "uuid": "de5fb084-6a39-49eb-8fb9-853f04ffa2fe", "value": "T?cili Sifari?.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1753d49a-a8e0-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647844095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844095, "uuid": "235f85f2-9388-4c3b-a088-2178a072e764", "comment": "Malware payload (RedLineStealer)", "value": "a5ba15e0742c22bdff673b408764246a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844095, "uuid": "d7925a7d-783c-44d8-b138-2e3fa4a7fb64", "comment": "Malware payload (RedLineStealer)", "value": "7814d65b25bae27749ddcfd54bfafaa7d765c5dfdceddf1055622fdfdc9d7ba5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844095, "uuid": "c7b9269c-404a-4266-a880-855d1c5c5659", "comment": "Malware payload (RedLineStealer)", "value": "2cb5d25be54d82cf4d2339a46e2d91229a909c54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844095, "uuid": "8d14f32b-4120-42ce-adf4-f648aaeddf2d", "comment": "Malware payload (RedLineStealer)", "value": "fa9dea6c4ea12904997296dd89b5c3c6d461257a3fa765fc32cc8766b45af423400a6c61b04e81acabb8e316a685c409", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844095, "uuid": "255f17b2-47c3-4063-a872-606eaac0e0ea", "value": "T1495533DAB39B797BD4EF2FB17621DA194131995FD2C0010FE728B22E66BE08085F51E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844095, "uuid": "b942e11e-aba6-48b7-a7ea-3678d18df3d1", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844095, "uuid": "f63c90ff-9fdd-4683-8eef-412c01553964", "value": "24576:SLbMBoORliVABO/9c0UVj8L1BQww19mzBY6kEaHNYK3H+K5Dyox5e:LBoili6yOVj8Ru1EzBXNal+M1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647844095, "uuid": "e75ccd66-d32b-41dc-b46c-db59b657c649", "value": 1375232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647844095, "uuid": "34e86d57-f7a9-4bf6-83b3-405b27d23ec2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844095, "uuid": "e254ea9d-cd71-4f59-9ae5-ce4691b97533", "value": "34461434.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "934f5090-a91c-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647870073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647870073, "uuid": "0c73dd61-0697-4092-b52b-aef55f1d75c7", "comment": "Malware payload (Formbook)", "value": "1229c10484831e73e1e82c300f56c55f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647870073, "uuid": "9de6aca8-0ece-4694-9aab-42285c91a340", "comment": "Malware payload (Formbook)", "value": "78a9216db715b198385760e65ac791c8b535b0d29814cce5eee6445812983853", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647870073, "uuid": "7890837a-5c85-472d-92e6-13ea90b1b5fd", "comment": "Malware payload (Formbook)", "value": "7a54eb885f11f2b674c75eafeea51db62463758b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647870073, "uuid": "c7fe99c2-0c29-49bc-b88c-223964fab245", "comment": "Malware payload (Formbook)", "value": "1033f8d1c00ef9606f473076e18e70e4e8f2008526bfa74bdbba83f6035746fd6676e4d0917cf82dc9498c81ab66a1fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647870073, "uuid": "04594770-409c-42a5-bce7-7e5cd2c41299", "value": "T1D4C48C7A11AC9233CA7BC27585600016F7A1E0EB7812ED1DBED35B950D136C67FCAA2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647870073, "uuid": "baca57af-709b-4f93-bd96-e05846d56331", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647870073, "uuid": "a10f6a4b-f039-43a1-b267-bd977d06fd1f", "value": "6144:34z//6hx9bmJkySELj/1IcnHnNxjSrt2g657K02iS8EOGU0dlPP2YqX+Kkzvruv4:6aWJwEaKHNxjzo0TE3BXP2YIZMvrumh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647870073, "uuid": "c0f1fdc8-2443-4c3d-b62e-aaaf418b8927", "value": 594432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647870073, "uuid": "4165abff-af29-4cda-bc98-bd7026eb9fee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647870073, "uuid": "1fb51ca0-5e25-4573-9f81-85ebe604bbac", "value": "G302 SCAN COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a5a3af0-a8e0-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1647844127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844127, "uuid": "273fbef4-a873-48f4-a703-03eb4fd1fc55", "comment": "Malware payload (AsyncRAT)", "value": "fa1a78e4157dda7a5f839948db4e3bc5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844127, "uuid": "97bb7d7b-bb41-463b-8b7f-1a757fbb8d7c", "comment": "Malware payload (AsyncRAT)", "value": "791494176550bed4aef033781d45c2f1a0a041f3b6a475a1f29c7acf128ff7d1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844127, "uuid": "83b5e23c-9562-4275-853d-5e583670e451", "comment": "Malware payload (AsyncRAT)", "value": "e320dfabcdde91f169224f0d324fd0177e1dfea5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844127, "uuid": "8cd97f22-9fb2-4cb4-ae69-12976389ee23", "comment": "Malware payload (AsyncRAT)", "value": "b5ccd810a6ac945911eccb2c2bbff13e2eb26bcf3fc8ef6cfe1d0044850e1241ffe6f854c89f428597fd97199f5fa6d6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844127, "uuid": "1e1b95d0-9f9f-4e65-8445-8e315bb76710", "value": "T1161548F0A9A45AFDEC509E76CE649574BFE60C88A8106F1ED16C24E90133BCEC5950FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844127, "uuid": "0c736e52-0d5a-453a-8ca0-fd963cd85392", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844127, "uuid": "3a2250ec-7619-4787-bfb7-25530e5e3f02", "value": "12288:Uqx+RRiHiwFKrEpxI8yC8NZ7TFZ0go16oWWkoW7ltnb2Bz/IVNpnHYFm:xxvC6KrNlHTFi16ouxBbkkpHYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647844127, "uuid": "23456749-f2ff-4303-abc2-e82386c43afb", "value": 951296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647844127, "uuid": "1894ee61-8ff8-46b8-b54c-5b12f16e4e5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844127, "uuid": "721a8480-11c1-4b74-9655-b65347ee8fce", "value": "35213506.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e079cac-a919-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647868803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647868803, "uuid": "e65ccb6e-cb53-4608-8cd9-1228aa674992", "comment": "Malware payload (AgentTesla)", "value": "f072414663368435a2594bd1af7f3cc7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647868803, "uuid": "f6b0a7c6-a80f-4fff-9f14-30863af6e4d0", "comment": "Malware payload (AgentTesla)", "value": "79e770585da61bc3732baa8d1c4151edb24d8b17a010027d1d2ae06851ba1733", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647868803, "uuid": "999bf590-03c4-411b-8d6c-15addbbb3e52", "comment": "Malware payload (AgentTesla)", "value": "62a5d1ac3c9206a1417b19ffda585a5f31994539", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647868803, "uuid": "2e3b705a-91fb-45dc-8135-087cdc0e6c89", "comment": "Malware payload (AgentTesla)", "value": "95399dbe934519411bd92dc49325a831ba48bd005ca5b0c1326f0d23675fe990e988d9fed2b57b485b3e16b728100cd4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647868803, "uuid": "f53c3a02-9827-4533-b92e-d893d25b39f6", "value": "T17535235C3377B43CEEF536759455F04823FB8A2A7C4BE304B6D2562C0A963CA4646E8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647868803, "uuid": "d3becade-77b8-418d-a38c-915a46918ba6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647868803, "uuid": "fba00a61-d2d7-4521-9e07-b029c2e43863", "value": "24576:g9qZTZx/rc0xjUAeuLZ5VDNasjgIRQ7pu2gI/tQ1f:Yqt/19PJlIcp2nt0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647868803, "uuid": "bd515576-b80d-48df-8e83-ee1968f02e75", "value": 1088000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647868803, "uuid": "0883186b-7c4d-4072-9808-abfd06512715", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647868803, "uuid": "c6df113e-a416-4bec-a37e-d6b6d2b2ac66", "value": "MBL+HBL SHIPPING INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "595a3d0e-a8f8-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647854514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854514, "uuid": "f3598862-5acf-46be-94b9-24c43c2ce381", "comment": "Malware payload (Loki)", "value": "4aa774ade221142ead83cb03308edfd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854514, "uuid": "7cf3aecc-4f11-41b8-a081-c074a0f9841e", "comment": "Malware payload (Loki)", "value": "79e83b0067743e159e8b9f689ed498ddd7ff706278e8414c37dac7ad5aba561a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854514, "uuid": "5347f6ac-4118-4fb4-917e-97802d66944d", "comment": "Malware payload (Loki)", "value": "73516b5b567c637bd22e75d41654bc714ecc9f88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854514, "uuid": "6fb3bc23-65d7-484b-a015-7cbe7379aaff", "comment": "Malware payload (Loki)", "value": "ecc262c5787963dabedc8629cd37fdd858977109528ce9f54690ef40e13162f3a83c53ba2df0dc7ebdc194877cd1d9b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854514, "uuid": "860da9e6-8784-4dd2-a739-bf02c0bdef8d", "value": "T134341292B1D4687BD6BA4434417AFAB0F37F6DED01A4DD029FE02F5E23241834A4A776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854514, "uuid": "25c16070-8626-40c2-aed5-1a1801caa6b8", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854514, "uuid": "eb3de7d3-95df-4362-8e8c-72f331acec38", "value": "6144:rGiqCApwL0xD0KTESk8kdHhtFGotUB+QAfliZyHEZe6LniG:SD1twhXGoA2NVHCfTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647854514, "uuid": "c554a52e-54e8-4256-b1cd-57555da07118", "value": 240775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647854514, "uuid": "eaabcba2-ff21-4266-be8e-b617d8cc753d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854514, "uuid": "2aaf1717-2eec-408c-8b96-43efdf0202cf", "value": "4aa774ade221142ead83cb03308edfd9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5ebdbb9-a937-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647881755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647881755, "uuid": "52ad8ea2-9adf-40c8-8c8f-6a86a22bb365", "comment": "Malware payload (Quakbot)", "value": "81c36cf8c2b7ad174dc978f9f37ffdf6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "gml01", "colour": "#39A518", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647881755, "uuid": "17c0f525-a893-48ff-9e2c-1e16b8f24eac", "comment": "Malware payload (Quakbot)", "value": "7a227df10f82dc2e11822716aa04e91797e9a3011976a4e5884deb704bf0134a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "gml01", "colour": "#39A518", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647881755, "uuid": "1c021b27-0c62-48d2-93b3-a673e3a28c8a", "comment": "Malware payload (Quakbot)", "value": "f12e439cca797508509120db4aaeeb32aaa24f12", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "gml01", "colour": "#39A518", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647881755, "uuid": "e5299bac-bf9c-4d44-9638-7c878bdbccaf", "comment": "Malware payload (Quakbot)", "value": "fe19799c4c66be12b39455f02272d474009fac7561aab04dfc9a10c6415a46d727801b0d9ca6fff86728b6deaf4ec2f7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "gml01", "colour": "#39A518", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647881755, "uuid": "ec9425ed-221f-4d4b-87b0-1d631ac682ff", "value": "T13C84F141FA80C471C0BD5834A07485A62A7FB9215DDCDD5BA3E41AAF4F742D0D930FAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647881755, "uuid": "88625d02-d367-4db0-97fc-fdaa02a06379", "value": "78d96f0c3be707d45006fd9759c6ef89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647881755, "uuid": "79dcbe24-cdb0-4c16-8620-68c54af10bfd", "value": "6144:yEIK8em50z49eDXxbpVpabpdAQOk5uSQuos+FUtzz5KW+/gFzId/:y1K/2UDXt38CQOk8rTjFGzzX+I9w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647881755, "uuid": "90ad75ce-e3b5-47b6-b2f7-5463269e1c2d", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647881755, "uuid": "3bc903a2-d3a6-4086-a3af-49fe508b9d6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647881755, "uuid": "a5b704fe-6a21-4544-b2e8-5f02582a31b8", "value": "gml01.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "760e2c45-a8da-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647841677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647841677, "uuid": "4dd6d395-63da-431d-98ae-e4c9d420c105", "comment": "Malware payload", "value": "8d0656a9b0a5710e683748390fe5a5e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647841677, "uuid": "81c34b2d-1222-40e7-836d-bb4a95481d32", "comment": "Malware payload", "value": "7a43d695a8aafebde90f8a82139e50b9d790bffd6d895f4db23124c878f275d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647841677, "uuid": "0c67a0d0-5d62-4294-befd-59eabf1a8e73", "comment": "Malware payload", "value": "767299d8203d1af6a98ea2b3613d9c291867e2f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647841677, "uuid": "1ab42f2d-09a7-4eef-b565-117b4a921b7f", "comment": "Malware payload", "value": "6cce961918cb85107f4be0115b92d267c9b6bc5769146b50984dd1c6628d2d8d0eb4e8e46e754e104f55a08ad0459458", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647841677, "uuid": "f636f2e3-7f63-477e-bacd-aee0086d61b8", "value": "T1D744CF123AA3C8B2C58715707815CBB16BBF7432157589873BA90B3D5F703D2AAB631B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647841677, "uuid": "dde9e63b-3cd1-4131-aaa0-02c51f3fc3eb", "value": "dd74d0a493381cbdbb2d3a82a03effd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647841677, "uuid": "842cc74b-fc92-495d-a94e-ea7bdde3a7a3", "value": "3072:TXgfFHtxm2caZ0s0F5zTEj8zC51dhgm2B:L8htxm2car64Qqdhg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647841677, "uuid": "45f1c982-d5b2-4d37-8006-00161da21ac7", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647841677, "uuid": "b28b4c87-9d75-4a97-a1aa-b4f34a369599", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647841677, "uuid": "421477df-f30b-48f1-822b-42109a626301", "value": "SecuriteInfo.com.Trojan.GenericKDZ.85453.31298.9882", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e376d1ad-a8de-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647843579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647843579, "uuid": "4f24e524-b7ae-4031-afba-d2b5a0ae7496", "comment": "Malware payload (SnakeKeylogger)", "value": "7c134ece929da3b9b69840c8e2c456dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647843579, "uuid": "f469c8a3-eea7-4d93-8b99-e844b8f46197", "comment": "Malware payload (SnakeKeylogger)", "value": "7a4829d4d5efb685669561127e319835be05a9485505b052f52beb7535644c98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647843579, "uuid": "ab568df7-7aa9-4cb4-a513-925214796b84", "comment": "Malware payload (SnakeKeylogger)", "value": "c0601d0e5d06331f2be5baf0815c49f41a4991a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647843579, "uuid": "720edf6c-4d54-46c8-827e-77b5968e0d52", "comment": "Malware payload (SnakeKeylogger)", "value": "42010e2e7a1bb1408be8fd0555334a8447267130f15d5fdd29858736bbe821b7db7a7c91557f13d8e6ef78334d192c16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647843579, "uuid": "6f358510-19ec-4434-a32f-92d277d48062", "value": "T1EB2523AB73A007A9CAA86A35C56990DCBF1318AD2E43FB0CECD55147076E7262C1717F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647843579, "uuid": "4325c0db-ab48-4f02-a201-0edefd01d0b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647843579, "uuid": "e64ae432-b2be-4ce8-9786-b8292b8171d5", "value": "24576:8uVl9zs/kbj7wKXOVrj/Pk40U/Vfd5CYascMyjA7:8upzRbj7wFrPjhNF5CkcM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647843579, "uuid": "78a392b2-5f05-448a-86e9-e6b00624643c", "value": 973824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647843579, "uuid": "c88ded7b-f4ab-4454-a2ab-34740b76833b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647843579, "uuid": "c7a56036-ac36-4f1a-b236-2be9a242d9d2", "value": "BP1090 PRO_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14fe9740-a8aa-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647820899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647820899, "uuid": "4c87008d-b8bc-46a7-b138-7c34672f8df9", "comment": "Malware payload (Heodo)", "value": "d1e5d7e95328864bebd836d7b0126863", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647820899, "uuid": "d92f90d6-5350-4cea-a454-39ca6972977e", "comment": "Malware payload (Heodo)", "value": "7a60e45714c7d9010247a2fd2b8569c83b374ed2ddd15291483bf6b14c6d27a9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647820899, "uuid": "3920da57-60b4-45dc-9557-4d0458c853ab", "comment": "Malware payload (Heodo)", "value": "e9919959ea547ecb1c5024cedb5a7f2b702bf2c6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647820899, "uuid": "7a43fec6-3729-4fc8-a332-1b619b15c35a", "comment": "Malware payload (Heodo)", "value": "852627a5369d2a8868c75595583b06876298f2148c10215f61bbf415b40ed5d8d34a80e0bd3257b8a52f9e282b6add67", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647820899, "uuid": "083bb7a5-7229-4f3d-a9aa-cc63cde81431", "value": "T1FCA428123CE2B072C89BD0348FC56164855FF5F5AFA6727E62FD629C4B24DA18E17B02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647820899, "uuid": "7d5e4743-86cd-4ea1-b598-a90319681bd8", "value": "3881d76bffe56c7cefb6ec7d56cb4aac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647820899, "uuid": "11b62b0c-c133-4f8e-aef0-48345552d938", "value": "6144:2zP28Xoxy3TAaZOO+k/EWKdguBw423quMsLh+tEgrtenN6YlXmcwT:2zxTlZP+S2x/23q7sEbEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647820899, "uuid": "1d178f95-59fd-4433-8fe9-9d96df93276e", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647820899, "uuid": "1e863c6f-b8b3-45cf-8bcd-f6124166deb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647820899, "uuid": "a234ced8-dcd4-4f73-90e3-2beffb603a9a", "value": "emotet_exe_e5_7a60e45714c7d9010247a2fd2b8569c83b374ed2ddd15291483bf6b14c6d27a9_2022-03-21__000134.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c325ab-a954-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647894075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647894075, "uuid": "2a9ca12a-7207-4f20-a496-aa7387acff83", "comment": "Malware payload", "value": "7bf3a72a5287c6388cda810822c894a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647894075, "uuid": "32620f01-7656-4056-ac39-419e2b13a477", "comment": "Malware payload", "value": "7ae4237b70f7233f779dbcde9db944e13472a1c4097baa4a17f5e769e0869476", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647894075, "uuid": "b981c7e3-b88c-4e1a-9a55-6b56f7388aea", "comment": "Malware payload", "value": "4c23e414457d18ceee367a19afbe0c51588c3df0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647894075, "uuid": "3b7da5a9-2c07-4a65-8413-b8e119fc2739", "comment": "Malware payload", "value": "95f94b23471fa0795ef4e6f1cfacc2ce0e57ca26aee8025349305339202bdff76422633420fb6596a5cd7dd0b09b40da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647894075, "uuid": "8f0b2a06-74c5-493e-ad8e-326ca50a6286", "value": "T18F86332AC6D591F5E42A5BBC4AE19163D7293DD61FB861FF23B8C2312D316C86831B0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647894075, "uuid": "327ed102-6702-49f8-a624-65058bcae6a9", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647894075, "uuid": "c1c71430-c408-4876-845d-eab80f821d1a", "value": "196608:rszWCrZ/1LjT4vlo6vqDs7eAlWCOETnNoauXM/XRDC:rsKCr4NlqD2KEhLRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647894075, "uuid": "a019aeaf-89ea-4d30-8a0b-41a52f207477", "value": 8078848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647894075, "uuid": "261a4795-e8ba-495c-bdce-03895c51eef5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647894075, "uuid": "839179ec-f7b2-4f7e-971e-331d0b22abbf", "value": "SecuriteInfo.com.Trojan.Siggen17.24708.25098.10939", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c66b3423-a8f4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647852979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852979, "uuid": "212bcd35-cac8-4381-9ae5-73f940a9bc46", "comment": "Malware payload (Heodo)", "value": "b7b57fa2cf3af783be6aa353ed6eddd8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852979, "uuid": "940ed41e-0173-443e-a6ee-017abf046716", "comment": "Malware payload (Heodo)", "value": "7b5416fd6e4b19cc3c839bad3cd00ddf84ad143deab7d35e16d2fae7d670e11a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852979, "uuid": "d79a89df-2b4c-405c-90da-540bb7552966", "comment": "Malware payload (Heodo)", "value": "457579c7d96f95d88986baa60ac1ff0dec0ea768", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852979, "uuid": "b959ce97-e9a5-4564-879f-783d7c182cea", "comment": "Malware payload (Heodo)", "value": "2cc5826e7a754ba1a60dc94e3edcce1c776281ccbca6cc0a41401ea8fc4a591bd45f9a964d31e592013fea721fa9c2fe", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852979, "uuid": "fa9cde64-aaca-4b69-a1d0-ae62af51bcd7", "value": "T1F0F2AF30F2E29B59E436587C4B8CCAF4C77DDB2252067E2D309E53BC5F126666A4E24C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852979, "uuid": "2916c228-ca7b-4bdc-bffb-4d6d0724a5f6", "value": "768:KYKtm5eMn7AjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooXLR:KYKtmg+UOZZ1ZYpoQ/pMAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647852979, "uuid": "33b7a6e5-f2dd-427a-8ef0-3c48e94e9bb3", "value": 36591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647852979, "uuid": "0f7cf601-0da3-4f91-897b-e077decad6c7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852979, "uuid": "04f05303-6392-45aa-949c-bde9c0c64caf", "value": "SCAN_2103.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8133a28e-a8f0-11ec-9275-42010a9c0029", "comment": "Malware payload (Neshta)", "timestamp": 1647851145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851145, "uuid": "28d7858b-e969-48e8-90a7-fe4c2507fea6", "comment": "Malware payload (Neshta)", "value": "d86b988a39328a2bb9ce77dac0ef6328", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851145, "uuid": "f6cc933f-463e-4c93-940c-07a698e66ab7", "comment": "Malware payload (Neshta)", "value": "7c362742a80fa19e2962e123eea0d7beaf76b6c825cf77b1941dea48ee4a7c51", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851145, "uuid": "b34624ad-0334-441d-a00d-5e71a3e10259", "comment": "Malware payload (Neshta)", "value": "b952f784b3483a67256c771878d67e690865428e", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851145, "uuid": "ecac8947-d70c-4cd3-a68c-e7a9403d25ce", "comment": "Malware payload (Neshta)", "value": "c140a95410adf25ec33259352b8a29f8b3752c0548ece7fc834e7fdfec30930847d9c153b23dd0c687f716d3d60980ad", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851145, "uuid": "396aa244-ae37-489d-96b7-15164b408d51", "value": "T1B21412AA6531C94BC15E5C3B7956F01CCD208E577884FA683A0AF5EFC4328272B53B97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851145, "uuid": "2b4f0528-8d45-40ef-b352-752859c2a6fd", "value": "3072:SzNWG3h5xFg0RjuHMgpPlWm5pu5C1nbg6x1/jKjQPUI+KeYd272:SbnLRCHMotZICFgE5KoUFcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851145, "uuid": "5cae5f6a-8bae-411a-8a8b-98624b05b3a2", "value": 190472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851145, "uuid": "c27cf510-f750-4eb0-8f0f-4fbf09b33111", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851145, "uuid": "3e9f3882-4952-49e2-a5fc-d98158635f59", "value": "RFQ20022203.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b607ee57-a937-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647881728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647881728, "uuid": "ad85d5ca-677d-4e18-8263-1eaad8c73b8c", "comment": "Malware payload (Quakbot)", "value": "48116c4d8cf74403229148ca85fe2317", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tzr02", "colour": "#BAF7BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647881728, "uuid": "207b719c-b7e1-48a2-8757-ec46dafa84a7", "comment": "Malware payload (Quakbot)", "value": "7c9f9c2c98000be10ec407763b4af47667c98573928b5405790442e4b1de30c9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tzr02", "colour": "#BAF7BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647881728, "uuid": "a5e9b113-d605-4ec9-9f8c-2840873f6378", "comment": "Malware payload (Quakbot)", "value": "0c83bea14318d99e261e9bcfb6efc54c111ef144", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tzr02", "colour": "#BAF7BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647881728, "uuid": "75510bc8-0121-41bf-a1c5-be26eca9089c", "comment": "Malware payload (Quakbot)", "value": "20bafede98fd5cc222d9b179757cc397cb4f75bee8add5eac6cdb36f1386af83bff66d6f6f2833cdd4b5fa32b8ba931d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tzr02", "colour": "#BAF7BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647881728, "uuid": "a53aee62-c963-4e13-b760-de0e6f2c59f9", "value": "T1E525BE32D2D059BFC063FA396C37B250AC257E609624D5492BDECA4D4F3A68237347A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647881728, "uuid": "492b86a5-d507-41da-8791-61cd995ff176", "value": "02ee5adfcd75575fd1c162e026db2747", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647881728, "uuid": "573ca5d3-0735-4536-be0e-1553698c1d94", "value": "24576:3BaQJdd2bDKdPtj4DNBRLp7mj2KCMeGNruaVa6FZd:3E+dgM6F9AhS6FZd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647881728, "uuid": "08370263-8bec-4412-b5cb-48dafbfd3f6e", "value": 1015296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647881728, "uuid": "140ca957-3418-447e-9a87-e6d0993d3db4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647881728, "uuid": "749675e3-8a44-4e67-b84e-f5137941cb84", "value": "tzr02.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e3443be-a8ec-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1647849422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849422, "uuid": "086a4421-321f-4b0f-b472-dbb8946bec39", "comment": "Malware payload (Gozi)", "value": "b7419ae99bdf4bb0d53ac560e308565e", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849422, "uuid": "52e440d5-2cdd-48df-a805-92456b6f9a68", "comment": "Malware payload (Gozi)", "value": "7cbb379e78c7c547cfd1957ccaa0be899cb97df3d001605c9bd51cd70d975886", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849422, "uuid": "5f92eed5-b378-40f2-a689-f86e4b75d1e8", "comment": "Malware payload (Gozi)", "value": "f143fb4f0b339fecff40838b43a645fc0b056c5a", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849422, "uuid": "3ecc2670-c01a-4bf3-89e4-bef1ed0c4c94", "comment": "Malware payload (Gozi)", "value": "8ff7eb921076f93b98abca8615f9e2ef754a20218a5d783e6b49b71e2bcd96f51cb1a9c5533ab32eeb6a620003182d06", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "mise", "colour": "#B2AF41", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849422, "uuid": "f9678364-4fc8-417b-8787-7801fcd563a7", "value": "T1AAA47C22F2E08437D1731A3C9C5B97A498397E513D38AC4E3BE81E4C4F797817A66297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849422, "uuid": "388cc4ce-7fc6-4c17-906c-85cc4ad7210d", "value": "fb1f8e7f8db967a7b56f775d8d3c6c8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849422, "uuid": "fb4636df-5ba7-4c8a-bb35-62698077b570", "value": "12288:GXNEWSzLHeHktZ2VWzBoCMr4PoBmomfWSTF7s:GXOLzSEtZ2VWlOGoczW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647849422, "uuid": "4aae55d2-17e1-4da1-8ac8-c69746e12cf1", "value": 467968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647849422, "uuid": "93d430a8-51b5-4415-bf7b-32c25673670c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849422, "uuid": "e2717a81-665e-43f5-9c38-6dffa6348367", "value": "readme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c582a95-a8f7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647854090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854090, "uuid": "0cf628c7-6027-4652-b89f-ee96e314084e", "comment": "Malware payload (Heodo)", "value": "163436cdaecafa20a83804d8d09ae08b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854090, "uuid": "e9bc3c00-8482-468e-a5a9-ebcf0cd98f45", "comment": "Malware payload (Heodo)", "value": "7cd6876c5556bb6fb7cbf6ecb7c17fe4e8f1924d05695f06f4c71f4e64e778a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854090, "uuid": "06bb91dd-7bbe-4557-bc5c-6359e6aaf0e2", "comment": "Malware payload (Heodo)", "value": "64b7db96aa14118afefee5eee5f46b4ad5f7e592", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854090, "uuid": "a7beba87-3a2e-46b9-a914-6f8d2ed6b28b", "comment": "Malware payload (Heodo)", "value": "ef135097f3951cd59443875943fa40e862463ae9225e6dbb75bf5e20794420f5177414ecffc870c6471be15e5b820d93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854090, "uuid": "84a6ea65-83c3-489f-8db3-84e7b6033b26", "value": "T1AD056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854090, "uuid": "dc2f0ec3-23e8-4df3-89fe-7addd5b1e509", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854090, "uuid": "0d9b5c61-2261-4345-8f2f-305f051160d0", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rH5CGNHrH2tZ+d+:gMV/rH5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647854090, "uuid": "5d9c2f08-44bc-4c5f-a2ec-39e58acf8c1d", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647854090, "uuid": "4799a60a-1c53-4c67-b48b-d998aa10fe85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854090, "uuid": "7cbd0391-eb85-4c7e-be9f-cdf010a760e9", "value": "163436cdaecafa20a83804d8d09ae08b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8ea579f-a8ac-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647822006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647822006, "uuid": "37a2ef13-fe2a-47ed-89dd-18d4034df7f6", "comment": "Malware payload (Heodo)", "value": "7d4c482010ef10f03a5034c29e3eb899", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647822006, "uuid": "47fe8c68-2fd0-4a75-bd82-6477806317ef", "comment": "Malware payload (Heodo)", "value": "7d2cf8efaa4e63b1be0d0b7fde25682c8914aacfb5ec950204947028c5689cb2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647822006, "uuid": "0935f7fc-850d-4c5e-a793-3505d7b7f02f", "comment": "Malware payload (Heodo)", "value": "405c41b8e9ee65c36b42008c916f87d3060129ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647822006, "uuid": "199dab4a-070f-413f-a824-b2008c3bd4ca", "comment": "Malware payload (Heodo)", "value": "408f5f5f159f60c0c485e865800985fc71b74ab3036b6429f1b2599ac287ebbb51b851183cde8024d14d04ef179f4db9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647822006, "uuid": "2332d6b8-6e6a-4ec1-9ee9-e1230b236953", "value": "T149B43A317492B279C2EBD73408A35275B21AEDF157E274E36EE707CC4B366906E72602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647822006, "uuid": "3968b40d-6f9b-4fd2-aa3c-abf0a3b9973b", "value": "55cf9ae1e74cef637eafd17181390202", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647822006, "uuid": "556d1e71-87fc-4c57-9b28-150a405a6100", "value": "12288:7FFCpYDLbBHqKK85H3jI2VlMD4zeSvturG9+:7VDLbQKzVlMDOtv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647822006, "uuid": "3cf1fee9-ee49-4539-b83b-df0090983981", "value": 516096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647822006, "uuid": "c8094ba9-b7ca-4bbc-8205-5ea244c1a2a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647822006, "uuid": "4ac6e412-8044-440d-aa74-5a04e74419fd", "value": "7d4c482010ef10f03a5034c29e3eb899", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7396025b-a971-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647906527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647906527, "uuid": "f2b6dd3d-d38e-49b2-b9d8-ac19ad71401f", "comment": "Malware payload (Loki)", "value": "412c63f968695cb55a0fc6ee560806dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647906527, "uuid": "b3a90629-3329-40d5-89bd-9a6837a01d4f", "comment": "Malware payload (Loki)", "value": "7d46a9212c3221cefb29a7604a02ed077aed3dee376b1887565c114d7b151a58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647906527, "uuid": "287db6e1-82d8-4914-bef6-f977a33a1f7f", "comment": "Malware payload (Loki)", "value": "507189619e15e7e9b13cb673c45fc9c16b4ad1ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647906527, "uuid": "d7b8ca56-a178-48e5-9610-0c97a7f3cf8d", "comment": "Malware payload (Loki)", "value": "094b63d8fe1a8d4c28756c73b740da1d4bf79c1e74eb087aad186c61213cffd23cb34910aee6ccb83294f313bd3e1236", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647906527, "uuid": "4caf2586-8344-4966-9367-ce7e3ae74031", "value": "T108449E00BB90D035F1B712F8497A93ACB93E7AB05B6161CB62D51BEA16357E0EC3135B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647906527, "uuid": "ac0cbf34-605c-439f-9f39-230d19826e13", "value": "42499a002b9d8635fd26126765c4da68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647906527, "uuid": "df4542d2-d1d5-4b3f-a586-6ce70df57524", "value": "6144:PF+8XXfkWshZUeLq78EvVc/cA/iZvWwLkKko:PLXXfkWshZ7MZvM/avWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647906527, "uuid": "965abcdf-5260-49b1-bb90-c4ca44a8e83c", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647906527, "uuid": "61a8a299-15e1-4369-8479-edd1e5110710", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647906527, "uuid": "8b4b635e-4bb7-46e2-837d-cb46966425de", "value": "412c63f968695cb55a0fc6ee560806dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a481a28d-a8f0-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647851204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851204, "uuid": "50d08bfc-0fdb-47b9-9dc6-c11e707e41ec", "comment": "Malware payload (AgentTesla)", "value": "6594f2893458960d73d9c894cb2bbb3e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851204, "uuid": "401f8b5e-e3eb-4773-8841-b1e1736a8375", "comment": "Malware payload (AgentTesla)", "value": "7d6fbfbcb3f2b4c0ffeb4c1362121df1047d225c1caf65328551d6a608cb862c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851204, "uuid": "bdb4b242-704e-489f-85f9-a13c05ed6672", "comment": "Malware payload (AgentTesla)", "value": "fdea60520afb2b23c0ab460d12475d6747151d6b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851204, "uuid": "557d3220-b237-4ccf-8ffe-c11ec912a4d3", "comment": "Malware payload (AgentTesla)", "value": "b9e186931d05c8de8ef8c852b25ec34041b407ce8aa7871a8981d0fa030fb0bae32f01d61cfec6de11dbfb60d41919c0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851204, "uuid": "9ef6446c-c7fc-46bb-ab99-cb3ccdaa38a8", "value": "T1C214126FF65B4391E2E23672870E5C590762FEC3E463A65E084EF0897DFF9468443A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851204, "uuid": "0bf5c0b2-1c74-4346-88fd-9a554f0a7d0b", "value": "3072:pEZ4wZ5J2dQhWFqIffequqh3RGTv1HD9YM+unQg1pOHTOfB0H0YgtkRtnoD+vTEO:OhJZMPh3RgcMLQA+qcgtstnyawk0aNQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851204, "uuid": "f2066dbd-5330-4f5b-a43e-5b74da16ef83", "value": 190456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851204, "uuid": "dcefbb3c-ec6e-4ee0-8a2a-edda749daa27", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851204, "uuid": "012810c0-7f4b-4e18-a63d-28d625ef9360", "value": "New Order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcf80a9c-a8df-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647843944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647843944, "uuid": "c3e0420c-9126-4570-b2ba-e39c0aac6f91", "comment": "Malware payload (RedLineStealer)", "value": "a2d3bf8915c443c9e3769f1311fd23e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647843944, "uuid": "0d83f3c5-6a4c-4cbd-9e91-c88eb0455e8e", "comment": "Malware payload (RedLineStealer)", "value": "7d920261dbaf11e47d86daafef7d2da06da6315e65f1d101634788d1e85dc48d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647843944, "uuid": "4ac2f9a4-c0b6-437f-b8a1-a35303cce1b1", "comment": "Malware payload (RedLineStealer)", "value": "6da3591926242dfe8e603a079cf1fff4af2fe7e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647843944, "uuid": "148aa0c5-f56a-447f-a35d-bc1a47578c8d", "comment": "Malware payload (RedLineStealer)", "value": "40685ef91a1a9bfd53447d10aee751ade5fa7ce2f49a898ce0f436cdbb3270c94107c9906c644ef769086dd5d913733c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647843944, "uuid": "bfb61081-14e3-4cd8-a7a4-ef2d64097302", "value": "T1990633942E0AD1D3DB7782F29AEB1B50B671802FC9AA470663CEF70ED2D7144329D635", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647843944, "uuid": "479ef807-58c4-42bd-a6ae-4e17a97c04ad", "value": "18df1dcc1fa258b4d6e464d165239b75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647843944, "uuid": "deb07773-8598-473c-9a34-e350eac21162", "value": "98304:+AjidbU9MNdfMdXpx16xEtrNHfif9dICN6LDo:pjiWM3AXrmEtWtoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647843944, "uuid": "3b8f9644-0e78-4ef7-94d0-ded7e9b4d98a", "value": 3774512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647843944, "uuid": "307d0489-427b-451e-8880-ff44241d54f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647843944, "uuid": "244e8b0e-2000-4278-8aa4-f0fa41b881ab", "value": "33774358.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b60a2242-a914-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647866696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866696, "uuid": "285135d4-d041-4fa6-827b-bfb59390d6c5", "comment": "Malware payload", "value": "b83172915e36d9a685657dabb43cbe47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866696, "uuid": "8399ede1-cebc-4adf-add4-b648420a757f", "comment": "Malware payload", "value": "7da585f221381494431723c3c35838c7e82c563f22e16fb806a5e63ed2fe7ce6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866696, "uuid": "eced554f-f0b1-46c5-bf20-83a8250053b5", "comment": "Malware payload", "value": "e3049bcf9cf493b8a17ffb33410d1e8836f34bb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866696, "uuid": "d152f76b-166e-4cfb-b75c-97cca86eeb37", "comment": "Malware payload", "value": "bc998a9e95474e02aa71fe53ecdaed79da77c89c27e51d8aac09212b2fc0a6903d7a557a0ed6ea445540617526b6efe8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866696, "uuid": "c754103c-d789-4da2-bc1d-01ade0503e53", "value": "T1F82522FF26A44E37D3AC0ABBD4A283D977B2C5637513EF822ED9D8AB448334151042E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866696, "uuid": "9c32a6f8-cac3-489e-883b-bb5fbe35cedf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866696, "uuid": "a2f1d3df-a0ee-4725-8cb6-985a9314c086", "value": "24576:6wOGDxJ8u+k23vSnUNm7DtClr0vPlwMiX8xUZhC:6fGXh+N3Fflr0Ff+HZ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647866696, "uuid": "87c67198-3921-459c-98b7-36463b5fe27f", "value": 1046528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647866696, "uuid": "f5a86fe0-5a78-44bc-b53c-45b77fbaf303", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866696, "uuid": "a76c49b8-d987-4af2-9552-e7e40923f75c", "value": "Pedido.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2600b055-a92f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647878050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878050, "uuid": "177f49d1-e19b-40ee-8c21-cca3942c092b", "comment": "Malware payload", "value": "9ec14db1d3bcf639a59f364d186b7e58", "object_relation": "md5", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878050, "uuid": "dfd2c3f2-f6fe-4d72-9df1-c9b37150bdcd", "comment": "Malware payload", "value": "7dbd0d8e8541010d138e2b027842569a289b1b76eab7bf58029ff5b0d5b857d3", "object_relation": "sha256", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878050, "uuid": "e78a8b79-69f3-4cbc-804e-565117a4e2d8", "comment": "Malware payload", "value": "66447ebaf888156d4feb86d17caced35c0091be4", "object_relation": "sha1", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878050, "uuid": "89de35e2-f6bc-4ef2-9cbd-43c9d372305a", "comment": "Malware payload", "value": "9ab9fcdcef51103f6d9d836b546a0c5dd1f5aa9b2fa0bd096acaa3765622c168cfa3cde25f522f7be626663f546eb51d", "object_relation": "sha3-384", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878050, "uuid": "8f92be26-3d7c-4478-b652-fc29694769b3", "value": "T15182D01DA4777E0852B9F04BFA24EA54C1CA9057AB607D9F0C351C43CCE84CAA1C692F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878050, "uuid": "bf6d408e-1a96-4051-a334-2b889fed5867", "value": "384:nJ6lbw0hPl65fJVUDuFKU8pa/er+WEEgHMT8vjMR:n2w6AVUDum+WEE4MTNR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647878050, "uuid": "29cd44a4-94af-43a9-99b8-897f6ae2e6c2", "value": 17781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647878050, "uuid": "a7bcc4cd-755b-4a48-b08c-ee8df120eb19", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878050, "uuid": "bdd7ac5d-85c9-4a7b-920b-5c358502c86f", "value": "JWK-010322 MYDD-180322.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac7e0f26-a914-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647866680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866680, "uuid": "362f4458-56a1-408c-90eb-6f94b34dfc82", "comment": "Malware payload (Formbook)", "value": "5978c05476263bda7d960999d199231b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866680, "uuid": "776c38a1-65b0-4f90-940e-5edab470ed86", "comment": "Malware payload (Formbook)", "value": "7de9f7a81557d4a2a6818b50b8f8ab8948ce6329bf1c696d038e1231237a07d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866680, "uuid": "b40027f3-f969-4f9d-a22a-a77bd0d8eef4", "comment": "Malware payload (Formbook)", "value": "ddb2e6c5412027261ca3f339e73a309451aa88b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866680, "uuid": "71522306-9886-4a32-ba97-808e3818cb12", "comment": "Malware payload (Formbook)", "value": "c7dd722a37aca046f40547399ad8a6d47514dd223a3d9f710c6d77a4b74e5f7a83b1955de9411d1d7f4ee3e8d0c8a743", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866680, "uuid": "3fe0a93b-7eee-4ae2-b966-83df4dbddc09", "value": "T10564234743C0A9FBCDA2593A2D32AB7CE7B3539013AB344B0BD82E7E51B63A64155607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866680, "uuid": "caa9a122-4989-42b2-aad4-266fbf72270f", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866680, "uuid": "7ce70bf0-ba58-4ae6-ac00-d691a25eac3d", "value": "6144:rGiuJdWYNKtZP6HQiQA7TnwxMxsnE6SejO+01N3YneWh3159LMVJ0iCe:iCY60HqA7TwKxgE6MD1lSph3159LMV2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647866680, "uuid": "d1550d14-e2c5-4c9f-b6fc-1716edee93bb", "value": 308927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647866680, "uuid": "25cf5087-cb8f-4458-8258-ed5c804807ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866680, "uuid": "cea487b3-ccf5-405a-a664-d0ef0c70df54", "value": "Boat Payment Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97f66070-a8ed-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647849895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849895, "uuid": "511f0aa8-164c-4452-91ce-f33ffe841779", "comment": "Malware payload (SnakeKeylogger)", "value": "0db84cf86fb977c7a8ad1510e2d75d08", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849895, "uuid": "c6676766-a7a5-4786-91c0-8a4f71a83d97", "comment": "Malware payload (SnakeKeylogger)", "value": "7e72008e720939c0f3111e0594ed99d04e5beb0038b6294702736295cadc32d1", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849895, "uuid": "ea8c199e-1d43-45e8-a96e-9f1d26a7bd95", "comment": "Malware payload (SnakeKeylogger)", "value": "b1a17ec58426a097c77be92622a25e536b46686b", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849895, "uuid": "d2e974e8-b853-4cbf-b84b-9091e0f6aaaf", "comment": "Malware payload (SnakeKeylogger)", "value": "51192a2392f13a60ccebf521250181fd2be9930aaca7ebbbc222a734d9cfa7a2bc3c207e97796bfd854063a1b4faeaa2", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849895, "uuid": "d20088cd-90bb-4e3a-b064-9dd86bdd0f6d", "value": "T17D25234317B808B3CD4B3775089063CD29B688497251D987F89E9A86CAE37AE4D477F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849895, "uuid": "00afc826-731b-4fe9-ae7f-53637c730b5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849895, "uuid": "ad3bfb9f-2b5c-4a9e-8a04-45fe90f2b248", "value": "24576:jY9bb7wulP08Y5KHqNhWGw3wJrWTnaIpfHxCld6+OR4+x:8bbVJYUHSMeSTnaISlddO24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647849895, "uuid": "ccd20bf1-ed39-47a5-bce1-c16bd24523c0", "value": 980992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647849895, "uuid": "2b036e02-eeb2-4939-b1c9-c8d1500c7d52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849895, "uuid": "3cfa6038-4f0f-4805-9727-b34f52caca51", "value": "QUOTATION.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe4f253-a910-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647865075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647865075, "uuid": "0f52f1bc-b6ac-4bf6-a5b7-e2b3bc947815", "comment": "Malware payload (Formbook)", "value": "6ff6999c6c89fea9de8b27ec94bbf174", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647865075, "uuid": "f89aa90a-69b3-4860-8a98-c828a3c2e887", "comment": "Malware payload (Formbook)", "value": "7eb2becce841f683f30914c68c674c2e24a98e8b1f40232706fdc771716d4202", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647865075, "uuid": "d95c53fd-ba8b-4424-a314-59f9646e7525", "comment": "Malware payload (Formbook)", "value": "9ccbe030de519a2907e2f3be496dbcab209b0c76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647865075, "uuid": "7eb676b8-6b2e-453a-b4e0-e34960121112", "comment": "Malware payload (Formbook)", "value": "1ade6f7f2f583b16042c0fd5274227b73d04aa950653ae24f04eb814477cad692fc023ce7240d97bee96fd0fd7e6b673", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647865075, "uuid": "f76134a1-6fba-4c55-ac83-d0c0887a08c2", "value": "T11855D00EF7916D59C92D6E33DDEDB875403E5D0B3AA3FB24565ADEA52E9230340A003A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647865075, "uuid": "30b5a73d-58ad-45fd-92cc-a2b2642053aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647865075, "uuid": "673f54d8-c14b-445c-a9e6-372716dc8874", "value": "12288:KbiKvgg/FnxfycJ86f3Y0FyFa0I+Y57ZCH9eX5/EMs6iKhsrjYjcwsTBKZxGQ4aR:KGKvxnqlsx0I+4rFiHk0mj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647865075, "uuid": "741318f6-6988-41c1-bdf0-5b8589784e0d", "value": 1362944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647865075, "uuid": "1c41bc3e-c9b2-4c7c-890d-8f0b02a1c5cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647865075, "uuid": "e773bf73-d106-4b2c-9ec6-d8819eb11f3c", "value": "SKM_C55822031512420.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7fbde1c-a8f0-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1647851237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851237, "uuid": "a4ebcec1-8b29-40a9-850d-2e98097c8ae4", "comment": "Malware payload (Smoke Loader)", "value": "5e40610e3e57f33de816c157f552b519", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851237, "uuid": "0122fa77-bd91-49ce-ae84-6cf167d55a47", "comment": "Malware payload (Smoke Loader)", "value": "7ecc89ff912c4137fc8b0d5e6a4c1b3bbd84b958fb0d6dfb56d98b4b1ac890ee", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851237, "uuid": "0765bc41-8758-440e-93ae-3ca8183e0efa", "comment": "Malware payload (Smoke Loader)", "value": "2f23ed1c0729e67ed4919ca535205bfceed03f98", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851237, "uuid": "275ea9b8-c0ae-48cc-b42c-79d732ce25f4", "comment": "Malware payload (Smoke Loader)", "value": "fa0e74392c0ee8d74888eee4f618dbc401a9d56ac35fd254d6bb3654bb1d42b57af77ff530d3dfbf424fbe281b391f87", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851237, "uuid": "1f0a7a18-9745-44d7-9db2-ef07f88cf535", "value": "T1101413B6727620B6FBC60BBE6809EBC9A062FC10AD54211110D737791D3ED9EFA50263", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851237, "uuid": "f1aaca8d-352d-43ac-afd3-970d725051c2", "value": "6144:c2HnEyrFiwBxezjGomA3jOUxQ0US9jIXx3g8LJz:FHXzLAlUkjIu8LJz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851237, "uuid": "0f519262-541a-4b26-9ac1-59ef7bdc479b", "value": 199432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851237, "uuid": "1b4d6e4c-6378-4e37-8c40-9c6e7dfe57b7", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851237, "uuid": "22987157-7f68-4523-a7bc-0e853d4ff6ea", "value": "NEW ORDER-HZS-2022-0332.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09b0632d-a937-11ec-9275-42010a9c0029", "comment": "Malware payload (Hancitor)", "timestamp": 1647881439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647881439, "uuid": "82219b66-00b6-46d1-9b10-8e1432b6f9cc", "comment": "Malware payload (Hancitor)", "value": "2549fdb48c76b7dacf0dc369e4c7e8db", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false }, { "name": "TA511", "colour": "#4A8AB2", "exportable": true, "hide_tag": false }, { "name": "Tordal", "colour": "#DC4113", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647881439, "uuid": "b3758892-5b26-4e17-93b4-598e9f82b4fd", "comment": "Malware payload (Hancitor)", "value": "7f19bc8eb8f0555986de478bc9a17a8e052f4a9262b0a19b924d8e9c66a01ca7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false }, { "name": "TA511", "colour": "#4A8AB2", "exportable": true, "hide_tag": false }, { "name": "Tordal", "colour": "#DC4113", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647881439, "uuid": "862ee040-f6cf-4a4c-954a-b6c33632c730", "comment": "Malware payload (Hancitor)", "value": "75036cb314bb9f1d38f600a795fdf1bbfb14568f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false }, { "name": "TA511", "colour": "#4A8AB2", "exportable": true, "hide_tag": false }, { "name": "Tordal", "colour": "#DC4113", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647881439, "uuid": "a44670f1-6aa0-478d-bd26-cfb2d74e5f22", "comment": "Malware payload (Hancitor)", "value": "d22199395da3caa6b0111ba17031b2e432db10907d2dc6bcb749197d6caeed3be9356b349682cace4ac3d20204de872b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false }, { "name": "TA511", "colour": "#4A8AB2", "exportable": true, "hide_tag": false }, { "name": "Tordal", "colour": "#DC4113", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647881439, "uuid": "21f4b81a-26c7-45d0-b535-ebd6a90af128", "value": "T161252346FEC29F63E26B9974A9D7C56E622CFC496EA6C007B3653B4C7074BB051E200D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647881439, "uuid": "a670e25f-8e6d-41e0-9cb5-3439b8ad9864", "value": "24576:MFW1KECuoOpbodVYnRI50bl1n19X6cpALHKeZBdQm1Xbd:sECuoQb8Vf5ynfAzpT1Ld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647881439, "uuid": "9f347750-e4b7-41d1-8c2a-fab91a78ab7a", "value": 965632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647881439, "uuid": "9b1aa3b0-a68f-4fae-9e43-941bbeb001d0", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647881439, "uuid": "60384b12-cc48-4d86-beff-86284453ccac", "value": "K3362p2954.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3bbc29c-a947-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647888703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888703, "uuid": "ebcc4903-536e-43a0-b203-be59a120604e", "comment": "Malware payload (Heodo)", "value": "a568ddd72bb56ca027cb34c6c69fa858", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888703, "uuid": "c14ade83-6125-4fbb-80c9-7d61e0c1769e", "comment": "Malware payload (Heodo)", "value": "800096af7579aa612600934de8e1bf65dec71ec3639342fdbb2a3ffa4fb77e65", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888703, "uuid": "5ccac911-ea5f-4d85-910f-643389cfd8f7", "comment": "Malware payload (Heodo)", "value": "6deec235fbfa85f71b68ffd32868f6dad4281982", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888703, "uuid": "f6aeb2e9-b73d-47f3-af4e-7af92e991521", "comment": "Malware payload (Heodo)", "value": "2acb5b768a0abbb97e72205a74b24c4ecc8c315aabe192b768a5fe7db193e11b043b517047c0327a9f7788b84073b9dd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888703, "uuid": "d6d0d5ce-dc88-4c87-a5bf-b762544104bb", "value": "T17CB43A11BC916832C36FAC7456073262588EE7F0DBD1F26FA3E0495C9A7C5E36624BC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888703, "uuid": "41bcbe8f-e3e8-4946-ae67-fce836ee81e5", "value": "14e6ae8d1400b6271725b3f01025b85e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888703, "uuid": "6d572ff0-5f8b-4c55-b9b0-e5a6243ac74c", "value": "6144:VikzyaB9eoCyx/mEhHB5RYSJ/x/+qiCjzQNPj79GkqbscgCG5qH6scI:VNnCGmyHB5SSJpy0zQN39GkUGQSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647888703, "uuid": "3a72890d-70b7-4e16-9c58-3cf9e9687c87", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647888703, "uuid": "c923b1dd-8df1-4052-838d-1dfd741363d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888703, "uuid": "07b3456f-54f8-4f10-851f-16eeec6760ce", "value": "Z5DBBnZcxvz6R.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94c13b63-a8ed-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647849889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849889, "uuid": "8fb0b371-04cb-40c9-bcfc-fe58062833af", "comment": "Malware payload (SnakeKeylogger)", "value": "521fe9dd772251e734498f3eaa7356bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849889, "uuid": "b7b7ad8b-ef80-4f43-a760-225769b106b4", "comment": "Malware payload (SnakeKeylogger)", "value": "80b951487480012a3af8fb085e253a8f4b085dbd3df617d8f5ef6b8323e4af2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849889, "uuid": "52d068d8-f48c-405a-aa7b-7b4c891c5302", "comment": "Malware payload (SnakeKeylogger)", "value": "783319958a7b60e463efec19b2e07b8fd03bb2de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849889, "uuid": "5a696fbc-ec65-4c18-b50d-3056a69c482f", "comment": "Malware payload (SnakeKeylogger)", "value": "31cfac4b2c346a812a3ea27b8ffc48a1ac2b44ec7451365fc6c576fda1f2a9896c19b92e80db57908cc3783ddccc926e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849889, "uuid": "1b30872e-2526-4e6c-b4ea-27401144560a", "value": "T15325236E22E80764DD38D333D8D490D82F7309827945EBAC6D90A7D91A43B585B7B33B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849889, "uuid": "291982b7-e369-47ee-8530-0429aff2912d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849889, "uuid": "1b56de46-7213-429b-9de7-6a7407ff1c9e", "value": "24576:TUrl94WU3I87FNsxTqRyg9313MJkvMQgMjVMI:TUD4BIF5qcgzMIMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647849889, "uuid": "9a7e6234-28b7-4c27-ae5b-cd05a32329c9", "value": 966144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647849889, "uuid": "7de96c53-dbd6-4ee7-a58d-1934321e555c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849889, "uuid": "5bbbd230-e5d4-450c-b9bf-d9f2206f1ee3", "value": "OA_29300761REVISED.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84bc654e-a918-11ec-9275-42010a9c0029", "comment": "Malware payload (Stop)", "timestamp": 1647868331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647868331, "uuid": "7943db1a-2b4a-42d3-b4d4-964699bf4f8f", "comment": "Malware payload (Stop)", "value": "bdf006ab7d3b4238dab5d9b3d65cd64e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647868331, "uuid": "18c83baa-cbff-4d63-8a0b-ac33d3caea13", "comment": "Malware payload (Stop)", "value": "80cdfc120b7824e7cb5b34fc9ab1b6b43b84dfb435fd8f3e681ad4ae0ebd41de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647868331, "uuid": "0bf754d9-6240-4a8f-94e1-064c6fc33f5a", "comment": "Malware payload (Stop)", "value": "8d0a87a19e5c1be940e8829aa5ee9be5312fda67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647868331, "uuid": "34d08782-7337-4ac1-b992-c1fd7bc14e36", "comment": "Malware payload (Stop)", "value": "6466a25d9e17453bb1a1d4d66309da40a325b35dab5dde8de9193048feda16e398a4f02aded1c06c5e418780b06b9f9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647868331, "uuid": "0fdec0ef-50b4-4bba-b027-918833dafa95", "value": "T129245C3AA750F436F0E20439A4DF83F6642979307B55C8EBB7954F2A6A715C29130F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647868331, "uuid": "e415c024-aeb8-48cb-99a5-4b5e1242c9be", "value": "ef16730f39cfc071fa7952154fe83b40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647868331, "uuid": "7cd2c2fe-c133-4917-b1d3-51e8ccd46c53", "value": "6144:N+nnYaV16r/eafGZK87gHoLBnluwMKwr1g:N8Qeafd8oofuwMKL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647868331, "uuid": "81119f4e-43df-415a-ae9a-fbc8d1fed9c5", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647868331, "uuid": "07f88b4c-baab-4d32-bdb1-ba6e86e33685", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647868331, "uuid": "d1dcad0f-b8f7-4c1f-b4cc-d4fdac8ddd39", "value": "80CDFC120B7824E7CB5B34FC9AB1B6B43B84DFB435FD8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35801b1e-a90f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647864332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864332, "uuid": "cf6cd15f-de2b-4459-bfd7-ecae3520a267", "comment": "Malware payload (Heodo)", "value": "74ac721fa280c01118785f6cb1872a74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864332, "uuid": "43fb915f-dd27-4bff-9a6d-ff351dae9d2c", "comment": "Malware payload (Heodo)", "value": "80f468a32c02ceee0529576abb5d5bac81009b449f203add20de0ecc75b4e515", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864332, "uuid": "1c9b5ebf-ffa7-4a1f-bf7f-4764d1b49fa7", "comment": "Malware payload (Heodo)", "value": "b041e4c4b622e5f7e3e7fd019dff5822b866e4ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864332, "uuid": "099346d2-756f-4226-8f04-614f169d6649", "comment": "Malware payload (Heodo)", "value": "02bb810d80946abb92ffa0e33eb63c94e67a635446e3cc67ec422667c0cd304858308a2176acd5f85d1b8da63045c81f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864332, "uuid": "2bcd3eb6-d894-462a-9ae0-974a88a259d9", "value": "T145056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864332, "uuid": "4d4d7d9a-b555-457a-85eb-d43e7e656134", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864332, "uuid": "186f7888-02fa-4622-aef9-048a45b71622", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rT5CGNHrH2tZ+d+:gMV/rT5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647864332, "uuid": "0bc9e719-4613-47ba-95da-43eb864c175f", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647864332, "uuid": "4fecc314-16d3-46d6-bba2-0eb93d9351fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864332, "uuid": "e8df3a57-04ec-4fe1-b93a-7a1f779bdb02", "value": "74ac721fa280c01118785f6cb1872a74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "925d939c-a92e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647877803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877803, "uuid": "e3499fdc-29ff-4c0a-9914-e4bd2defc333", "comment": "Malware payload", "value": "370ad4a2ec2aa5f8a729ed1164682a7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877803, "uuid": "688a6a71-0965-4b6a-8129-d570bc8517d4", "comment": "Malware payload", "value": "818d393b502a3fef64b2bfe37ff39d1319f359398eff0ed96d7c0f3a1171755c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877803, "uuid": "ce5d1f14-6d38-4212-a577-9f3e50a3667e", "comment": "Malware payload", "value": "7d57ece04ad69641698c55a072dfd478a48184bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877803, "uuid": "0183eb19-8b73-4c98-824d-d56786e58815", "comment": "Malware payload", "value": "a8f8d250d35e1e27e60bf27103dbd8e512efbfe00abf7bd5e39586b46bea13da97ef843adf4ac9f311ef160ac3611573", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877803, "uuid": "8aa68163-b6fa-42bd-9f78-d7023cb5a02c", "value": "T18E1733133225DC9BFDA272769A0BED9567AAFF052519C6CFB601739EAD302F1C018781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877803, "uuid": "34489376-8580-4005-a711-f509c2f03453", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877803, "uuid": "45809250-6d62-4482-88a3-24289e95e4bc", "value": "393216:kutkF/Xv7cKbS7O7baQOTreusBWDfx/AGUorUjGFqyJgLUtGJ:kutkF/zcYq0UTr0EJbrUjGI7L3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647877803, "uuid": "6f127ab5-9255-472b-a25b-ff900b7e53c1", "value": 19081112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647877803, "uuid": "ff958885-35cf-4033-b6eb-99edf46bda1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877803, "uuid": "7bb78041-0edb-4881-82cf-7e2c9f886835", "value": "wzdu53.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27463bda-a93f-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647884924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647884924, "uuid": "38b166b6-6397-4356-a8ec-8f864529de24", "comment": "Malware payload (Formbook)", "value": "03a113e9d7665163e11da0a30e0bb0d0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647884924, "uuid": "39ab4b6f-1912-4375-849a-aced19d49f91", "comment": "Malware payload (Formbook)", "value": "82344a1cccf5f3f5f48a2bb06beb448289dc7e7be250e359d6b9651ad3848fb9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647884924, "uuid": "0921365e-a2a6-4950-9312-c20dfcf4cc7e", "comment": "Malware payload (Formbook)", "value": "5133168b7c0aec34f8a405b8ebac0b59ffbbf1b1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647884924, "uuid": "67ef0eae-eb2c-4c7e-b816-a4cc7a9dfe37", "comment": "Malware payload (Formbook)", "value": "29e1822c318cf1c75eaa5c3e630c5a95fcb2d0e106482fa55326de8d44268b4762db3bafab7bb492e9561683f037d41c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647884924, "uuid": "e36fc3af-a848-44a5-b26b-552f5e00475a", "value": "T10C9423F890C59A72853FC99208B9CD424116716E3E6DCCDB3A5B10747EE9C4EEA2E11F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647884924, "uuid": "07ddb441-b579-4a3c-9792-72399a98df16", "value": "12288:qsTzugLn2RAj9MyEclCa9DccswJSCoSke:Vf7L2aXEhactOoS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647884924, "uuid": "91044e6c-081a-4df9-aec0-a511d77ce1aa", "value": 432099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647884924, "uuid": "b810300f-b542-4bfb-b774-440261633678", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647884924, "uuid": "eb3f6ee4-befc-4f77-8d99-d7bc3a96cb5e", "value": "QUOTATION.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a953d0-a914-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647866693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866693, "uuid": "7c62d1d9-fe79-40d0-bd6c-5a802dd0904a", "comment": "Malware payload (Formbook)", "value": "8ef333e61c8c8e85178917675bfb852c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866693, "uuid": "e75d70b6-3122-4f1d-9bf7-f6145d486829", "comment": "Malware payload (Formbook)", "value": "834bbca917e33d612d4989b3b68ab2aec2d6f5ac27494514238eba9f579d9a95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866693, "uuid": "06505a16-d27f-4c57-9c12-4f968961d838", "comment": "Malware payload (Formbook)", "value": "b11b26da2ab8b2d54436a0ffd0c3612bf79efc0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866693, "uuid": "015c7199-70c7-4f97-a4bf-c1814fd9991b", "comment": "Malware payload (Formbook)", "value": "a56ab2ccd275824f0542cfda721f7404dd007d222835f9e43145b7549ba0a04adc47484b98d968b5ca2bad6087f600a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866693, "uuid": "15ecfbc1-8554-4b87-a3f7-2abcd79d2522", "value": "T1CD355CF5A2508432E4223A784D5F4EB9B8297D00DDE46946AAE43F0D3F3D6B1FC21A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866693, "uuid": "b82b5016-f350-44eb-aa03-5a50532acc37", "value": "066f2adf6884c84166ea572f3442e2f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866693, "uuid": "b1a1abe2-f4d9-436a-a3bf-63cb128fa6bd", "value": "12288:RbojJKNbgMwT2NRAvS/yqenMbJjRsBp8oziAO8Iz2sVW3MsqI6F3HAhcAszeVQ18:elKiCRAvS6qOMZGBNgziqTHAhU2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647866693, "uuid": "227bf0c4-d487-4dfe-bec4-fbcf288991d7", "value": 1156096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647866693, "uuid": "c4aaae1b-cca4-458d-9b49-fe9ec44d7635", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866693, "uuid": "636bd1a1-264d-492e-b14f-6d5b59d47a3f", "value": "Lista de pedidos adjunta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df188eaa-a8cd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647836270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647836270, "uuid": "d85e70d9-9602-46b6-8d03-1dbb3c07943d", "comment": "Malware payload (Heodo)", "value": "8bb0d17ef9baa890b9dca83bef9df9aa", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647836270, "uuid": "e1e1782e-dc00-467f-9163-083f77a35a09", "comment": "Malware payload (Heodo)", "value": "838c1c25d54ebad7242ddd8eedfdfa3b30f90120a3880518f6f6fe88a5a77c94", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647836270, "uuid": "e531ec22-9f83-4b77-accd-9c2d4cfc19a0", "comment": "Malware payload (Heodo)", "value": "4f2a5a680853059b2bb75b9e4fa3b02c4be1d5b5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647836270, "uuid": "b5ac1550-906c-4580-9f3b-0ca2da1fff53", "comment": "Malware payload (Heodo)", "value": "30c53428a98214e7d1e2771035c839f2e65d1ea9e5be77aca14905a209504d2b5e67427b41cc09d9f4888dd00cf366cf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647836270, "uuid": "ac9592f5-8a6d-438f-9853-e97245e44a53", "value": "T1FD64A2123CE2B072C99BD0708FC95064865FF1F6AFA6727E63FD425C4B14DA29E17A42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647836270, "uuid": "9c614d5c-e3a6-4ba8-9f4c-9eb84a98af1e", "value": "3881d76bffe56c7cefb6ec7d56cb4aac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647836270, "uuid": "cf4b35ec-611d-4052-aa5d-3efbdde263fd", "value": "3072:2SdVV0J69C953lrzRzqXsXoxy0eTXAnalrfOO8iQhKJ1Z+t00WKdzX41uQehDR:2zP28Xoxy3TAaZOO+kDEWKdguBR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647836270, "uuid": "25848c21-ba7f-42ab-8df5-93be9593f759", "value": 310603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647836270, "uuid": "67ba0660-50b2-490a-81b0-c73b00a95f79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647836270, "uuid": "97028ef5-f202-4b18-9fd2-36fa8f4bac12", "value": "emotet_exe_e5_838c1c25d54ebad7242ddd8eedfdfa3b30f90120a3880518f6f6fe88a5a77c94_2022-03-21__041744.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7737b2b-a942-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647886455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886455, "uuid": "7b11fb62-ddf2-4821-94df-0d22ff917460", "comment": "Malware payload (RedLineStealer)", "value": "779c6511fe5be01fe3db87d2530e8434", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886455, "uuid": "580a02e3-d699-482c-9e58-6ae2387477ed", "comment": "Malware payload (RedLineStealer)", "value": "83a132869e90b115ecdc009e379b70d23b97b36120cb98320e16dde6f68102e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886455, "uuid": "d9b549fb-0090-4833-8825-5881ff2a0708", "comment": "Malware payload (RedLineStealer)", "value": "287c1df09946bda7a24fe4d4e08c504e6b813818", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886455, "uuid": "5fdac85f-4595-4dda-9607-072c44841cc2", "comment": "Malware payload (RedLineStealer)", "value": "ce6f93df72bd85c14fbcf33a3bf91e0e23186d7e4903b74b4c9ed2368e5b1a5ba91023eba9ab7527d2337f4bdef84f26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886455, "uuid": "82f3fa04-c4c9-4b3e-846b-b2ac8e44c7ad", "value": "T1ED15339FD686CE25E092F8B478B8DBD6B65021B473E877A3FD7C9862DA39054C305708", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886455, "uuid": "3c565fb9-cfad-45e1-813c-236aff670d24", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886455, "uuid": "8d8c09ce-2991-4ea9-a2a1-f1cfd6785ddb", "value": "24576:QXH0XdYO7gYJwYBSGTDv76H03UPNkEaHNYK36deN0:QX8N79+CSk6HPVNaIP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647886455, "uuid": "47896974-e848-4d2a-8fc2-4578ccd8cb78", "value": 947200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647886455, "uuid": "f0b79139-d6c0-4280-a2f0-ac3fadacae3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886455, "uuid": "41442b92-8266-4e5c-98be-3f023ecf5229", "value": "SecuriteInfo.com.Trojan.PWS.Steam.26630.27608.26553", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a0b8754-a930-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647878513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878513, "uuid": "ec0d2994-fbb5-482b-9c44-343f480a133a", "comment": "Malware payload (Formbook)", "value": "f81330ee5847784f90651d57d0e2e916", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878513, "uuid": "7fcdf430-e326-495b-89ad-1a16180d7086", "comment": "Malware payload (Formbook)", "value": "83bfb1bf3d445b86e4aa3c753c9f3f80cd00dabcd51993f67aa4ba36df71eb16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878513, "uuid": "7e2ff675-5897-4467-82c1-c49a0dff32ca", "comment": "Malware payload (Formbook)", "value": "295427c1b0d6bb135083db87119b2b8195a579fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878513, "uuid": "f8a264fd-a8a4-4231-b07e-6ec65b19ab37", "comment": "Malware payload (Formbook)", "value": "ef551d96cf5f06609b2924398ff68cbd71702cc5f0a391a619b33db8d13af2dcf4c6e323de6077f0166d969628329d4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878513, "uuid": "45740d3f-94ff-484d-9a41-a14cfdcf16e0", "value": "T1469407AF22DC6F6DEE94DDB370440C6D62E7A350D2BC3919EC092E534BDC82E6562B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878513, "uuid": "e7213665-8cd7-4c81-9ff2-039eb6a89c7e", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878513, "uuid": "9af1f239-e30c-4b8a-a072-04358b11305e", "value": "12288:xd96dzKzAVZAxr59e6yr/7XXKc2eNjT/4rF6SOsXzV8i/psDjmD7CfLaGsi7qZ8s:xd96dzKzAVZAxr59e6yr/7XXKc2eNjTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647878513, "uuid": "0850358e-56b7-44e1-a1f6-184e57e9d4e5", "value": 438173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647878513, "uuid": "b85bd810-007a-46d4-aa85-656774059b30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878513, "uuid": "b9cfe6f9-2338-46a6-b7c0-bea0a5f22391", "value": "Order Details_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30fd7030-a8e1-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647844568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844568, "uuid": "2410c83e-711b-44de-b8c1-6b1afbac8baa", "comment": "Malware payload (RedLineStealer)", "value": "5b001152dcc0b3b5c2c58283784ed637", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844568, "uuid": "4025fa29-0dea-4897-ae57-dae1fd77a724", "comment": "Malware payload (RedLineStealer)", "value": "84089e99968bc4f076960814fe0d5cc4799dd692d5238960de74ea3e45d30e27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844568, "uuid": "a289c6df-f96f-4286-9956-febe7d12d4b5", "comment": "Malware payload (RedLineStealer)", "value": "f4ef36fc2b7f08e59b55a1cb9994a2b0956e7801", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844568, "uuid": "0ad1b5af-9c02-4961-9ada-cc7dddeeacc6", "comment": "Malware payload (RedLineStealer)", "value": "623480eb1d78b9120d8bc8b393c930f6ca013876c68c260dcf2326952dac402d41d4339cc4ee51194ba94289f3966245", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844568, "uuid": "c5aae2b9-e484-460d-b40b-ae08bfc3bbdf", "value": "T1A094CF44B7A0D03DF1B712F4787A93AC742E7EA05B3560CB22D62AEA56356D0ECB1317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844568, "uuid": "4f0b35b4-0579-4e9f-8e4a-b9eb5e879b75", "value": "30c85236402d607ec86afd7c1aadbde2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844568, "uuid": "f0c12f46-5606-4630-bc13-a5a3ed624c85", "value": "6144:Kys9jEAeollMWJnGEhLnFXyueawTP5UBMOKEfwj4USV/R1FJjDoq:PmEAnlzJGEltyueD5KsEfXUeb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647844568, "uuid": "61cd4def-0324-44d1-99c0-2debc017b73d", "value": 418304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647844568, "uuid": "ee7c3652-bf12-4e40-9c4e-35309978e9f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844568, "uuid": "0bbbf5ea-0245-4c42-be18-d44b654d899d", "value": "5b001152dcc0b3b5c2c58283784ed637.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c694240-a8dd-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647842789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647842789, "uuid": "5c39c2ca-22b8-42db-bb05-0c8584f0f4fb", "comment": "Malware payload (RedLineStealer)", "value": "b1d7ae06bdcf87cb799c19e7617f15fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647842789, "uuid": "e6bdc5ec-0101-4db3-a662-1e100e80517d", "comment": "Malware payload (RedLineStealer)", "value": "840a9e479aa3d6d4afd80b0464448bd756d6bf0624a27ffdf33620c84760b59b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647842789, "uuid": "868897f1-96b7-493c-9d6e-ac32c87df00d", "comment": "Malware payload (RedLineStealer)", "value": "c78d625ee095bbdd2da378056163f790625703af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647842789, "uuid": "c040d0d8-b2ff-4f22-9b23-ba717e2ba30f", "comment": "Malware payload (RedLineStealer)", "value": "60b2cfc23b760796edd65f483902dadcae963cc105089be772fe4f3bd710c11bfaa3d2eba79252772205ce88158ff2f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647842789, "uuid": "d17e8735-c5e7-4527-90bd-8c9f6ac0342e", "value": "T1C8F49EAD3F82A3BFD11651FA5A7B81C206B869CC6511B4E81BC77C2231AECCB04797D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647842789, "uuid": "2d0124b3-a156-4776-84ee-9619effe6a09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647842789, "uuid": "658917e7-45ad-4c66-8499-f36104f817f6", "value": "12288:s9eRD6WBX5v2p2FP91tbOCMStQkfndTshTKUyCZAxK3O0WWsc4dIDFz3oJvR7UBF:gewWBX5+p2FP91hQIRVTMKUexKWPdIak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647842789, "uuid": "ef286484-9c94-499d-a223-420db04a1de0", "value": 775168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647842789, "uuid": "8752191c-7847-4df8-a2ac-22b7263eb2c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647842789, "uuid": "182e619e-1cbf-4ea3-8fdd-ceadc5f593a0", "value": "ORDINE DI ACQUISTO PER FATTURA,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2639a69-a91f-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647871494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647871494, "uuid": "f1a4bfc4-28f7-4b7f-85f1-4137b3175919", "comment": "Malware payload (Formbook)", "value": "5f6a1a42e22554b28370c217cd713e38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647871494, "uuid": "408e12fe-952d-4a08-b046-8fb1c3105ee9", "comment": "Malware payload (Formbook)", "value": "84b8e7a5f3bfed0e2c4e05fcc1902526f6fd42faf572412eb93321db0455fab6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647871494, "uuid": "86ebd6a4-49ea-4e71-9724-ca381acfe086", "comment": "Malware payload (Formbook)", "value": "97f1ec964eea326e8ebdc27682def3cb14d52223", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647871494, "uuid": "793d1f36-e323-411e-ac9a-0177b30d1379", "comment": "Malware payload (Formbook)", "value": "bcbcbf080908f933e83f8f3bb0b5d75cf9a91b3a62371a22b0730a3cfafa35342bc7054f3defe7349bc3cfd35c4fba22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647871494, "uuid": "2b48cf8b-281a-4e13-8f6c-0b45ea7c0eaa", "value": "T192B58D11F3F8292AF4AF0671EE3145D85A64FE0E8E49C29F5409B45D7572330BB8A36B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647871494, "uuid": "44a1bfcc-cb62-4448-a7e7-b6009087a0b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647871494, "uuid": "2e3cfcf9-9a3d-4f71-892d-32a191040ed4", "value": "49152:qXBEmgWSPCQZPlbHZemUqIt+lYRGOotoyLwHda/:cgWSPCE/AqRtoyUHY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647871494, "uuid": "c21059cc-9323-4b87-8fd9-dc3eac7c6e97", "value": 2484224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647871494, "uuid": "c307bba7-5c65-43a7-9180-8d3d735cf500", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647871494, "uuid": "021cdbf4-1e96-4943-bc1e-78522cc83bf8", "value": "ORDER_CO.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77763b7a-a8e3-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647845545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845545, "uuid": "1b27bc69-cc83-49b2-a975-587031da6338", "comment": "Malware payload (RedLineStealer)", "value": "84d8735aa5343278b68b475da4cab56c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845545, "uuid": "28f34e9b-e5be-4256-b0d8-4606d203cfc9", "comment": "Malware payload (RedLineStealer)", "value": "84c8bbbc317e3ee64597e00cd0a16de149164b95d529cde44cd434c9ec6bd17e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845545, "uuid": "180912df-903e-41e5-ac67-0b55096e8c31", "comment": "Malware payload (RedLineStealer)", "value": "cdaf46d994a62878ead04450bf19865d44ba53b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845545, "uuid": "003d6ae4-b45a-4142-882c-ac25a10ba20a", "comment": "Malware payload (RedLineStealer)", "value": "3919406c8b38c6980accc6ebee004840d3cf5e3f3b508a7348ff851d1f1fea637c060d286999cbb67a3f4488ff51d77e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845545, "uuid": "0f0a59aa-b3a5-4681-883a-6bdda6d45939", "value": "T1C206333A590601EEF733A63D9E198212B1B5423479E30E4E956839DF73D963EB00772E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845545, "uuid": "b9aa23cd-e32e-4dd6-8e98-744dfe8712bd", "value": "18df1dcc1fa258b4d6e464d165239b75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845545, "uuid": "af7d5d1a-1835-49ac-a82b-c3f7a7f70878", "value": "49152:jqMpfBaaXgRC1RPUWN8bwqI1F3lhw4iLir9RxELhMBSb/BsDsV3nRezBVOB598BY:OMlHr8bwvF3lgq6hjBFVhezBC98B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647845545, "uuid": "c2484096-a565-46ce-bb53-2c1f33e34a11", "value": 3776112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647845545, "uuid": "e743cb46-a978-41eb-be92-442aec2c7c34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845545, "uuid": "eee4f5f4-fcdd-4814-9864-8630cf5cce04", "value": "37428409.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1799a5f-a8d1-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647837992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647837992, "uuid": "27ace884-0ae3-4180-859e-6f255a27971e", "comment": "Malware payload (Loki)", "value": "52a2246fc94b2b333adced3ae049012e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647837992, "uuid": "ae80be30-f527-44f3-9d70-ff42505a475e", "comment": "Malware payload (Loki)", "value": "84e31f5894eec64eb89b66b3630a5da22db8a7916fd51604c4c579a491506e0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647837992, "uuid": "1498f680-ad22-4fc3-85cd-8b78e7870137", "comment": "Malware payload (Loki)", "value": "3f50de8ae020d4f0b709f470c40201b61119d50c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647837992, "uuid": "9c142611-b051-4fbd-a784-17f93f5a04ed", "comment": "Malware payload (Loki)", "value": "6653892bc79d7db99dc91ce8d0b0010b78a7b8d3198a857dcc1e06ddde5e5459c8deb27b6f15df06f7e6709407744d62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647837992, "uuid": "ed22f3a9-b699-4aec-93e9-bc0df49cf0e6", "value": "T142848AB3B3C07973CA79897225935E588DE4BF72CB641C661AB27BAE2671D70010178F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647837992, "uuid": "c6b8f9c6-d257-4743-aeb9-83f4a09ce268", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647837992, "uuid": "864635e5-77f1-4928-b040-1849a34abafd", "value": "12288:W2jA50WYlFcBPOUDKVGL69ZkzlAJ8zcpGp:60WCQmD4SuzIax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647837992, "uuid": "2bf37602-12ff-42a1-a195-f48e31a5aaef", "value": 400148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647837992, "uuid": "c96fe4b0-5667-40d7-a502-2d5f3761e3a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647837992, "uuid": "fd153a08-b307-4951-a45e-6644ffab0779", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b9d231e-a8e1-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647844505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844505, "uuid": "6f5aa8df-9420-4aaa-ba13-e90044501581", "comment": "Malware payload (RedLineStealer)", "value": "4c1e18947725060ca46fbae3365e00f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844505, "uuid": "2c486963-7c55-43c2-b1ca-e85d50f6d89f", "comment": "Malware payload (RedLineStealer)", "value": "8512716947c3c8dcf787802ff0b78db2fe4cccb20edfbe3d2a3fd2bdda9ab96e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844505, "uuid": "b87ddf8a-dcf2-4e0b-8498-6c01e091213a", "comment": "Malware payload (RedLineStealer)", "value": "b472526c01bf266dce1fd1c03646b8e85fb24f38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844505, "uuid": "2c24d5fd-b5dd-46d5-8df4-0fad41dc1129", "comment": "Malware payload (RedLineStealer)", "value": "dedd59eb5ebdc73ce641f8d18895e4dde5d2faf237cdf1a04a613811b2f925f48278af50b2ec0d3ae3423bf6a946c4fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844505, "uuid": "b2543f5f-d7d8-424b-aefd-d49212b09c94", "value": "T17B36333811857C4AEFEFA83CF2965961E7CCBEB59BC7058EBD2A3309B11A6538534710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844505, "uuid": "c0eb5440-6570-4de5-8d6e-3592527e28c0", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844505, "uuid": "03f202e1-c293-4ec6-b1a9-8d7943546718", "value": "98304:PUQcbC+cERdlm5awkdZAWR6usRmYCPN4X6ZcbXoxymBB5w:PUQwnRLm5awkjKuwm3iX6ebXPow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647844505, "uuid": "77ad0132-5cc3-4f32-bd56-6110b5a449d7", "value": 4986824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647844505, "uuid": "f922421a-ca46-4ff8-9e93-e1772cfd3eb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844505, "uuid": "bfd6f439-c735-4753-87d0-e93b0cc206fc", "value": "73390918.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63dc681b-a8e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647848089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848089, "uuid": "8614472c-b045-4215-9f67-e5a2f0a84ee7", "comment": "Malware payload (Mirai)", "value": "e28d829ad086dbbf0e47d6310bc33157", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848089, "uuid": "e157fee8-8291-4e71-94ad-413fb5be6984", "comment": "Malware payload (Mirai)", "value": "85208918c0468e4083ff464ca899a024b05340f1737a458dd22d267a02a07c63", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848089, "uuid": "47d46898-d731-4060-b1e6-209ab8a40a1a", "comment": "Malware payload (Mirai)", "value": "f34a45ac115b6759fb02f01776bb4487c3e1fb73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848089, "uuid": "567ffeaf-3b8d-426b-9f90-0fdbbb9f0ba4", "comment": "Malware payload (Mirai)", "value": "e9c7ec9825a6f6eb053aec8202fb6c3ef10a9c05124f4106d48c936e225ab8d579c991baaa16c8a46a6b323e657e1a70", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647848089, "uuid": "6d8ba4b7-32dd-4afd-8d06-a7e601a10d45", "value": "T1FAB30901FD404B27C6D267BBF79A438D77366658ABD73301A6297EB02BC179C2E3A150", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647848089, "uuid": "02e23071-2cfb-4a97-bb55-cae0e1d00bc7", "value": "3072:C9DMjalFQEnohuAZhpO0OO9UUY5hssRbUlD7YHQQ/hVOmAD3m:/pO0/WUY5hssRbs7YHQQ/hVOmAD3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647848089, "uuid": "10baa633-0155-4903-abf2-e433cd19d7c9", "value": 116080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647848089, "uuid": "c82c9d39-03fe-45fc-bbdc-052da6a2cb63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647848089, "uuid": "75a8b5fe-c763-4ad6-bb1c-1a6640c2abbd", "value": "e28d829ad086dbbf0e47d6310bc33157", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20f70242-a959-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647896081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896081, "uuid": "b8b6fced-895f-43d4-9963-113292f431e1", "comment": "Malware payload", "value": "16830ec6977ee574e0c67331d3093ec6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896081, "uuid": "aea8dafe-307d-44ed-8d8d-bb3f8a9eed1c", "comment": "Malware payload", "value": "853d7d34b5d4ec925afee672f0506ff73e5a0d7fc515a7dfc6fe996f1bc78a17", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896081, "uuid": "e7fc05ef-f4a1-456b-b0e9-cdae8438a2b5", "comment": "Malware payload", "value": "9831ef90cc3ecf296eeb26d27d1cea89c7eeaa6c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896081, "uuid": "1ae061b6-5c6a-48a0-8359-be54e649b070", "comment": "Malware payload", "value": "d418da8125bfe4e835028615acef74647bcad4079948df78a713165a62f1c9e7aca84e1c3362a710acb63f2ee2a6aa84", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896081, "uuid": "18b85aec-29a7-4dff-a263-b02ddac0994e", "value": "T13E5523C3C7587664E15FAE7617066E8027B1EDB2A25DEF4BA824F081F5783533813A63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896081, "uuid": "53c4cf18-68a2-48a8-ac2d-1bd84fc14759", "value": "4758b18d2692987bfa538afb6559ad72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896081, "uuid": "6dfdb8f6-fffe-43a1-b8f7-c6d731d2f5cc", "value": "24576:hex7Q24fmYF1dSvaFB2mie0Q5UGVXsT4vxV6E2wII8MjFVYF+6kvwb1rG5VCEl:ox7Q2jYF1rfRiA5FsTNApVBvw5rGSEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647896081, "uuid": "7fa1ca7c-348d-454c-ba8f-12c7d371a01e", "value": 1306560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647896081, "uuid": "ed0933e3-d07e-4d7c-b176-21e49a3e0c80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896081, "uuid": "38ce4d70-9d64-4855-8b18-c0d4ee2ec915", "value": "16830ec6977ee574e0c67331d3093ec6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c029c01-a930-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647878597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878597, "uuid": "0c70830a-3a53-48f0-9ddf-7707b34cc388", "comment": "Malware payload (Formbook)", "value": "18ad51ffb2f94b9804fe509306faa429", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878597, "uuid": "e9de3d97-0398-4249-a3a0-fb7cb2027a98", "comment": "Malware payload (Formbook)", "value": "85434cc29d28674a4e118cdbbee621656d1aa0b0507fd1135446c93e97d175be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878597, "uuid": "19a0d29b-9799-4f1b-8465-549b3ee5485e", "comment": "Malware payload (Formbook)", "value": "e2376d4790e7f9c18ad1b47a8c5abcd68e26a40a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878597, "uuid": "406cd12d-062a-48ef-8dc4-07e5f1b8e315", "comment": "Malware payload (Formbook)", "value": "ebdc5dd8a25dccc8b4d132f1b9ccba01293f5593f4ce3d1a31ea03beccb63ff8a0cb762a73a461cd306d9f30113d9a13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878597, "uuid": "b206fafc-65b2-440b-9421-f6893b29bb7b", "value": "T1ED35D0E121FF5EB1C17BA7F1F851B7BA0EA0BF08E201C2B9497368C691E5729353454A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878597, "uuid": "2c365889-2735-4df2-a67e-34d833c00a60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878597, "uuid": "fc2f4d67-2907-4182-a5ce-cd60fa1b3dea", "value": "24576:c99iTyGG5uLfs0QzcpkrXYKJXaAPIvrBQjvaYGD:k6HcuLosKt5PIvrBQjvatD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647878597, "uuid": "c20d7958-c460-4fdb-8a0d-f26d8a656cbb", "value": 1156096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647878597, "uuid": "c622561d-45ea-4b99-a0f1-05a881ce831c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878597, "uuid": "50798b1a-e687-41ad-99f4-fa1296387fdf", "value": "Telex release.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d652edba-a947-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647888654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888654, "uuid": "e8ed3b8c-15f0-4ad3-92b8-7a768dd39a9d", "comment": "Malware payload (Heodo)", "value": "074418abf99bddf2269119b7610d166c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888654, "uuid": "a756127d-fefb-45f3-80f9-e3479601049a", "comment": "Malware payload (Heodo)", "value": "85ee876003d27e9fc313e841c4e073b8486d3e51fe0a3a5e34c455bd3ff77b70", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888654, "uuid": "67db86af-2944-46a2-8cb5-fdf93965eda9", "comment": "Malware payload (Heodo)", "value": "6ed24c8e939494ec947e759c4fbf4f8d945477bd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888654, "uuid": "51d8d526-7983-4a7f-be33-483ff84d5460", "comment": "Malware payload (Heodo)", "value": "e0082c6a507e1d2f88a5511e8ff5928e511ca7c0dded7758567eee7fcc96a536b29ffe5c94e804d78e4f29c61e281173", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888654, "uuid": "e6edc356-92ad-49bd-8bcd-ab6776d449d5", "value": "T1E2B43A11BC916832C36FAC7456073262588EE7F0DBD1F26FA3E0495C9A7C5E36624BC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888654, "uuid": "ceb13ecb-d027-49ef-b9c4-cef31e8bda8c", "value": "14e6ae8d1400b6271725b3f01025b85e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888654, "uuid": "80d97bb0-86ac-4f9c-aff1-271802c07e39", "value": "6144:VikzyaB9eoCyx/mEhHB5RYSJ/xj+qiCjzQNPj79GkqbscgCG5qH6scI:VNnCGmyHB5SSJpm0zQN39GkUGQSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647888654, "uuid": "3dc5ab13-082b-4fc6-af45-b0779328b6dc", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647888654, "uuid": "29d28717-c61c-4d5e-a653-9b63a5a2a129", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888654, "uuid": "a9ba5fa0-9caa-4b5f-8537-5e86d8068bcd", "value": "emotet_exe_e5_85ee876003d27e9fc313e841c4e073b8486d3e51fe0a3a5e34c455bd3ff77b70_2022-03-21__185044.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f56f0643-a8e4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mozi)", "timestamp": 1647846186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846186, "uuid": "84e802c4-54d7-4e5e-bc66-4d56ca91ac6a", "comment": "Malware payload (Mozi)", "value": "db26369d7795b35ee700de3b4f619014", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#AFD6C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846186, "uuid": "96cbd927-0501-4b60-b1d0-4590f2d15605", "comment": "Malware payload (Mozi)", "value": "86881aec90e578e550b6a49cf113910baccd5d7b5e6c1eb37be172eede2e4d09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#AFD6C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846186, "uuid": "9206f4c4-de12-425f-bf80-a951c806776c", "comment": "Malware payload (Mozi)", "value": "c331072e66ceb22179ae2b7a283313d4276c96a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#AFD6C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846186, "uuid": "f3fee406-85b3-49b1-8e56-d63624bc2ca6", "comment": "Malware payload (Mozi)", "value": "5bcaa328de860981bc6aa29f7fd739d59ac6f0b162ac63baf36e67d15f8676144550f1a64bdbe3df488cf575a52a179b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#AFD6C3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846186, "uuid": "4e073a17-b704-43e6-a812-9df6f9fc70db", "value": "T1B3914B817152B923F90665BBC8D4C5110B9EC43932D1CACB9FD0E2863E12A87A33154C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846186, "uuid": "9ee232f1-8598-4bcd-94f8-e2f4166e5724", "value": "96:a7wTabRChXahd5DfSg5GKNf0Zfng4wVYwel2PU:a7ww8qhd5D35GKNwfnhmvC2PU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647846186, "uuid": "2b171a0a-3255-4199-989f-48096e19e7a5", "value": 4344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647846186, "uuid": "2ad70a56-171c-4368-8fff-2db849fde7a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846186, "uuid": "8638fd6f-d8a7-45cf-9f73-f5b0029bf61f", "value": "SecuriteInfo.com.Linux.Packer.Patched.UPX.7352.459", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfaeb742-a8ac-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647822044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647822044, "uuid": "b7e3730d-0c2f-4b0e-91c6-28b31daa1d50", "comment": "Malware payload (Heodo)", "value": "58ba3d7e7ef0ffd6a9989b7bd439c175", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647822044, "uuid": "fcfd20a2-8b95-42a7-9c66-0d2dd9e43e14", "comment": "Malware payload (Heodo)", "value": "86ff61fd337460935c24b85afcdeaa936cad1d2fc350b367714d6816a97eaa5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647822044, "uuid": "ddbf178a-3a41-42fd-b809-e3bd16b2ecbc", "comment": "Malware payload (Heodo)", "value": "dc5ea0e8a298cadad0d6b6282ab287aef59580d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647822044, "uuid": "a1f5d806-e157-4f1e-82bc-af9927ab57ec", "comment": "Malware payload (Heodo)", "value": "f112b36e2e724efbf14422156eafd3ce85fb8cb1870f3757ab4476b472b593908f9715f3ca495263f91b639b62adf50f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647822044, "uuid": "388d44fe-f165-4f3f-9131-8a74bb20b89f", "value": "T1EBB43A317492B279C2EBD73408A35275B21AEDF157E274E36EE707CC4B366906E72602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647822044, "uuid": "c661ef00-155c-4a75-bdee-da0d0fbb9c1e", "value": "55cf9ae1e74cef637eafd17181390202", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647822044, "uuid": "8c394c59-f58c-469d-9e80-f92665018d96", "value": "12288:7FFCpYDLbBHqKK85H3j72VlMD4zeSvturG9+:7VDLbQKcVlMDOtv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647822044, "uuid": "0eb440d4-a8f3-415d-b323-08113e110918", "value": 516096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647822044, "uuid": "dfc15cd7-5d71-4db6-aa0a-488315202faa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647822044, "uuid": "b1eb2b51-6f0f-4c5e-881c-3f6f27cb9b16", "value": "58ba3d7e7ef0ffd6a9989b7bd439c175", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74258f77-a904-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647859713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647859713, "uuid": "a802a27c-fb33-433d-a08e-2038a0d07717", "comment": "Malware payload (SnakeKeylogger)", "value": "0240f70e69d099fecf3561ec672b0ef4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647859713, "uuid": "dbcdfd35-1b26-4ff9-bc2a-88908b81dc57", "comment": "Malware payload (SnakeKeylogger)", "value": "871a59d3ae49c5c20ccc636bcb992f585539c4c49159e10f718e1a6764973ca5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647859713, "uuid": "b4b40420-c9f5-4799-93b5-4154bccc7aee", "comment": "Malware payload (SnakeKeylogger)", "value": "b2427e1fbdcba564436ad1580b75c8bad9afd33f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647859713, "uuid": "da730856-81ad-43c6-9c26-99607b907dfe", "comment": "Malware payload (SnakeKeylogger)", "value": "10e9c6b60a6d4dc680a021bd1a1e4c24a4508e0248624f0b81cf580000dc573c9e3ef8d0de7c587d507e7d26bc4c8bf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647859713, "uuid": "58fd1391-e111-476f-8d09-f2cf7b29d800", "value": "T1A225232B7795D227C9FC0A32E0EAA4900B759BA17453D70CF8D163590B233E697126BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647859713, "uuid": "ec694be0-7499-4c6e-8534-c96c4118826f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647859713, "uuid": "8c426dc5-e02e-4165-bb58-a23f961e2c8b", "value": "24576:r3jS9mmKXrUPJXzUnoVmwJVE8Gj9AhQR5Di0S:nO3NPp/mwJcjWhM5O3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647859713, "uuid": "aec9b9e9-1eb7-4c48-ac81-6391666be6ee", "value": 999936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647859713, "uuid": "8e33009d-4598-4cf8-aeb2-f80d6dce6496", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647859713, "uuid": "9589053c-01c5-40a0-852f-6580cefa46b9", "value": "20220321_3339477993743000000,xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1906b889-a8f4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647852688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852688, "uuid": "515fdb64-4524-4434-adbe-0dc05ee8acf1", "comment": "Malware payload", "value": "564de3caccb1131fcc3acaca3d3d60c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852688, "uuid": "b289aac5-4796-477f-9815-8524b9361778", "comment": "Malware payload", "value": "87671869a34ebae368c85a54310a826a5e1c887cc20888b76efd025e66f4485e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852688, "uuid": "e13524c8-3624-49b8-b431-3cb93aa13904", "comment": "Malware payload", "value": "8abbf0fab847ffca933da13351103d34bfdf20e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852688, "uuid": "9a5a83a6-65c6-4611-8c14-d6ea0111b172", "comment": "Malware payload", "value": "8bfc2bb4aebca822848481c5119146d3f67b3f99b9b39ed72a64045f1f665010c283924374a825817dbadb28b7028a5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852688, "uuid": "4f7b79fd-1e43-4788-b6ff-2c71dc9d8200", "value": "T13F54AE40B760D03DE0B712F8797A93ADB42E7DA15B2094CB62D66ADF16306D0EDB530B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852688, "uuid": "b104b12f-86e1-4f9f-8572-bb81d83d89f1", "value": "cbe2a3d9f5bb4fa7c1fbeb2b00df447c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852688, "uuid": "d1e63c1c-5bca-423d-b5a1-df5f55554a18", "value": "6144:bSKW0+IrJHWt19u5eWyNANFxCedyXEsvFx6XBEoS:Wi+IrJHOTuQRU7zdyXEscBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647852688, "uuid": "03137edd-c7bc-4444-9330-d33b1786cc08", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647852688, "uuid": "18507854-fb3a-408e-bddc-2150a2f5e070", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852688, "uuid": "263526e1-4584-4dcc-8d65-8b63a32603b0", "value": "564de3caccb1131fcc3acaca3d3d60c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b12b5c1b-a914-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647866687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866687, "uuid": "3fe7707e-55ca-4fae-8381-42adf753f514", "comment": "Malware payload (Formbook)", "value": "a433cf43be0917bd0806f02236e7cd4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866687, "uuid": "b7a8122a-c2f3-4de4-86c3-7ca2b2f20a02", "comment": "Malware payload (Formbook)", "value": "879202f8f82d5dc4f8b255a955f0b7a4b970dbaafaa98849ef3b16186f58ab49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866687, "uuid": "a53bf53b-891c-4909-8ad0-a7dae596a777", "comment": "Malware payload (Formbook)", "value": "c69c2af6004fd2ebcbe6a72d81e34de9ec0a8e4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866687, "uuid": "c0bb3d15-0ade-4bc0-89a0-5d7d0c82c95a", "comment": "Malware payload (Formbook)", "value": "c8a3b0d76c9c9125ac27d410dc1cbbd8d637209890e7f19ffe53f37598ede2b0278e34f621dec107ce83045ca444e906", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866687, "uuid": "7416d7ef-a3e6-4f71-b1f3-d0168e8c0566", "value": "T1B7C4B71C3A85D673EE0DE0B14C422D24ABF70E03DA40A9D25FAEB5C6877AC579F4589C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866687, "uuid": "b6c32202-3676-40d3-9cd3-e3c59a7e2c05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866687, "uuid": "c9a44cb5-8343-44ad-86c9-4ba69e214a98", "value": "6144:YOUgoQC2JfQQrsRcwi61iyZAoI+/pWLQxhURikF8OsTLLsml+lAkp:loQCWrQXwmAojBWLUPZPYmCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647866687, "uuid": "c741972e-0ed6-460d-8740-b2d6bf3088df", "value": 544256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647866687, "uuid": "ab89cc9b-8fc6-4b92-9802-44b5533cbb35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866687, "uuid": "eb654166-f44e-4a20-bc99-1c962bee4ea0", "value": "GIRO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e2bfb06-a94e-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1647891513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647891513, "uuid": "ecc672db-0289-473d-8a28-8cfef115c66a", "comment": "Malware payload (njrat)", "value": "4bcd6366fc744df9aaf4e9e27f942534", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647891513, "uuid": "cddcda49-f2bc-49e0-9d38-d967868fac96", "comment": "Malware payload (njrat)", "value": "87b81b7ef9e2548731d2c93d102ed6f9845fbda359789da7b5dac1eb4b012051", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647891513, "uuid": "08102e07-0458-4ce6-aa6a-0ebfa25ed392", "comment": "Malware payload (njrat)", "value": "5eb7c0f713676861178660b74c36fe25239c4862", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647891513, "uuid": "13cba075-a4ca-4d6e-afa9-90bcfd831b2a", "comment": "Malware payload (njrat)", "value": "34dca3568d9664991066bbff8ae86490e6932ca2e8277acba80b01774607fd0c21616cc6f71bd3bf5efaba0322c30775", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647891513, "uuid": "748b9f41-d592-4b25-bd22-0aeb6aaf2066", "value": "T1B2032A4D7FE18568C5FE057B06B2D412077AE04B6A23D90E8EF564AA37636C18F50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647891513, "uuid": "105f38ed-ab2d-4ce6-a861-23689599a08d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647891513, "uuid": "2bb4ef52-6c39-4226-aba8-0536a7fd127c", "value": "768:w5jYjAwJvtPfHgMsGUarM+rMRa8Nu6st:w5UcwJ13AMyF+gRJNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647891513, "uuid": "a943a627-6f22-479a-9d71-0cd42dcff147", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647891513, "uuid": "60faa0ac-8dc8-433b-b014-eda02716230e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647891513, "uuid": "f8442d2e-5a27-4dbd-828d-b6901ddedfc7", "value": "4bcd6366fc744df9aaf4e9e27f942534.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986ada5c-a8f2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647852043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852043, "uuid": "87655265-316d-4a9c-bbd1-35c00920fbf8", "comment": "Malware payload", "value": "e485297c6798dc26612665e5a4609fa4", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852043, "uuid": "2f687bbe-5f8e-417e-a047-12751d804bce", "comment": "Malware payload", "value": "87bef8251b58877442c0b4d9be6b126b9a64972eea54427652ec9646724309c0", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852043, "uuid": "d0fbdcbd-1954-4093-98ce-b4e792798746", "comment": "Malware payload", "value": "8f52276b023ce883292425ae047648ba6889bc7b", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852043, "uuid": "9139aefe-2942-42b3-8c5b-bd584c9c129c", "comment": "Malware payload", "value": "3f6fb33261e11afbbf5ae26136d7cc73ffb0f26313cdc4a98d8940cb7bf499b2cb5e7a64752cf253cb841c1ebfd58bd6", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852043, "uuid": "cd8ca2f4-4bec-4843-81ff-ca934f6e7021", "value": "T1E1064B32B2C4653AC06A3A3A5527A278F93B777167168C5B17F0C84C8F367436A3E647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852043, "uuid": "dbc861b0-2d8b-411d-8554-b01642967a9b", "value": "49152:uR1ZZQrdvsIn1ZaSr/cD72QU8hb38aAoYT4+oqkdkPp8t7GYSpA:6Z2stUUbMaAUqkk+t7GYgA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647852043, "uuid": "2ffd80a4-9575-40f4-b7ba-9862b1e4fc76", "value": 3922944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647852043, "uuid": "d9ab65cb-084d-4416-8cf7-e8f63ceeb6b1", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852043, "uuid": "e699548d-1254-4cd9-b04d-fa10a7a906a9", "value": ".._qmpb.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec1bd9b9-a971-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647906729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647906729, "uuid": "0d469b09-58b8-445d-8599-433c888cafc7", "comment": "Malware payload (RedLineStealer)", "value": "a24178afbaa42eb9390652e3fbda20d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647906729, "uuid": "4955740c-1b3c-4189-b35d-c0c0258e3018", "comment": "Malware payload (RedLineStealer)", "value": "87c6687072818d29fe38eb77b40ab949c18201a36e0533a356cc8d55ba21fd38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647906729, "uuid": "5b7df01e-8f36-45b3-8462-b0b169681845", "comment": "Malware payload (RedLineStealer)", "value": "c0924e802f2ad0e079dcd06dcc632612c7ecb73f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647906729, "uuid": "58136364-6a55-4207-a86a-1c1eb7215c3a", "comment": "Malware payload (RedLineStealer)", "value": "4bb7ebab38d6563db1e4d6b696e97ce4d882c953befcf528f68de6a1c650c1d4a328ea5a9eb69180104ef853eeb34731", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647906729, "uuid": "ea191164-75a3-4555-aaed-bcd6861ac087", "value": "T1087401723B80D435C5A220316A11C3619B3EBC721A768A473BC927BD4F353E1DAA9746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647906729, "uuid": "0375351c-e5dd-4816-84f5-dc2f35514b79", "value": "67e4fe6a415d07af81753b9154f04b82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647906729, "uuid": "dea94ce6-0947-45b7-8176-cdecd6e8e549", "value": "6144:Wa/rS+VwTpusBrd0NvBqFBxqV75rJfLRAg14eBp:WB+6Tp0jqFo5rJfLz14W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647906729, "uuid": "418d222b-3bdb-41a5-898b-0b4655b00801", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647906729, "uuid": "fc0da955-84a7-4a1e-86b7-ae6941de2046", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647906729, "uuid": "922a6c58-e661-4276-b019-11809e6c37e8", "value": "a24178afbaa42eb9390652e3fbda20d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a2c9b07-a90a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647862112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647862112, "uuid": "2c98ab1d-15f7-41d0-b47c-81ad481b179f", "comment": "Malware payload (Heodo)", "value": "65cbe9b53d2139fbec8de66d6fa692f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647862112, "uuid": "5f7029ef-292f-40ee-a25d-eb3a4de9c621", "comment": "Malware payload (Heodo)", "value": "88049ba4ad7aec7020f1a2f1bb483c9b839713e1b2069140248f6397fec92976", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647862112, "uuid": "d68154fc-7020-451a-a3bc-c1ffd3ac1b76", "comment": "Malware payload (Heodo)", "value": "e5addebc8eb1cc7f33d58860c913a2f26685f1cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647862112, "uuid": "21e1270d-b1dd-428f-972a-41c5faa60375", "comment": "Malware payload (Heodo)", "value": "2696ec63afb723d660fec1f93fd130ea5c1febb8c9b4d6dfd0786b5bcaa09e987c0d453b7cd69c676df5d06d75c2c91e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647862112, "uuid": "24f71d3a-ca73-4046-9a04-099e74db2955", "value": "T154056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647862112, "uuid": "248b3514-6850-4829-8405-eafa9a16a8d1", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647862112, "uuid": "ea0771dc-72e2-4131-802e-8a8e3544d3af", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rX5CGNHrH2tZ+d+:gMV/rX5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647862112, "uuid": "abe13fda-3868-479c-815e-76e2e992738d", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647862112, "uuid": "f2c73ca2-e23e-423b-940f-ba2a7c98df8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647862112, "uuid": "ea3da07b-2a73-4653-9a57-1e0606db857d", "value": "65cbe9b53d2139fbec8de66d6fa692f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6aa771c-a8f2-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647852067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852067, "uuid": "432d4281-8d4b-41b5-abfb-5755df24f18a", "comment": "Malware payload (RedLineStealer)", "value": "4ec3beb942ea57098b15b6ca8994aa16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852067, "uuid": "0e589c55-5dc6-4aac-be90-00b099cd3a4d", "comment": "Malware payload (RedLineStealer)", "value": "88081f66ba8c0a2b9ef60c2b5d63f95f69bdf99555cb3f60f8ff23b40928d4d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852067, "uuid": "5e780dba-388e-4d71-88ea-946ed216fa24", "comment": "Malware payload (RedLineStealer)", "value": "b4bcab82e496069775e88137dbfc635eb0e9c26a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852067, "uuid": "be9e815f-67ed-4495-a5ae-0ee199102712", "comment": "Malware payload (RedLineStealer)", "value": "2f986729b67c50076fa6bc17b8a1a8f3bbbc6e1958dc5c90940dbd3e246727f470fddbd3054077f16dfa233c811048a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852067, "uuid": "f7fad574-7c9d-420f-9a22-4807432fa636", "value": "T1CE94CF40B7A0D03DE17711F4797AA3ACB82E7EA09B3560CB22D66ADE16306D4DCB5347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852067, "uuid": "f7e27f54-4117-420c-9f14-42c18c7dc301", "value": "30c85236402d607ec86afd7c1aadbde2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852067, "uuid": "52d22c78-b5d7-4395-b250-f1cc20978b17", "value": "6144:k29EDUs+YlQM75XnEhbBFkkwD4WeKZVwyBoLwebkqwUiA8+adkdo5:NIUs3lR53EjekwD4Wt6lMeqiUks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647852067, "uuid": "636ef30f-700e-4242-b786-0e65435cc1b5", "value": 418304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647852067, "uuid": "8cf19100-1e63-4ca2-832c-3526799dcf4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852067, "uuid": "b45eb8bf-3098-400d-aa07-cbefd914296a", "value": "4ec3beb942ea57098b15b6ca8994aa16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c574b3a3-a90e-11ec-9275-42010a9c0029", "comment": "Malware payload (NetWire)", "timestamp": 1647864144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864144, "uuid": "9f642bc6-f064-4dc7-b310-274a3109415b", "comment": "Malware payload (NetWire)", "value": "b31969b9a0511de3a2dcd3012925a3e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864144, "uuid": "08edebd5-c47d-4dc1-a2e7-4f0a0184d73f", "comment": "Malware payload (NetWire)", "value": "887dc596452817d1ec48e073fd28312f0e75932e34fecf13bdc6ce68ee665f4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864144, "uuid": "6d6f9831-333b-47d8-a715-2d6fd35fed48", "comment": "Malware payload (NetWire)", "value": "1d39ba196552fd588c4f84ad396de0778371fed7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864144, "uuid": "06bbac3b-d006-4da5-8db3-22bb0e489913", "comment": "Malware payload (NetWire)", "value": "0bea33b637d358d7fe30b833b1a0f1d73fa32d8ec7cce67af401f3295ccbb73ddc8d3049464a2a23085ca21a0ce8b91a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864144, "uuid": "ebe83f02-3484-410c-9c1c-f45f8482a782", "value": "T11133E70C27D8B251C2FDA5BD89F211BC43B7BCA36A11E64BDEC0FE5C3872A956501A47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864144, "uuid": "641dcd95-5522-4e0f-9208-6d248deb4cb7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864144, "uuid": "c3412c97-e8f1-465e-87c1-1b9666826483", "value": "768:P8CTq2W8/ZU364FGQ4rIxvVKmXU88IN1wu9gTMCr:P7TqkX4FGQMC1Jz3IMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647864144, "uuid": "2b5a154f-98ad-405c-a8b6-5f1b7364ebda", "value": 54272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647864144, "uuid": "6cec9cd3-2e85-48f2-b949-3e153601601f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864144, "uuid": "6dc50a83-2ff1-4600-886d-8204aabec1df", "value": "Scan0741000110.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea9bd447-a929-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647875803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647875803, "uuid": "e51b2c22-692a-4b18-aef8-953d9d558b64", "comment": "Malware payload (AgentTesla)", "value": "8c69c4ea2f0219eead964cab6b2b17cc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647875803, "uuid": "dc573b24-80f1-467f-9bea-63aeaef88ac7", "comment": "Malware payload (AgentTesla)", "value": "88e423165b95bbb6d3fe432b078a87461f461324f8c6f2eb8f488aa69c4b05d6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647875803, "uuid": "3c729097-1ba9-4fa9-b537-30223b93fdf5", "comment": "Malware payload (AgentTesla)", "value": "1d6d29c3f5c1862532469f0bf0f8c41ede2361ba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647875803, "uuid": "1c7cceb9-b177-42a7-8394-843cdddac3a6", "comment": "Malware payload (AgentTesla)", "value": "235fcb66f0a9020a01d63257d248ec80b8f54c852cf15791657416ca9694275f68d5f6b3381ad40f2cc531b6ecaed94e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647875803, "uuid": "2e69b8b9-420c-4260-b131-974655915a91", "value": "T1E525235C7BE89E37C9DB9D78C4B8B9455BB70456AC03CA080E88A1494C137F05DAA7EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647875803, "uuid": "47404572-b6e1-4833-a48f-73e9c7408c1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647875803, "uuid": "359fad72-42dc-44fd-bbc1-6afd76df61d6", "value": "24576:jFQl9zvAEFL4qyBElxGLiXS818njsy41vxBLv5n8DlNr:jFOzvVstBgxHF18jsBvxBLv5U3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647875803, "uuid": "621f1515-b8a0-444e-928c-c6e9e5be625a", "value": 1044992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647875803, "uuid": "11b2e9e5-91cf-4f60-86ef-50da9723d3f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647875803, "uuid": "b94c8e1d-e648-4c1b-8488-49283118dc11", "value": "Product Purchase Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b872d3ce-a935-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647880873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647880873, "uuid": "acbe0beb-8261-4efc-95c6-8af392b481b6", "comment": "Malware payload (RedLineStealer)", "value": "921a7b1b9d214864e841e367c6b66eee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647880873, "uuid": "6d3efd6b-6495-4384-8932-b51479de4ba3", "comment": "Malware payload (RedLineStealer)", "value": "8933afd919d120bf9b572f07110aca6c46e26d098770202ceab73160c21f8204", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647880873, "uuid": "22dce6a1-bcbb-4806-8ab3-c1a55d9947a5", "comment": "Malware payload (RedLineStealer)", "value": "8862d227692aea8ee80d2e2212bb2ba3a028100d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647880873, "uuid": "b50f36e2-64ec-494e-a58f-c7c413e5566b", "comment": "Malware payload (RedLineStealer)", "value": "a3387f8d0361aa60351219f6ccd95c24495428f5c0fba7e74853482e0aa83473747678f19dff4ea80a2a5139c35fba35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647880873, "uuid": "8d80bff1-97ae-4ecb-a765-06c1cc9adcd5", "value": "T1C284D010BB90D035F5B712F849B9E3A9753E7AA15B2494CF22D42BEB16346E0EC3135B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647880873, "uuid": "a388f323-9560-47a6-9560-db716edc2575", "value": "bed14e41bdd24b7cea4b53883d7b3cf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647880873, "uuid": "4b1d0e6e-d42a-4111-bf61-f78ac5e3ab34", "value": "6144:UAc93x3rt6hI3FGgRntTFMdtE2ghZY5NKRZ7bIjbKPpBpEcISkgaHnYz9eKmJns9:LOx3rtv3EC1a7AuNK3XBpXISZa4hhmy9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647880873, "uuid": "e30c83e0-f5a1-42e1-b0ef-4ada153b400b", "value": 390656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647880873, "uuid": "3d8e8991-2fa3-4bcd-8fcd-8175174f059e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647880873, "uuid": "09dedf36-e910-4f82-9cdd-b34bfc10af45", "value": "921a7b1b9d214864e841e367c6b66eee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b021254-a8d7-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647840397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647840397, "uuid": "02e043e7-d46f-4051-ad95-a145ddf814db", "comment": "Malware payload (RedLineStealer)", "value": "b4fc7d106ea5b8b5f6b5615cda031d12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647840397, "uuid": "b9ab6347-29cb-4afb-85bb-9c9ac78dfdb3", "comment": "Malware payload (RedLineStealer)", "value": "89bc1770ffb49c92f6473138f49bd23e7200b86e3284d0ac373d5f2340d167ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647840397, "uuid": "40b78303-e2c9-441d-b8e4-e5f1100e8e29", "comment": "Malware payload (RedLineStealer)", "value": "fda7e1b2d1e4a94573e186264fd331002009c912", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647840397, "uuid": "1d3ca22d-79ed-45c3-bad3-eb41e97059ab", "comment": "Malware payload (RedLineStealer)", "value": "95f187c934995223e11594dfa30e9eee5b2dfcdc0b2a34eef944bbd8131362edda4f611a8f6cce93d00c342b10a6d1d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647840397, "uuid": "2276e55d-f1c3-46d5-85fc-95dba4dcf5c6", "value": "T11E26331036659C36E0B281351EA456F347BEBC304F56BBCB83C41F6ECA252D27936A5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647840397, "uuid": "a4304093-f9db-438f-8a5e-4da0e970c2b5", "value": "d59a4a699610169663a929d37c90be43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647840397, "uuid": "eef5a94b-9c33-4398-abfd-99abacb22487", "value": "98304:y1Q+L2BZz/da+5bPGnxzMC5TxTl5mwUb+CTiKqFDL:y5Lad/o+xGxzMCBxTlrUX2dF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647840397, "uuid": "23af9dc2-e547-4b46-8c8b-29a584602fff", "value": 4430848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647840397, "uuid": "bce49859-b3b2-4576-ac0f-959f7c1f3c7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647840397, "uuid": "825cd06f-6749-403e-9b44-a4b525f84c60", "value": "b4fc7d106ea5b8b5f6b5615cda031d12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9054fe8a-a8ed-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647849882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849882, "uuid": "d7e30b95-d87c-4721-968b-d7914554433b", "comment": "Malware payload (SnakeKeylogger)", "value": "13cde0860fede53683b6de13179084ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849882, "uuid": "acfcb8d2-bddb-4991-8753-17c24d6f176f", "comment": "Malware payload (SnakeKeylogger)", "value": "8a77dfe996ae250ca3790004b42cc914d0af6b1e0ab9bf0dd71be79e5c7a25c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849882, "uuid": "cef55677-bf39-41ad-abc5-62ef7ff119bc", "comment": "Malware payload (SnakeKeylogger)", "value": "f1e99e52fb96e6fed61e3663d4c3ea75ea34be4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849882, "uuid": "fdac24b4-7431-4de1-af11-f8313ede4687", "comment": "Malware payload (SnakeKeylogger)", "value": "acebe5dbd5e624452f310bc4ed0d392408487503b2c58083a660aa336579382ff44563046dee769032c5696189d7c4ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849882, "uuid": "b85b258f-da4d-406c-9004-deedd3587754", "value": "T1F825238657F8A730D0EFE772D8BD65544BB308CE3402EB48D8561B8A1707F941A867FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849882, "uuid": "a4a37139-c0fd-4efe-9ee4-72dae47d677c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849882, "uuid": "e3835761-a2b3-49e3-8c85-0708bca92ff9", "value": "24576:5n6l9iWjR2ugWIDbQ19aU4nBnNsyN1Adh:5n8PHgK1kUgBNsuAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647849882, "uuid": "b3197621-23ef-41d4-a937-1d3acce3ebea", "value": 973312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647849882, "uuid": "7bd23fbd-ea09-4dbe-a695-8abe68eeed2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849882, "uuid": "9f3f2579-5f8c-4222-bdbe-1a8218aaeae7", "value": "aidYG22m6cum7j8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d378535a-a90f-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1647864597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864597, "uuid": "db2de13d-a10d-4e81-be5c-62216d731fbc", "comment": "Malware payload (NanoCore)", "value": "70ea776a5a664cdb6c9276fd7f7eb81c", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864597, "uuid": "09d1bd48-7a47-4344-a6cd-37ed362cd0e0", "comment": "Malware payload (NanoCore)", "value": "8ac54aab4ef3af3c5c4606961a985f9a9883fd3118735397010b5c9d0b191964", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864597, "uuid": "4b0820fe-bc53-4cd1-8cc5-767b31517cc6", "comment": "Malware payload (NanoCore)", "value": "9919e93d68edcc8251840e65ca7d2590e1951652", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864597, "uuid": "1c55a30c-747f-4d2b-a46a-5abfc97ab8af", "comment": "Malware payload (NanoCore)", "value": "2d76ca46213b58c6f550de37b5e4dd900264683b428309b122f9a87b81515506ae18632f98b622b2a0a7b1781bb8834e", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864597, "uuid": "86e4f6d6-42b9-4c1b-8411-5c9b6a7dd643", "value": "T1E43523A5B7781132D877557208B40144077B3A9F2903FB60BA0DA4E58B4F3AD1B6BBF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864597, "uuid": "964b8903-975c-4213-b3ba-bd9f45cf7d8d", "value": "24576:bjwl9XLFyDVjnKCmujATFXWEZbmgi/jyzviyHZvVu:bjuXBYZLVATFXWybmgiLw5vV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647864597, "uuid": "e7af2aaf-4268-42b0-aeb3-d27372da0b6b", "value": 1132544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647864597, "uuid": "5400906d-28d3-4652-9060-e81bea1b6867", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864597, "uuid": "2f0626b6-1e9c-4aaa-a8e3-8fdb8c63d7f9", "value": "DHL Express Delivery Information_Pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b6d187d-a8f0-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647851162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851162, "uuid": "9ef665b1-2329-4e7f-8500-c5396db42c2b", "comment": "Malware payload (Loki)", "value": "b1c1926efd94ffd7eb105a2f98d74c24", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851162, "uuid": "88b74a6b-e3da-4f65-a4e6-02d842fbd3d5", "comment": "Malware payload (Loki)", "value": "8b13bfe1bca85eb545934ab0f96610c7a812cfae978fc08df2aa8ac7e23d2335", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851162, "uuid": "328cca75-ec2d-485b-987c-0b388c61af9c", "comment": "Malware payload (Loki)", "value": "1180f42ab97339577127e6c401badfb942110dd4", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851162, "uuid": "183a263e-2050-407d-bbbc-27f37d6e4702", "comment": "Malware payload (Loki)", "value": "20c7c9e6ae8df15e0f0d0aa03e9d92c37b30316352d9008430347f46a39c161827bccdbdde3e36452d52d18307b06c9d", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851162, "uuid": "24b88118-89e2-4ce5-8369-f150607684c1", "value": "T13A040225A93FBC7DF4F061B56A87C2A40A51BE3AA438A00536243F1D78F2A1196FD674", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851162, "uuid": "954c66fd-5570-45f9-89ca-8ad298733a90", "value": "3072:DTICNWrZY1I7HAsoBkr3xaLtaTGMHRXOqpyPdIctNE7QPBRGcJ:XorljQEkMHRgdrDEgRJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851162, "uuid": "70bc1e87-c9bc-4573-8907-dab162952a13", "value": 186888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851162, "uuid": "0afb4ea0-c4ea-45f9-b0de-a2b37dd99954", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851162, "uuid": "887cb877-9424-4c7a-91c0-d35a38afd649", "value": "c84713.rtf.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4108de25-a8f5-11ec-9275-42010a9c0029", "comment": "Malware payload (vkeylogger)", "timestamp": 1647853185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647853185, "uuid": "3eba8f56-341f-4004-b781-8f1123e13cf0", "comment": "Malware payload (vkeylogger)", "value": "4552348445415f5a30a31366a5d5e126", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VKeylogger", "colour": "#FE96F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647853185, "uuid": "8aab1679-8320-4c0b-b17e-fb38f4177c97", "comment": "Malware payload (vkeylogger)", "value": "8c50b6cbe0c930b7e7725350fbb11cf8f1d7e8d5efb0db383d507155ab9f0a7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VKeylogger", "colour": "#FE96F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647853185, "uuid": "60dd9184-f7e0-4743-b303-e0eebe637c8d", "comment": "Malware payload (vkeylogger)", "value": "c15892a50f4237608feee5b06c0737c3126a8bc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VKeylogger", "colour": "#FE96F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647853185, "uuid": "1b8d0738-5a7b-4f3c-8393-bb6c07089497", "comment": "Malware payload (vkeylogger)", "value": "5464542978763c6e3b6920b6718436e5fef3c37350765ece06d44a759d7ed143c3ff5756215976ad3dcd3a64a3c693aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VKeylogger", "colour": "#FE96F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647853185, "uuid": "2fe490a3-7f37-49e6-be5e-2b0487cb8a9d", "value": "T1EC54AD0176C18530F5620D3EB9A9B568D32EFC6D07D079E7E3C797AA5F206C0EA70926", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647853185, "uuid": "8f69be50-5bf8-4573-a605-9b6582407b2e", "value": "3ffe16ffa9a486170b22e4b390a7fad1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647853185, "uuid": "3e8ca17f-0c61-4508-b398-e6c4e68f54fa", "value": "6144:CABd84uhuDhWlJo/Lw1RPsLnq0C7joZCf5f:CABdsuDhoo/mRULqrLf5f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647853185, "uuid": "7e56243f-3658-46a8-8375-dd95855d2b46", "value": 283448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647853185, "uuid": "9a75c06d-632b-4acb-8d5e-8f9a2e8242d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647853185, "uuid": "3ca83f01-a04c-4073-82a2-5b6ea6eb3d49", "value": "4552348445415f5a30a31366a5d5e126.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90aa98bc-a948-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647888967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888967, "uuid": "90bf4c78-dc69-4fdf-ae6d-cf2682f01ab1", "comment": "Malware payload (RedLineStealer)", "value": "f8e03edb6dc9431ca7771b0ec0e1c488", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888967, "uuid": "e1edf8db-faee-42d1-a0db-80639f037de9", "comment": "Malware payload (RedLineStealer)", "value": "8cf9a38c56bedd4154c130c72839fcd6a7325d6ccf6b2689e2a11c47e6fcec46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888967, "uuid": "11fbe921-1838-4690-8736-f09c4333efab", "comment": "Malware payload (RedLineStealer)", "value": "d28128da1b1d48ad772de24ad4839c438f92dfe0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888967, "uuid": "2d8a9869-d309-4d77-b5e3-3b071632a7aa", "comment": "Malware payload (RedLineStealer)", "value": "a72c9e265fdfd9f96283a47a5eae148c41ba343d66669205267f27421db32fd41b322316325d50d333af28b7805fe826", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888967, "uuid": "b226cab8-e951-4394-aced-88f9ef85bf84", "value": "T1A884CF00B790D035F5BB12F8497A93A9B93E79A19B1460CB72D85AEF16357E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888967, "uuid": "2cb7254c-d694-4e8c-a65d-4f56a9bbe69a", "value": "748f08eada0979fa8642d413794a1a5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888967, "uuid": "a09eea40-d0f8-4aa0-bda8-e45a7b964c04", "value": "6144:ua/phhPIZmDSeDOqdmUeWTLKYWAjLjIn77MV+jWaSPQdxmcDOqDNo:uIhhPIZmDSZ+mUl3KYWzMV+jSoLjOK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647888967, "uuid": "d5f65936-21f7-4ffa-bf5b-80fe732b7c54", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647888967, "uuid": "547704c1-3963-4195-922c-a94d13e98281", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888967, "uuid": "4e65f086-db72-4c45-b5e5-4288118804b7", "value": "f8e03edb6dc9431ca7771b0ec0e1c488.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b70be8b3-a914-11ec-9275-42010a9c0029", "comment": "Malware payload (DBatLoader)", "timestamp": 1647866697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866697, "uuid": "dab19995-9893-4d3d-ab4b-5e7bdc1bfdcd", "comment": "Malware payload (DBatLoader)", "value": "9741d20a40c1240121a3e92ada31e36d", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866697, "uuid": "4e3ec0ea-c360-4a95-8112-3ba8bfb1e40b", "comment": "Malware payload (DBatLoader)", "value": "8d5f75029a8b18b50f6d17ff20cb510d60fcea55b7ea49b9bb3f18dc1424db8a", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866697, "uuid": "6a4c35bc-4434-489e-bf70-3ef15cae76f0", "comment": "Malware payload (DBatLoader)", "value": "bef395fcbba8e117f769d9f0bc0eb8869724bbe4", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866697, "uuid": "bf9f601d-5f81-4e44-ab58-fef5618b5aad", "comment": "Malware payload (DBatLoader)", "value": "3a4d6007168e02d35b0e8897cfade24568d16bf840befd499d482a5a004235aa62134cff4f3d66d2cae9a312ccb61da4", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866697, "uuid": "f6117506-5157-431c-a9d6-27b054cfc175", "value": "T120D45CE6F2908837E0232934AD8E86B99815BD51FD249D4AEEF47D8C7E3C7C2B416153", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866697, "uuid": "32099429-e8e7-40c7-a3df-2e1df0ade503", "value": "8855fa9c9366af3805198d563d544234", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866697, "uuid": "d4bac39a-667a-47f3-91bc-de805b964cfd", "value": "12288:leGezcWTwVTIdGk7R2A67pdTSJKsAR6zqI6F3HAh:j+kVT1kfINktHqTHAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647866697, "uuid": "5c741fe8-34f0-420c-be70-d9608bccfb46", "value": 608768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647866697, "uuid": "2074adb1-76d2-4c43-8506-28879cb52d9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866697, "uuid": "53751b96-e006-40ee-b2b0-51d05634e35c", "value": "PO.NO NIP220104-JUMBO NIP220104JB-002,007.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea044be-a913-11ec-9275-42010a9c0029", "comment": "Malware payload (BitRAT)", "timestamp": 1647866012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866012, "uuid": "f7819f0e-1365-46fa-989b-8374b39b3776", "comment": "Malware payload (BitRAT)", "value": "58e0f3f8c39232d342d952dd57d372d3", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866012, "uuid": "b17cf1f5-fd2b-4912-9164-dd8681b8b573", "comment": "Malware payload (BitRAT)", "value": "8d9ba741c497d3af424724bd632a20158e0cb59029b8db358719e97fb793ecd9", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866012, "uuid": "56baaed7-8f48-44ef-aed1-7946dbc4982c", "comment": "Malware payload (BitRAT)", "value": "e27abdc2fd86c3101225d5d1a4a06702b2747d90", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866012, "uuid": "15fd12b2-2cc2-4425-972c-9a2a734fd8eb", "comment": "Malware payload (BitRAT)", "value": "a3b1b4db163e6cf363905bb8a565e9c1306fcf2618a114aea0e543fde321b567136f2067464fdd99aa152b9e151ef9d2", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866012, "uuid": "3ef7b8a3-8f49-4a7a-9084-2c0ef2f33441", "value": "T177327CB21B9C2C87DA9BC5F2DC69BD246717F34206CF2E51331CFA711B764246769800", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866012, "uuid": "2202ef1e-7ff9-4a9d-a114-10485fcd0450", "value": "192:Gaxck3Vad9vK7bhuWcnH/hLUk/JI6lvJgoOchjc0yV+n5CM3uwLcANnd:tczvAuW+JJ6STOeSMnoM3Zwund", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647866012, "uuid": "d7ea8a78-8143-415c-9872-a1ad79884680", "value": 11604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647866012, "uuid": "faa81fe3-235e-41fd-913e-2bff6a3d1d5b", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866012, "uuid": "af902953-ad94-40f7-aa7a-a3159a745396", "value": "Inquiry list 21 MARCH 2022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab488bd-a95f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647898808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647898808, "uuid": "20aaf58a-21c0-4036-9695-cd1b11610d9d", "comment": "Malware payload", "value": "884a9c625d95c07f1441d4c89c642dec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647898808, "uuid": "86dd5e0b-bfb3-433e-bfd7-ada26ec53b06", "comment": "Malware payload", "value": "8dc1a1dd2d8b2a06aa7541a850c71730d5c9430129efaaf7e9d8c06f617c51fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647898808, "uuid": "498b58b4-c318-4e88-b101-c8379810a5d3", "comment": "Malware payload", "value": "55e76afc687b395cd59bcc01a2fbf7b0ee96e6ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647898808, "uuid": "02c68644-dec1-4994-a991-6fc0512de419", "comment": "Malware payload", "value": "69b0bd8af08c36d824ef9ab5c37d56e9159bc6a4c6d775c63095742c4eec677e96903697084e13c930c3a43bfa5e86e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647898808, "uuid": "18285704-3311-41c8-ba3b-7c374d75749c", "value": "T1F534469D726072EFC857D472DEA82DA8EA5074BB931F4203902715ADEE4D89BDF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647898808, "uuid": "010f1941-45ce-4689-81c8-423a1f786366", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647898808, "uuid": "c35a82d3-95f4-4be8-847d-df060cf8bc10", "value": "6144:ReH/F1im2UzrLHB+gnSO/se6seO/BElLCXAH0HWsOjGrRGxUTpg7VBbCawd:YH/F1D7zrLIgnSO/se6seO/BALCXAH07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647898808, "uuid": "b82578f1-2fa0-4ae0-b646-3dda9f4bb23a", "value": 235008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647898808, "uuid": "42f397f4-e9a5-4835-a4af-849c57fb88fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647898808, "uuid": "0eec22bd-73fd-4146-8df0-9b6b89f02069", "value": "884a9c625d95c07f1441d4c89c642dec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b708845b-a8f2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647852094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852094, "uuid": "df0a5811-aab2-4d22-9e52-0ab1ef53f30f", "comment": "Malware payload (Heodo)", "value": "543176db3e2a3e0a20282118eb4ca877", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852094, "uuid": "f31d2a6c-81f2-42e1-b1c2-78e3f49c36e6", "comment": "Malware payload (Heodo)", "value": "8dd42bae44b81a33bfe39deccb2fb33faef0d350feb33f826117dedbf1605d5b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852094, "uuid": "fbffdb68-6160-42fa-b271-d9cc53cbb389", "comment": "Malware payload (Heodo)", "value": "70f56791a6749f3f48427bd0f2c9ffb334e61e7d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852094, "uuid": "f5447f8c-9053-4598-a981-a61b5641723a", "comment": "Malware payload (Heodo)", "value": "fe5caff004a1e5eaa6117eaf7515763921c1c2988ac61e1f101108ec9102ed1c1a9b83cac6236da6d2174e67181a1be6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852094, "uuid": "0c4adf6d-0880-44be-a619-5faf59d9c2c1", "value": "T19C056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852094, "uuid": "00648650-aa4c-4814-ac14-20aa26825b74", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852094, "uuid": "d9aa44a2-28c6-43f1-8f2b-8c5867639be4", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rq5CGNHrH2tZ+d+:gMV/rq5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647852094, "uuid": "2f2ed1ef-07d0-45e0-9639-49ed56d68ee1", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647852094, "uuid": "5cda463e-d080-4d0f-abbb-39de89fb3650", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852094, "uuid": "d22c850c-55cc-401d-be99-26b9bcd91d3d", "value": "543176db3e2a3e0a20282118eb4ca877", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc0289cd-a8e1-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647844909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844909, "uuid": "83e459f2-6b8f-479a-9041-69e52d512691", "comment": "Malware payload (RedLineStealer)", "value": "3c74019ad22fbf703951443fd341f21d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844909, "uuid": "e935ff35-2d3b-4327-896e-e545c1e9bf4d", "comment": "Malware payload (RedLineStealer)", "value": "8de3f9b25a71e77642c09575b921e60f4620c62377e00dbef078a54cb4f6ad36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844909, "uuid": "660ff289-8fc8-484e-ae87-f04b1cb74c25", "comment": "Malware payload (RedLineStealer)", "value": "35a85c8317eec34544be5c125ca086a1387bd3b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844909, "uuid": "60b5b681-16e1-47b4-80d1-359188247cea", "comment": "Malware payload (RedLineStealer)", "value": "e5e1b2fcfd4edd586faed073dc04099b0745b15e1dff848363a1a050e8bb0dfc598d32d5e7b876e99497dd23426306a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844909, "uuid": "2d9ffc22-c906-426d-b7f3-eb836d34b767", "value": "T15854129E2384C5FBDA7746B444BBD766C5FBE3143201052BA3111F9E0A361BBCE692E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844909, "uuid": "4fe94d4c-bd5b-4766-ad3c-875ec6e21f82", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844909, "uuid": "2410e608-a0cb-4e03-ba2b-de123fd2af10", "value": "6144:TxDUcHCsJqvO//yRfaSodv6x+85KVrOVRw2GjVpWP0Elo:risU2nyRjodfVrOM2GjVpZElo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647844909, "uuid": "3f97c3ae-8222-43cc-b1ee-1e3b3c039191", "value": 298578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647844909, "uuid": "2c849329-e3f2-4231-8e86-ffb81c609699", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844909, "uuid": "2dac7ec4-7198-478d-af42-57e3f327b38e", "value": "68106008.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73e186c8-a916-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647867444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647867444, "uuid": "19acf106-569c-4c07-bb74-532342e3b0ed", "comment": "Malware payload (Heodo)", "value": "2acdf30e9e89ae668c230aa2fc1e24ee", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "ocx", "colour": "#2B6846", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647867444, "uuid": "f5ab0545-35c4-4a5a-b3f1-c407153c2cd5", "comment": "Malware payload (Heodo)", "value": "8e096f200910365d3b620b8e394178966afa5b5980b8a48b0ea1a731c01eb8ee", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "ocx", "colour": "#2B6846", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647867444, "uuid": "a63e1127-ffa5-4504-8160-8eed2447553a", "comment": "Malware payload (Heodo)", "value": "6cfa285815388b9fc262282ae044874199356f5f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "ocx", "colour": "#2B6846", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647867444, "uuid": "67f919ef-d4ac-4b36-8ed3-5fad43bf94a0", "comment": "Malware payload (Heodo)", "value": "7d9aa74940f528acee690cbc834dfd231fc02310f6327b21f851f50aed8f2dfd5c005d5f386a98a44044f78204b9e070", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "ocx", "colour": "#2B6846", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647867444, "uuid": "7133cbc8-7ae0-4b16-818a-96036a8875cb", "value": "T1E1056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647867444, "uuid": "50fc2ed6-9b78-4d00-8522-bdcb7ef00b41", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647867444, "uuid": "0765fc5f-ec46-4a32-8416-01ef906ae4ad", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rH5CGNHrH2tZ+d+:gMV/rH5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647867444, "uuid": "21a972f2-ec49-4352-9ef9-d5f6605ce47f", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647867444, "uuid": "786c80e1-816e-479f-9750-517f5bc67b98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647867444, "uuid": "adeb1dfd-0232-4ad4-be28-eb4c789705f2", "value": "xdha.ocx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e7f87e-a953-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1647893648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647893648, "uuid": "1a7f12ec-0dd3-4602-a37c-151d59810f77", "comment": "Malware payload (Gafgyt)", "value": "3143c9a4a2dd4f6d6a83a0fd93065700", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647893648, "uuid": "83f64bae-1d1c-4c26-a851-ca62b63dcb69", "comment": "Malware payload (Gafgyt)", "value": "8e0af6907f6e80dbc77c56c66d971931c7de20fd7ec589a6d4248a3aa50189d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647893648, "uuid": "70170b41-df7f-47e7-bd38-da38643d9b5f", "comment": "Malware payload (Gafgyt)", "value": "d9c419164b84148f9a165356e66dfadcd35db40b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647893648, "uuid": "406b8c63-11e7-452f-99c5-8e99786fb6de", "comment": "Malware payload (Gafgyt)", "value": "01775f5163ed5b8d2b046ab2cf592ffa6b72741e9f60ea15a406552e7bb357c35ff9cd8439f748c2df66518cc20d968d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647893648, "uuid": "fb2668d9-39b6-4b4d-bd48-d3e326d27635", "value": "T16EB31977A8655FB7C086A9B115AA5A300F52AD930F4F1A99713CBAB0033F4CDB41EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647893648, "uuid": "6c95ea7f-c1e2-4efa-bf51-bee005d568b6", "value": "3072:2JGaLQj5xyXZcId5BFpiHImHtcvErvavEN/:2JG8Qj5OcMNpiHImHtcvErvavEN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647893648, "uuid": "8fc44f75-b78b-4a9f-8754-5ffebf4d8729", "value": 115139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647893648, "uuid": "ff945f2d-bccb-4ae3-9fc2-acc9ffdbf54e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647893648, "uuid": "d67f190b-956d-41ed-833d-435878812e26", "value": "3143c9a4a2dd4f6d6a83a0fd93065700", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e9ff12-a91f-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647871286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647871286, "uuid": "e29ef3b0-83e7-46a1-bc4f-e12090143df2", "comment": "Malware payload (RedLineStealer)", "value": "af4f1d3258ba476b0ca39ba1b17b6a8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647871286, "uuid": "c4c3e87e-1282-4c86-b3bb-89593b02b2a6", "comment": "Malware payload (RedLineStealer)", "value": "8e88a317b2a066bbf484f480b1d982880d3749a0ab5d33bab5de59bcaec22b5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647871286, "uuid": "5e6d49b5-5d05-4248-adf6-95cdc0795fde", "comment": "Malware payload (RedLineStealer)", "value": "fa6af8a445dd960031cb9183e191b55d3c299843", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647871286, "uuid": "c30cd85e-19d4-4dfa-bca4-72ba252934b3", "comment": "Malware payload (RedLineStealer)", "value": "6f8784ad4b0e0fa70b24fb45f83808a2c1cdd2e2c55b4ce4ed58cb6ead76ee0c9af61c1a9fa91f28c629c5a648246a60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647871286, "uuid": "8b350a14-7983-44c7-b1f8-36bd08ae4db4", "value": "T13A94DF40B7A0D03DF1B312F8797AA3A9B53E79A05B6440CF22D62ADE15346E0ECB5357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647871286, "uuid": "182b79f3-ff3d-4f3c-8f2f-bb79fc353e37", "value": "d626a2a864a52e91dc5f85b5e98029ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647871286, "uuid": "9fe5a891-3643-4790-b853-b340ef32580e", "value": "12288:AuoTJVW57UAdgpW5nDu/A/QfLghETttn4M+YM:tWV/0V5DuYIUhETj4M+YM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647871286, "uuid": "37845843-99ed-4f13-9a0e-525754adf884", "value": 417280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647871286, "uuid": "8ce404f3-4355-44de-97db-d704882d1dc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647871286, "uuid": "397e1481-3ab7-4684-b70b-8372b086a0d6", "value": "af4f1d3258ba476b0ca39ba1b17b6a8c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c13c5b-a8ac-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647822026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647822026, "uuid": "f75f3de2-4ca0-40bc-8823-bd01a8afaaa8", "comment": "Malware payload (Heodo)", "value": "cf947a7a6077f72b44f547550e99f73d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647822026, "uuid": "406eedbd-3e88-44b8-93bc-e6cac17241b1", "comment": "Malware payload (Heodo)", "value": "8e8a14bc7d706f113595bc86042faf3028c39a3ba07203fa92abea0ee3490ef5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647822026, "uuid": "c589a77d-255a-4cde-9b2b-10a8f145e8c5", "comment": "Malware payload (Heodo)", "value": "3ac11b3972ba56a7a589c972b5ab6409c27f5abe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647822026, "uuid": "59cd537a-9694-442c-9c1e-599be847f96d", "comment": "Malware payload (Heodo)", "value": "7b9ce26e8e894cc83190f521612f74770ebccd62ae4fd0189fa28263cfb5e1752ed1b980c8af24167a8e7afa2fc10dbb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647822026, "uuid": "66492700-2af0-4de3-a537-acf2829244f5", "value": "T133B43A317492B279C2EBD73408A35275B21AEDF157E274E36EE707CC4B366906E72602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647822026, "uuid": "6393ad55-1785-402a-a4c8-5e4f9f8f9097", "value": "55cf9ae1e74cef637eafd17181390202", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647822026, "uuid": "1dbaeaa3-129c-4368-afc1-b27a4b7fc0cf", "value": "12288:7FFCpYDLbBHqKK85H3j62VlMD4zeSvturG9+:7VDLbQKBVlMDOtv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647822026, "uuid": "941d61a3-7aaf-4f90-860a-52ef2134cd82", "value": 516096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647822026, "uuid": "44d395f2-dd1f-4e45-9395-ad544d219543", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647822026, "uuid": "3943baa4-9b6e-4146-9a7b-f4ae285fe9eb", "value": "cf947a7a6077f72b44f547550e99f73d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5588de6-a8e1-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647844790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844790, "uuid": "2a2b63db-b63d-4375-927d-48e7b84ddb01", "comment": "Malware payload (RedLineStealer)", "value": "5ed36addda0a56f58d2e189b525914b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844790, "uuid": "2daeb66c-3db9-4d51-856c-9a2ba349f8a3", "comment": "Malware payload (RedLineStealer)", "value": "8ebf1295b274627e4f2e5083b465866a6ea7ca296620b863ab86fec72dddc16e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844790, "uuid": "ac8dbbce-5ea2-45bd-9a51-906e04eb0f7d", "comment": "Malware payload (RedLineStealer)", "value": "246a653ae0a1285b1a93c9e075e2bbcbcfd0c092", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844790, "uuid": "7a8523e8-786e-4d5d-b6c2-890dd1117b83", "comment": "Malware payload (RedLineStealer)", "value": "1400719fb54a7feba519df7c100dea6e7faae7e75d58a082d9f3506b9d82e76f0417d10d8d3188992afc58ce68499f6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844790, "uuid": "753176c4-f16b-4db2-b0fa-b505a695399d", "value": "T11234CF2175D0C1B2C477503044E6DA7A9E29317107BA96DFBBDC2BBA6E213E1A3352CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844790, "uuid": "3ba7a1cd-62a3-4a1e-94d1-fd9ef09be697", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844790, "uuid": "21296fbb-55a8-49f2-9a95-b759b01a5f5f", "value": "6144:6DKW1Lgbdl0TBBvjc/gco6YBO1djRgPepHp:8h1Lk70TnvjcRo6Yc1roe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647844790, "uuid": "7badb3b9-db2a-4867-9e4b-21df059d1c8f", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647844790, "uuid": "56c81b4a-1c9e-4fea-bba6-b13e430e8694", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844790, "uuid": "5dd6b026-43be-4f33-b3bf-6a79d8857893", "value": "93638076.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a03cfefc-a938-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647882121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882121, "uuid": "5c109d22-2bdc-4f93-9f62-4166512d450a", "comment": "Malware payload", "value": "bac2f897a58a12389e85e6417fc3ad02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882121, "uuid": "1a9e500b-bc06-4a37-8f52-5bcd31faaea2", "comment": "Malware payload", "value": "8ecc2a19dcbcfe3f7f6e749dca526d6f1c0d277f95a9c2b8df6f81fe3d1a1d1f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882121, "uuid": "4c66bdd5-ef01-458c-bf28-aecada92e111", "comment": "Malware payload", "value": "c46c6eff37a8770b22331392e87e45f0917996ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882121, "uuid": "aae6796a-32be-49a8-8b96-e6835fce91a9", "comment": "Malware payload", "value": "9116246a64b05d3bb2899984223f57142353912cc54ddf90915069de88acdaa98afa4d18f3e6f0de7788a6d347c2af79", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882121, "uuid": "449199c6-e4c7-4775-8a01-d378d18a0362", "value": "T135A3024433EC5111E7EE867E50B141D01A75A3ABDE02EF4E5A4804DDCEBB7496A327B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882121, "uuid": "191f9b84-36b6-46c4-ab04-24a9d20e9182", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882121, "uuid": "b0fd7e95-3763-48eb-97a5-1e63956a9532", "value": "3072:t1xJKgfsFNWiPQWDWJM22gaxH2zB8DmandQMq:TxJKgkFNWhWGaxHUBcndQM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647882121, "uuid": "8bd39e66-8325-4fd4-838f-bf5b7fd212dd", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647882121, "uuid": "c62a427e-085e-490b-932d-eb16286d0890", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882121, "uuid": "3149b8c4-59bb-4643-b765-39f1b6d66407", "value": "bac2f897a58a12389e85e6417fc3ad02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a06afc6-a91f-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1647871158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647871158, "uuid": "dc7252a2-ea57-4f27-b4d8-97eb0a3de031", "comment": "Malware payload (Gafgyt)", "value": "ae4d7135681dd750d6d2f69adda86bcf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647871158, "uuid": "aafd1a27-31fc-4f4f-ba65-87722f41589c", "comment": "Malware payload (Gafgyt)", "value": "8ee55aaa93eec7f5e30b1cbf8e41ca4e70aea7e19e93f478a7c723da216205fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647871158, "uuid": "a763a4c7-3f75-4a2a-898c-527a17763d49", "comment": "Malware payload (Gafgyt)", "value": "930a6045d47ab87e8a4431ea63f794e09b92fb67", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647871158, "uuid": "2a0d988c-a4dd-4680-8939-051cced0a64b", "comment": "Malware payload (Gafgyt)", "value": "b3ae8ca3e4b6e96961046ace42ad9366a87d1c6394ff52612c04fee3f96cd648cc7701c95088427aee67c2c2eb932645", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647871158, "uuid": "bba84ff4-2790-4210-816b-e6309cbfe1ec", "value": "T14DF3643E7E21ABBEE169823107F65F70CF9529D326A19342E16CF6185E7124C1C9FB90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647871158, "uuid": "3310ac34-31f5-4063-b69a-656c71bd785a", "value": "3072:QcKQeN7t8zTeuZcbncoq4DZi6abmrThnaqEaSknNb:HKvZTfDgNmrThnaqEaSknNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647871158, "uuid": "e541a68d-d067-4b28-b555-8bf598e2aa4d", "value": 162207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647871158, "uuid": "28e5ffd5-4b95-45c8-b744-d08985eb0428", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647871158, "uuid": "a55b5740-dcce-4e11-844e-f6c6150b7351", "value": "ae4d7135681dd750d6d2f69adda86bcf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c719d63-a8f0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647850976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850976, "uuid": "45782ab2-ebc7-49fc-8d5c-59ec143bccbe", "comment": "Malware payload (Heodo)", "value": "bf5ca4b5cf4405f66e939a736a4538db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850976, "uuid": "c83b259e-cd56-457e-860f-921e1a9b8bc9", "comment": "Malware payload (Heodo)", "value": "8f70e47c02c278d4c49c7dd8ab5ed6d3a07290d5f4f411949d4ad6cd0c4e14d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850976, "uuid": "ab829650-6f66-4220-9318-aad4486d63d2", "comment": "Malware payload (Heodo)", "value": "a79d62a3cf1efe312238035413cf4f0f78ed8940", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850976, "uuid": "7555c8b2-1709-4d47-9219-7b8c0d99748b", "comment": "Malware payload (Heodo)", "value": "4c80b5ccec904aa19c804486493d9c5310e27fd96aff67b6ba7743c014fcd837dc929b15141833556faffbc42b4f8761", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850976, "uuid": "38360196-d0d1-414d-a260-3300e326b4ad", "value": "T195056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850976, "uuid": "0e4c2584-4787-4889-991b-a20462c850fc", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850976, "uuid": "3eec5a3a-800d-4a06-ac19-b63721240b53", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/ra5CGNHrH2tZ+d+:gMV/ra5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647850976, "uuid": "0602e46e-784d-44a8-8cc8-60558a81d088", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647850976, "uuid": "161cde88-fe42-4f28-8111-9241ac791607", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850976, "uuid": "50856079-475b-47d6-88b2-3c493803a604", "value": "bf5ca4b5cf4405f66e939a736a4538db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a69653e-a91a-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647869146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647869146, "uuid": "c288a00e-6a48-49ea-80d2-90e2fc0851bf", "comment": "Malware payload (Formbook)", "value": "e0681f6fd3b1fefac91e6d4f78ffc6a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647869146, "uuid": "675f33ec-7900-4853-a868-c76e434b490d", "comment": "Malware payload (Formbook)", "value": "8fb567155619feef229141bb4a87119700061289822b50e682534a2051c5a4f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647869146, "uuid": "d9f636f3-aa29-4e5a-a01b-e4a7132ef2ea", "comment": "Malware payload (Formbook)", "value": "0a2faa6f7a6054b975374e048723d3e4eb352730", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647869146, "uuid": "745f71d7-bc87-4a23-9b79-eb812f74002e", "comment": "Malware payload (Formbook)", "value": "6f33674c55ec2930362a6aa19443c76e3cb2905c8271746bfe014b89285ab77b5dc7c9206a71ee13f8e42f3a8032fc32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647869146, "uuid": "5060c171-20ec-4c18-9273-2dde08dc5f11", "value": "T10BF408BD715472AFC877C1318A945C64FA50A8FB630B4917E4931B9A9D0F8C7EF840BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647869146, "uuid": "d9a48bf9-4288-46cc-aa5d-ea3056c63420", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647869146, "uuid": "696da16f-e102-4da5-a5a5-c871d3d8f6d1", "value": "12288:sVUnKstGyaUdD2CyhIQRdXknrKWryXXPB9HNFCn4asNgTtdD7/XUr7upFEAjU2go:ZKsUyaV/upFRQpWcvtVjIY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647869146, "uuid": "6bdc7b62-f393-48e4-990a-536c0082a8fe", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647869146, "uuid": "2e9527e0-0bb2-49b2-8b69-87ae217803cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647869146, "uuid": "3ea008a4-6832-4e46-9a28-0f74a7a9dd48", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a57474a-a901-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647858247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647858247, "uuid": "25a20a41-ee2c-4664-9e07-ad7cec8f6345", "comment": "Malware payload (SnakeKeylogger)", "value": "dffadb566b1e5c7ebb1106dc2eb7f32d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647858247, "uuid": "be04389f-cb77-4146-9c9f-665fb8f99b4d", "comment": "Malware payload (SnakeKeylogger)", "value": "8fde71dd19823e27074edc7d43927ba4106830721b7dbe145f265efd97a9a31a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647858247, "uuid": "f8f89828-18b6-46ce-af24-a4c89ecb96dd", "comment": "Malware payload (SnakeKeylogger)", "value": "22071c30cf8d787bdcacdb7177e78c59baed98bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647858247, "uuid": "8ebee29e-6271-4307-8a10-90cc2206818c", "comment": "Malware payload (SnakeKeylogger)", "value": "e06775c99d3803d9afbfeae1e6ed4eceeadb6965b17eb503ee27e2d3c69b0214d8afe2c192d76dad32a8bcfe708039af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647858247, "uuid": "441c196b-fbde-4f91-814b-bf8e57b68e41", "value": "T1F525230AB7DB802AC0F96879A4E5A0540FB9469EB423DF4C7CC453894A47B764F2787F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647858247, "uuid": "0f9f7be6-f7b4-46aa-9e55-1e26720db285", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647858247, "uuid": "51738a7d-8a11-4210-a99c-b7a7823a00c9", "value": "24576:0J9kSR3of6JPwMUD1KnJvo9NqLW5mb00KLr1WCHjsq:07kMYfqc1EA3ctK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647858247, "uuid": "1b1682fa-b504-4733-9695-989d64c992e6", "value": 997376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647858247, "uuid": "b2c05150-06d9-475f-81e9-620ff3af9196", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647858247, "uuid": "675f2b68-8018-4aa0-9b0a-1d17c5f25b28", "value": "PO#Z1210800.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59a97832-a93a-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647882861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882861, "uuid": "3b79bf51-4ebe-4bea-b295-61831d4bd9ae", "comment": "Malware payload (Formbook)", "value": "b32f3e6dd826c354347ee8d24d3a9e91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882861, "uuid": "c0f1e652-5b24-4997-93a7-97615139e6aa", "comment": "Malware payload (Formbook)", "value": "909570efc48341a6ae00ae8dcbb8d751f912569a4756f7526bc7d0cf1cda81ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882861, "uuid": "9f8d7c08-12c5-4fee-b7ce-722f25a9dfb3", "comment": "Malware payload (Formbook)", "value": "a0490cb6f79358384d2ac10d75d5fb5d60f1be0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647882861, "uuid": "b54c14cf-29dd-4273-ba01-8fd97ac8a44d", "comment": "Malware payload (Formbook)", "value": "1dcd533480d3b6126234f6892d5ee861c5d9d713cc62f1f7d72cffbc9d40a34236fdef770317b9befa2b928e76909113", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882861, "uuid": "cc8849ee-560f-4e67-87d2-c475800d1f1c", "value": "T10B33E64C26982117C2F86539859E5178B3B9ACB32E11D3178970336F2BF3AE19DC2677", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882861, "uuid": "ae6a7062-556b-4c7c-97d8-b1b670096422", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882861, "uuid": "3cf8429f-a03e-4240-b807-ac4375b22582", "value": "768:Yj5e7+7BcOekxGztFBTwVmNv/VKmXUu8cjpcXBTf4AWCOlF3vSfogqqPDN:5mBLxGznBTyWvlLjmXtlW/Svqq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647882861, "uuid": "dcc84fea-fd98-488c-ae7e-738117c18ec4", "value": 52736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647882861, "uuid": "55bbf1eb-1a03-4d82-9448-6fbdc1afd8ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647882861, "uuid": "033a0011-f90f-43ec-af49-cf4a3243ccee", "value": "Thanh Tuan Co., Ltd - Inquiry List & Sample Photos.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0393f67b-a8f2-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647851793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851793, "uuid": "551d1eb8-e090-4ca9-b0f6-9b436b485d0a", "comment": "Malware payload (Formbook)", "value": "eb470a7a48fa26f1fe71af818fc30672", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851793, "uuid": "cdd395c2-cdaa-49ea-b3c8-aede093d4259", "comment": "Malware payload (Formbook)", "value": "9115bb677daba25bff172f1dc4a6970e4e4f1d3fce4c684c370ecd67c10cb679", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851793, "uuid": "b8a602a9-caf4-4108-b600-3421b4c52b93", "comment": "Malware payload (Formbook)", "value": "8f2a1f1b3cebf2d5aaf9365c1a7f401fbb3b6830", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851793, "uuid": "19fca173-d588-494d-b870-9ab25004ad40", "comment": "Malware payload (Formbook)", "value": "4fc8491386a7da6c2250e02332b0cb825a0c5ef8fb25b6b5bdecf3ea0e0a3bc90d7d67d1a5f22893dc4ac10b759927ee", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851793, "uuid": "8c45d422-7184-4033-9d11-7222dfe88070", "value": "T117018C8665E0D4E801A2B0C7924135B53C8FE59651CD701069B0E2335AEA4BFA7BACE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851793, "uuid": "89b7e0c9-00b6-44b3-bff9-93d584282263", "value": "24:vG1QhPPGPl5HmD5G1QhPPGPl5UXhsSpVENpUCo:vG1QpPGjmD5G1QpPG4xVEDUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851793, "uuid": "4cd5a7da-bae0-485e-bc9c-9b33b4b8301c", "value": 792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851793, "uuid": "1e9d6612-11a2-431d-a535-b2e53c26c77b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851793, "uuid": "327c0461-0947-47d2-90f8-903352bf0e09", "value": "Payment Advice Scanned-0004.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32a7e23d-a926-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647874206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647874206, "uuid": "1bb5b8c1-5a68-4b9e-8259-4472b184fda6", "comment": "Malware payload (Mirai)", "value": "fcedb06be1240644cf7392ae83600442", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647874206, "uuid": "78fc9978-f73d-4381-802f-b56c90b59276", "comment": "Malware payload (Mirai)", "value": "91662febbee42034fc89dedf7c799a549b078451c423025e4bfaa475438a6e1c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647874206, "uuid": "588a3bd0-0bee-4bcb-b3ec-4bcec2e4aff4", "comment": "Malware payload (Mirai)", "value": "76f142636a5857f39b72a1b0062b159faf6b6000", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647874206, "uuid": "411e9cb7-bbfe-478d-968f-728495f72cc6", "comment": "Malware payload (Mirai)", "value": "b637802e372ed7ff5493703f7da00e47cdbd78482db285767fe61207ffa51c6648fa46f6421392eee983a0d707b72c68", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647874206, "uuid": "7910a3a3-7e22-4742-ac0a-2be622efe3df", "value": "T1E2B2D17182CAF1B7D9B04836C51AC381735482BDE30BA5B93794437C99C20AB29FDD9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647874206, "uuid": "eb3fbb7b-18fb-47a6-9b90-1aadf1c07748", "value": "384:Xve61ETeimlczawZcdgCLGh/T/zEYJjVEQjtuJHhk7ZXwmdGU5EW:F1aPmOzplOGh/TLxxESuJyS3UV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647874206, "uuid": "80df53c2-ec85-4a60-9cc4-ebbb60f6d59b", "value": 24076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647874206, "uuid": "d26ba3c6-6bd5-431c-b052-259bbdc5910c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647874206, "uuid": "baa5165a-918f-4331-a9a9-8458c7ca4074", "value": "Cronarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d80a0f56-a8fa-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1647855586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647855586, "uuid": "ddebc035-7040-44c8-a632-f60d8b66b1af", "comment": "Malware payload (RemcosRAT)", "value": "d6f05d1a5cd232bf8cd3c4720e053ff0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647855586, "uuid": "9ddebb07-91ff-467f-9f34-446dceedfba5", "comment": "Malware payload (RemcosRAT)", "value": "918412f1a9685389e243154925460d152bad5d6187fa23a1f3131170a6aac943", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647855586, "uuid": "8ca2e3ae-8b58-4e3e-b9a3-e7ecf2fc6850", "comment": "Malware payload (RemcosRAT)", "value": "c16b3a2414de9331ef793da883712d49e48ddfde", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647855586, "uuid": "ce94af47-c734-4e8e-8f28-9ab64d1c37b7", "comment": "Malware payload (RemcosRAT)", "value": "f9b6ba824f824aac4c56a3f40d14846c87f80be0fb27b101a73b281fd7d35b7d98805dbe66b7aa695ca4fc7d8afe9b26", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647855586, "uuid": "ebb9a07e-66d3-45dc-9a21-7efe32c1af36", "value": "T12635F12B78C340A8C59509B0A7BC5AF863B4675B2849E7EE214613B8DF0562F77035FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647855586, "uuid": "8be3bfa5-60e0-4f84-891e-6737fc7e3737", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647855586, "uuid": "7ddda41c-540b-4634-ab5a-f4c7ad810d98", "value": "24576:+9mK1yGnTZrh01Y1VaPrpGtxhGTLseID:+NyGnTZiO3aPrmvGToN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647855586, "uuid": "37ecc677-b13e-4cae-b4a2-dfe4e341a1b6", "value": 1084928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647855586, "uuid": "8f957009-fbf1-4447-9715-d93c86963718", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647855586, "uuid": "c2c0bd11-f181-4c14-8fd6-a3051db23803", "value": "Purchase order GR8734.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77abb322-a8bf-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647830084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647830084, "uuid": "a6c1aead-3dac-4add-ae05-c3b23aa1e2b6", "comment": "Malware payload", "value": "83b899aa853ed2f98fe51eade534b66e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647830084, "uuid": "9ff56a74-b1f1-4846-9725-594ace6cdd1e", "comment": "Malware payload", "value": "923a5b3b1edf8a0f3d67e4637f16e1df38ce33716ccd6fcfb0854de72343522b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647830084, "uuid": "d94be9a9-ff75-4691-b45d-681a50089dc2", "comment": "Malware payload", "value": "1af22985ea8295aeb79fb9759c728e55ae4cf9a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647830084, "uuid": "75650c6a-9137-475c-bd9f-551cc1a2efd0", "comment": "Malware payload", "value": "9d6b0ccbbbf3f2b60e033a259d8069e3a6632c4a166b67d3657710157792d16110652f07c93b4c2e2b1fbc686710ef87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647830084, "uuid": "b0dbda2e-ba99-4a29-8681-1957f6d94a0f", "value": "T13844CF217AA3C871C98B55707825CFA16ABF7032157588473BA90B3F5F703D296BA30B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647830084, "uuid": "5ab8cbb1-954d-4c9a-ac5e-323a1534cffc", "value": "dd74d0a493381cbdbb2d3a82a03effd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647830084, "uuid": "708010c4-2a90-4dbd-a601-f09c9f2100c6", "value": "3072:hXgggN8xaldaPaxkWvuvi+75/q8LS51dN52B:Fvi8xaldamrGvi+91adNo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647830084, "uuid": "2becea3e-bb77-4791-a4d0-4f64e72be1f0", "value": 268800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647830084, "uuid": "6c92eadb-30e8-4eb2-bf7b-0eedc10eecdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647830084, "uuid": "18ccd1e7-4470-479b-b7c4-6aeaaff3d4c5", "value": "83b899aa853ed2f98fe51eade534b66e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a8c016b-a8f3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647852234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852234, "uuid": "76985a2b-a8ea-44a9-ac06-72fc23161f2e", "comment": "Malware payload", "value": "7ad79094b86e3bc375491b9d5e36a9ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852234, "uuid": "a1ffcd47-7a2a-4e0b-856b-e8f23114d12d", "comment": "Malware payload", "value": "92f42e225389e142f95209aefa95963269e7ecec4a5ea61cccb1651d22d9ceb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852234, "uuid": "a48f2ec5-d4fe-413d-ada6-a52871b3fb66", "comment": "Malware payload", "value": "75aea7986b952621f42ef9057879bcb77520b406", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852234, "uuid": "491f5ac0-54e0-4bc9-8454-2af2eba294ee", "comment": "Malware payload", "value": "de6068ced9f4e866ef2e02a27c60e60feed04499b3bd6f53ef125fa6ec0b0b83cdecafca01d0f86b0d0d8891fe6fc4bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852234, "uuid": "d05411e2-ae39-4052-8ca9-03941fb30500", "value": "T1FBC57C1BB765D0D0C4EAE0388956D28AF7E6B8900B74DFEB26D5035E4EA32D08D7D364", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852234, "uuid": "34c4d215-06b3-43b1-a043-8490f8400fb1", "value": "9334fa5a6d38935a5ce2368f2294776a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852234, "uuid": "e0278043-4b78-4c66-909e-0277b12b30b0", "value": "49152:rAg3t8HJIjOWq6JglqPy3jYjVM4TWomcNR:eHKq6bzioh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647852234, "uuid": "313c3db3-3c52-4a68-9402-c5ca77b9c38e", "value": 2695168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647852234, "uuid": "86138323-8c47-42fc-a9e4-92bb9739759f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852234, "uuid": "7b9caf79-ebef-466e-b627-ca4cf09350b9", "value": "test.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf853179-a942-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1647886468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886468, "uuid": "de3b5395-28b5-4085-9b92-2869f20deb93", "comment": "Malware payload (RaccoonStealer)", "value": "550b160ed1b6ce417fc44b7b46e4266e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886468, "uuid": "80f34d7f-5369-4b58-a4e1-526f901402dc", "comment": "Malware payload (RaccoonStealer)", "value": "939600490aa1dfd1d8365faf074495bc017e4e018dea2950a56b462bb491d713", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886468, "uuid": "91023779-246c-4613-be55-64943367187e", "comment": "Malware payload (RaccoonStealer)", "value": "537d2454dc16774320431d8e29feec8fba8f6783", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886468, "uuid": "42eca7ef-efe2-46fa-9aba-fcaf4637e731", "comment": "Malware payload (RaccoonStealer)", "value": "f887eecaff2e19bc23f4fe3068e5de91a11f30d883bdde2c8a1e6e55d893e24998afa1cc01f3c15b861cda107066f849", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886468, "uuid": "6aaf8b3c-186d-4dfe-832d-6a8164a400c7", "value": "T1AFB5E001EBD67837E5BA273695F587803D32F81479EAC21B2D70E82E7CB16909DB1316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886468, "uuid": "62deb344-0708-4cbf-b1e1-0f0f874737a6", "value": "135ef29841e512c3103f400d08e4a85f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886468, "uuid": "58b0fbaf-e797-4ffc-a676-413ac3359ca8", "value": "49152:UytGBCR7ZZISZ6WKcj5/DsiynFKzIPXvgzwEKXq:UBB2ZHjKcVKnFK03gzrsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647886468, "uuid": "3e5d066c-c772-4807-9b74-7efd45a02d4f", "value": 2319808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647886468, "uuid": "24ba9649-b96a-4cd5-b733-05c5fbf3eee9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886468, "uuid": "530712ae-7301-4248-9a4d-bcbae664cec2", "value": "SecuriteInfo.com.Trojan.GenericKD.38997813.20236.16210", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7acf56dc-a8fe-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647857147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857147, "uuid": "823035be-7f56-4aa9-970a-5206cecce36c", "comment": "Malware payload (SnakeKeylogger)", "value": "71eb6402bf826cbe79b7c6fddcc15f8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857147, "uuid": "5ec6806c-592f-46ad-92fd-6f973cef1744", "comment": "Malware payload (SnakeKeylogger)", "value": "94f4cbb72ea96fb77ced484d9edf9ebf600a5d6b074c75b28e48b8a418ce8266", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857147, "uuid": "bf038b54-2c37-43e5-b12b-dba81465a37e", "comment": "Malware payload (SnakeKeylogger)", "value": "06477a1dfb9ec524772fff7f0cbe64604301f86e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857147, "uuid": "276c0416-fd2d-4499-bac9-cc2495a263e2", "comment": "Malware payload (SnakeKeylogger)", "value": "a9b5f2cdf6b86dff9acee245269cae5774178dbcb715b433a2bca1d689599c8d0742eeadad438fcb01750e315668d93e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857147, "uuid": "fa3f38a8-3a57-41e6-8b64-3777700e9e96", "value": "T1BF6533E5DB624837CCC9BF32176823099F7609E19F2B59370A9B12D01B5AF976588333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857147, "uuid": "8cb0e84b-4448-46ef-b60a-663c9c6e84a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857147, "uuid": "c2698abf-ff85-4610-bd67-da83fcd201ac", "value": "24576:AYbiooD7a43XRnrBPeRkHskU/4FD+q8oIZdmS9qN4C:TwSKtGRkMl4YoIn364C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647857147, "uuid": "195753ac-a81e-43eb-b44c-429024822b78", "value": 1532928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647857147, "uuid": "bd27ce79-b30c-4531-acd1-a0f38b64ec3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857147, "uuid": "a5c892a2-18d9-4e9b-a6c4-82b0c0682a55", "value": "71eb6402bf826cbe79b7c6fddcc15f8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2662eed8-a930-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647878480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878480, "uuid": "7015a323-e75b-4b9f-b6a0-5dfcb5f2f4e3", "comment": "Malware payload", "value": "a1df7d20f24936b484e4c96dac052443", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878480, "uuid": "e275536a-7995-4289-9c33-11c2e1225e05", "comment": "Malware payload", "value": "94f50d46f72e533ffceb464f2824ef1e0bb2b6638de918ced25123e741339e40", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878480, "uuid": "209f8e7f-98c0-4b9d-a313-b968e4841ea1", "comment": "Malware payload", "value": "a0f417cf00c4cbf166e2df3df101c4b5a7d51815", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878480, "uuid": "b749ad95-97b8-4b46-acf7-6648ace5eb54", "comment": "Malware payload", "value": "2ea6c7f8de0dc34eb13615232d9030da6da8d6c51fdf1e53795ae228e81ae623ffd33f6a86f9935663831249f2f96325", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878480, "uuid": "57ed1bf1-a409-445b-9137-06d5db8bf882", "value": "T11B21E1152EE86629D1B3CF7E149F63029B38B957AE02CF3E407402151895911F87DD3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878480, "uuid": "97ed6a3b-cc64-4dad-99e3-14ec4cddc4e6", "value": "24:8tZv6CYvd58A4cP3KIU3+/Yyvm8WKIuyvm8WKI6+Hp4pkCabVIZMzm:8tV3ePrPK7HyIKxyIKdKp4pkCaJme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647878480, "uuid": "f5c994ec-8aab-4e0c-a9a6-1005337cd71b", "value": 1179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647878480, "uuid": "6dbb0936-f977-44a5-9912-516d19dcd1c2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878480, "uuid": "17d754a8-bf89-44b4-980c-9d8d46b8ef88", "value": "Image-93463-FR.jpg.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89812c95-a8e3-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647845575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845575, "uuid": "fefc2fe6-c5fe-42b3-962a-5783d9038038", "comment": "Malware payload (AgentTesla)", "value": "40281e17c6943974b7bb8ee10bca08b4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845575, "uuid": "42ef347c-9194-465d-85f8-5c05a22e63cc", "comment": "Malware payload (AgentTesla)", "value": "952d4a4cbc26e5bd273b5564b4620c57b7db4d8d7747e57d904dfb11271cda6f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845575, "uuid": "876b7ee9-6652-446c-adeb-a18904b0599a", "comment": "Malware payload (AgentTesla)", "value": "2b590d2715f242dc13f89b51324ebac5d36f1509", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845575, "uuid": "09456615-cce3-4c40-bc65-447747a7a44f", "comment": "Malware payload (AgentTesla)", "value": "ae1c9cc81d098d2f9e4b2ebd2d56aaf95fb7bb31437f50a64858bf13233cb90b73fdff1cf66f96fd66c59d12d9917b12", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845575, "uuid": "637f1edd-16f1-46c8-a244-5efdfab9eca4", "value": "T19635239D63780372D9AC5672F02AEB1003BA142F5716D31D64C5669B836B30ACA93DFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845575, "uuid": "b299a1f6-8b98-4f56-a6d2-9a000275e606", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845575, "uuid": "90429229-f04a-4d62-9491-0c7b4efe8585", "value": "24576:+rpl9NdDvDb1rLSTimbNDw0ZgJH6YGB2L4kh0:+rFNdRamm1ZgJuB20k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647845575, "uuid": "699ede5a-5bd2-4e15-b1da-de14dd7a653c", "value": 1077248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647845575, "uuid": "6625d3fb-371f-45be-a449-7c00b57a9636", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845575, "uuid": "7b51281d-af51-4508-9008-c5ce801b8762", "value": "REQuote_45893216_33661100.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5dbc1b9-a8f4-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647853059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647853059, "uuid": "59f0b5c4-6705-4a90-a18b-35c0a6989660", "comment": "Malware payload (AgentTesla)", "value": "aecd7ebada8acf1f9bf7d0ec34d275ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647853059, "uuid": "546fea7b-833f-4421-9604-a1b2564abac2", "comment": "Malware payload (AgentTesla)", "value": "95590a08cdd484993f89508e263542bef911267e95d4b1c70dd310effb64eb8e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647853059, "uuid": "a23b9e07-1523-4adc-8bd9-69ce8af1b534", "comment": "Malware payload (AgentTesla)", "value": "7298fc6b5f50c53d4561a52cd0ed27f1a5638bad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647853059, "uuid": "ce19d083-6e32-4479-92fb-041d15fde112", "comment": "Malware payload (AgentTesla)", "value": "be0a7d1dfc0aef11347dad944b29ec8ca0fd4ec1a96c18f82fc8edbb957651602a62354a0d173f62c6081ebeee413173", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647853059, "uuid": "2c8929f2-33b4-4710-8e72-9c99b4d89246", "value": "T1AD13E61A7C929619C5D47BF869F1A19766367CE10124C18FECF9BF29A933223CCC126D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647853059, "uuid": "08ddaf9f-5892-4563-857a-9b5bf760758b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647853059, "uuid": "1acd518d-4b5e-4770-bc09-31b412b4fd26", "value": "384:SMvBGyNvXkQ6ulaiJMwCKTH2S3dd0hUADkam/8:SoUml7MwCKt3deVD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647853059, "uuid": "f5dac702-f066-4b83-a4ea-7cc2fcc9c29b", "value": 41472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647853059, "uuid": "1dca2ccf-70b8-4d92-94cc-9932a5b1d4a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647853059, "uuid": "ffef0048-a84e-42b5-86c0-a2d5cb3ccd53", "value": "2095431.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "906cd75b-a8e1-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1647844728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844728, "uuid": "f5dbe3ab-eb73-409e-b2af-26e327fb7228", "comment": "Malware payload (CoinMiner)", "value": "94fb0756f34225fd40d3706cc3d6e282", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844728, "uuid": "db214653-8990-4d64-a439-f2f860e215b8", "comment": "Malware payload (CoinMiner)", "value": "955bce112c0abfd0b1c695f51f3300bc2ff9cfc85bcae914abd435d564432c86", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844728, "uuid": "8b01e460-294e-4b25-8c5b-724968039625", "comment": "Malware payload (CoinMiner)", "value": "5b6738fe0d5ffb3a3b1127903f66a1c1ccdc54e3", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844728, "uuid": "b06b5bbd-8ac5-441f-9c38-0e5b508de4c2", "comment": "Malware payload (CoinMiner)", "value": "1ed8cb19328c5d8a558040a215d6bd899f215dd66a1d5f779a4799aad1234ab904ab4f7888e91ab6d28df05e356defb6", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844728, "uuid": "544cfc53-0074-4947-80e9-9e62c10af416", "value": "T19136330B42421CF9DBCF26BFC9BFB859C854AE68F8835159B135782933395071A643FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844728, "uuid": "05860784-1f17-4795-ba78-92d1cc58d1f7", "value": "02549ff92b49cce693542fc9afb10102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844728, "uuid": "58f9e36a-2f94-4140-9cde-384572028343", "value": "98304:Lk56+981Kmmytsr1R+PP0uA3OnE4ev9C+zkoCaOs9/Qg6eEyhgJhi:Ag+98/mqsrL+PP0uQOnE4qw+7CRCIg68", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647844728, "uuid": "bfe244c0-2d90-4ca8-b634-eb7ed1523a53", "value": 4921856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647844728, "uuid": "36f58e51-3e81-4f16-acd6-a489d3a6ec03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844728, "uuid": "960e8e47-6a57-4dd0-80f2-852848653b84", "value": "88513662.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c76c96-a8fe-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647857238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857238, "uuid": "57b31817-6bc7-47a4-8dc0-89eedd0c7c9d", "comment": "Malware payload (Formbook)", "value": "14ba954e55194b6aeaad53ed548500f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857238, "uuid": "38c4adb2-01f4-4604-ac45-ace231ff4047", "comment": "Malware payload (Formbook)", "value": "9621e6459dc138fb11bc279b6583fc68eed0db7b284e198c74dda8385db8ce0d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857238, "uuid": "944e2f1b-8855-4e4d-bdcd-2589834f45d2", "comment": "Malware payload (Formbook)", "value": "778103f9eb636db078a54ba97b82d04bdcaa2856", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857238, "uuid": "1a13e7b8-571f-4235-8f49-7a372bc46381", "comment": "Malware payload (Formbook)", "value": "a7008161346e439929273df9171730360160f2245cc1d408c48585f79186f1116f66b89191a49e02000749acc9f301cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857238, "uuid": "06ea97f8-57e4-454b-9868-529b9bf83956", "value": "T14B2533A833B42534CA9D2F35E4EEDE6603B3589E7A02E640F94495414A17B07A3B773F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857238, "uuid": "046ee658-1706-4d29-8269-af79f2d7bd3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857238, "uuid": "7eac3fd7-baf6-4655-9ad9-4dcfaa7bdcf0", "value": "24576:u4fl9MAcybvHadUhmrdYm3LwFUOxrzFluuOhNYQ/UFs0:u4f+dgmrdt3p2rJl3OhNYQ90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647857238, "uuid": "32852c2a-1d12-40f8-8a8c-ed6311645891", "value": 1024512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647857238, "uuid": "d1d3729a-0296-4a07-a1dd-23e39a08ca51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857238, "uuid": "60484476-d5d3-4ff2-a1c6-1cd5d6356686", "value": "14ba954e55194b6aeaad53ed548500f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7e168da-a919-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647868873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647868873, "uuid": "13606d86-f837-4333-86e8-ec05ee9514e2", "comment": "Malware payload (RedLineStealer)", "value": "b36b848e61744e9d63ef3d1e7a2266a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647868873, "uuid": "580acafe-8dea-465d-b9fb-c5d94a0483e9", "comment": "Malware payload (RedLineStealer)", "value": "9628c80e4407f6bf7eca3f6400d1fa0316248cdafbc78e6dba4ea65a87f27829", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647868873, "uuid": "2dba4afd-a045-44f4-b3c6-5180fdee2e33", "comment": "Malware payload (RedLineStealer)", "value": "3f782e2d8954659efa0cc86f009a1451de97c737", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647868873, "uuid": "02a51899-68d6-4233-8f98-0640b79b478b", "comment": "Malware payload (RedLineStealer)", "value": "9a1649f13ecb300f66cdca3f886d2d57b75279bc023523d0429f8fdc303a60decb708c2f3a0a122e722b15ec101a5306", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647868873, "uuid": "781e1c77-7a31-41d0-8df8-7a82ac4c88cc", "value": "T12D94CF40B3A0D03DE07711F87979D368A52E7EA15B2065CF62D62AEF16346E0ECB531B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647868873, "uuid": "0dfc0464-ad17-4d56-b4aa-dcfb7cfc21f4", "value": "5761b9d43ffb6d646c886cb4b6f3b2d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647868873, "uuid": "afa0f969-c74c-43eb-9073-bfe9c160d565", "value": "6144:JTeCwT7y5ZB21eYqqYOFwJDwVtHVpfJdB8t/p5DOQKZcoHuKEke+rWo:1+T7y5Zg1tq2a1Mh9DYXOQKq0uKEp+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647868873, "uuid": "9271fcff-041d-4d11-9041-92b4a71a457e", "value": 417280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647868873, "uuid": "0164f0a0-e4ab-4d4c-85db-509b49999ce4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647868873, "uuid": "27aa2152-0cff-473e-bb3e-fb3d151d7353", "value": "b36b848e61744e9d63ef3d1e7a2266a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c40182f-a904-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647859592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647859592, "uuid": "24008f4a-b12f-4ec2-b0a8-dd973fdd8a68", "comment": "Malware payload", "value": "7cbc8bbc7f2f5c6546addfc293131d1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647859592, "uuid": "2f2e780c-4083-4e6b-8c94-958ec514fca1", "comment": "Malware payload", "value": "966e87812db1389863a7422cca0e4ec568e6a6f39800f3b25258344ea6b96b18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647859592, "uuid": "a65fb184-a53c-4c93-b5e3-4292c821513f", "comment": "Malware payload", "value": "ff1ed0183bcfce44fd358a0d2090f5ff6bf6f452", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647859592, "uuid": "db7c7daf-0a1d-4b0b-abf9-40404eba7721", "comment": "Malware payload", "value": "384a1565a4b140273250f1208f26a2803897acfee60016751846e6f08f753ce4350fecb8844e7943baecbf05a1f01d70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647859592, "uuid": "28f680c6-69b7-44f2-98be-a626a3c6a23c", "value": "T1E804BA74A1F26AC9F896CEB29E61E609FFE70C819941821FD17439F61233B84C6451FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647859592, "uuid": "b7cfe633-6e3d-446a-a1a3-1dfb1dbb3d92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647859592, "uuid": "edc59c4b-5978-494f-a1c5-8dd4cb973812", "value": "768:/kC+uZj3ViIisL735bQzQ95sWIIIIIIIIIZnIII2nIIIZnIIINsHIIILHIIIwHIe:/d1ZjhDIBPrEaO+dSkEiRNR5t3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647859592, "uuid": "cbd67a00-410b-461d-8d14-116aa10cb878", "value": 180224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647859592, "uuid": "b1bb5e36-8956-4904-9a7b-e4c099bf620e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647859592, "uuid": "bde3c08e-50a8-4dcf-a64a-85e9796fa1a7", "value": "Marketer Global Harvest.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee96f950-a92e-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647877957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877957, "uuid": "c69f9118-410b-43e4-bc0c-12cf68bd5906", "comment": "Malware payload (RedLineStealer)", "value": "e80b22f3cb981bf595b87a786c771648", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877957, "uuid": "aa3b0925-b466-4c60-a5ac-ec3adc673cb9", "comment": "Malware payload (RedLineStealer)", "value": "96eee991b032a550d1ebcb2dd34c35465d9ef94fdbc4194cdab909869195d208", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877957, "uuid": "6059053a-9fcd-4b40-88ef-f4f9321598f8", "comment": "Malware payload (RedLineStealer)", "value": "60ea3913691826a049a35d398a23c96bb20f9867", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647877957, "uuid": "0b770e21-7d3d-4aaa-9924-2d5b52b1f256", "comment": "Malware payload (RedLineStealer)", "value": "251129cf534d0ae9ffbaa49aa97aa8ce5a67e5511303737d5585c91673edb6a3cf66ba7ffef2d0b58d8d268204d0ebec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877957, "uuid": "bb910a6c-6d55-4d8e-94d7-43bb358b468a", "value": "T12574E0223B93D472C59315707965DBB05EBFB032167589073BA8177E4E303C2AABA35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877957, "uuid": "317adb95-664b-45dc-87e4-14e7a366617c", "value": "fe3b174fa1083151aea39118cb091acc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877957, "uuid": "54e0bcce-e08f-465a-a230-cd0dec3b8da1", "value": "3072:cXg3iWneqURqbDMZgU0C2C/MTSmIkWzu2nNP8nIlWSInwF846Bo5VqcHKN2B:Y0iIeqURqbDa0C2f+kB2nN/Inw7q6K0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647877957, "uuid": "a573e2f0-0807-4e86-9db8-9ffc862c2795", "value": 353280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647877957, "uuid": "090ac34f-a41c-4236-896d-474ef99ff95d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647877957, "uuid": "d6532ac1-5bc5-4a21-9931-5ca24bce1ca0", "value": "e80b22f3cb981bf595b87a786c771648.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3bd09ef-a8f0-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647851257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851257, "uuid": "6825a9ce-cd0f-4446-9a4a-7c50dfb3755a", "comment": "Malware payload (Loki)", "value": "50151f0e449bcbb35adc4731682763d9", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851257, "uuid": "ff2bdbef-b8db-47a4-936e-ff2e4dc94465", "comment": "Malware payload (Loki)", "value": "9714fdddd6ed4496ae34a8e63b0abf7b1edfc449914ebd30b6698873e498a65d", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851257, "uuid": "b0dc9faa-4098-40d3-b148-74b433bea2fb", "comment": "Malware payload (Loki)", "value": "ad20563b8a3b659c8ea468d4f65bb74d12edbce0", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851257, "uuid": "cc8cb75c-4d0f-451c-85fb-0a11843bfef6", "comment": "Malware payload (Loki)", "value": "fb439ef94ec98b28a64e1c1c10305149292ec631f8fdc00a9088f89db4e72e7e6e87fb3d539ac83b3e2975b2d5631425", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851257, "uuid": "6bab09da-a146-4502-865e-3fdd072165df", "value": "T13F0402113ACD8469CA67FCB3C72A67A20A56BEF48756148A7180BD8CD53DACD3D17833", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851257, "uuid": "c8b81fbf-b566-4c89-9c71-673ca937a947", "value": "3072:+zNFrdH9qn4OmrmUX8I+Jyutq0QAt1of7VROQi7bbL8JufXZD1g+zzEt4enCP:kFrdH903JRVUROQi7OuBzzEt47P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851257, "uuid": "a8ecfeea-52d4-45ce-98c3-8bfd1f5d4243", "value": 190264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851257, "uuid": "ce73b269-3589-47ad-9716-530234d09925", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851257, "uuid": "447a17fa-068f-4900-a5d1-6ce2e5d68068", "value": "Swift 3-18-2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "264aff51-a8f4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647852710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852710, "uuid": "2d4b2760-440f-4376-a670-cb378e6b8367", "comment": "Malware payload", "value": "cb0ab441fbd2b235296ad910c9492cc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852710, "uuid": "d44d1db9-bcf5-4b54-86b9-c66c7b410e59", "comment": "Malware payload", "value": "97cc51baae950c680b213219d19cd6425446d2be6a595a878dfcdb321fdc4102", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852710, "uuid": "894200b5-f600-4132-a674-50b4f84e49a2", "comment": "Malware payload", "value": "5a4e725fd1d617cc05b7868b3cd658a83a540eb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852710, "uuid": "8412b443-7102-4e71-b778-d84809e9f12b", "comment": "Malware payload", "value": "efbecbdc0af9e18ef3905b7ea6d4b869ec3fc7bc230318335caa48f91f99fb5cf96d71bc747b0527eba5ba80973b2f26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852710, "uuid": "88db59e8-0724-4392-819e-6a5601a7a45a", "value": "T14C549E40B7A0D03DE0B711F8797A93AC692E79A15B3550CF62D52AEF66346D0ECB130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852710, "uuid": "1b7a6fb2-02db-4042-bcb1-c8c46c4e88ba", "value": "cbe2a3d9f5bb4fa7c1fbeb2b00df447c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852710, "uuid": "e8d31276-1c1a-472e-ad3a-3e19826dd40b", "value": "6144:Mvmwhmw5e1nG0D1fSUsO/FCCsmC29hJpWs3Vq1EOuoK:Mefw5e1FDNz/oC0UhVq1hM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647852710, "uuid": "80b19d2d-ee7d-49bb-b4e4-2978ae56cf24", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647852710, "uuid": "d6a17890-8b82-4e56-a0d5-57ff2bfac47d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852710, "uuid": "2f13ca42-0d7e-4fbb-bbcc-070c873ed65f", "value": "cb0ab441fbd2b235296ad910c9492cc4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd6ccfb9-a914-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647866708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866708, "uuid": "344fde1a-23bb-42fb-a0b7-402269cd4664", "comment": "Malware payload (AgentTesla)", "value": "a2be34753babc78e021f02f716d62e10", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866708, "uuid": "7a2fb4a7-48e8-4549-8763-87f0cd20f611", "comment": "Malware payload (AgentTesla)", "value": "9859ca7e872ce67ff2eeeff00e38beed07aa64e94e8799bda3fdea8f35e7723b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866708, "uuid": "8b2d58a2-f027-4c6b-82e6-a57d25ed8b29", "comment": "Malware payload (AgentTesla)", "value": "1c9c472d3da279c3c626c25148f27dda72f3c445", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866708, "uuid": "4240f3df-c629-4a35-851b-52309ee1c30b", "comment": "Malware payload (AgentTesla)", "value": "13d69dd42a45155923e35bd7c9082c484661da6a8bee5e22f2fa76095d2c9682139a78ee5bc8bffa733678b7457f494c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866708, "uuid": "769c1f48-3d82-431a-8698-9ae67265bbaa", "value": "T19DF419BD715472FFC877C1328A945C24F650A8EB630B5913E4971B9A9D0F887EF840BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866708, "uuid": "10953f39-431a-476e-8591-4064e487b2ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866708, "uuid": "5b9873a2-f91d-40a2-bdd9-4c157c47e3b6", "value": "12288:wPuGMf2rTRXugS2UjtlKF+xn/Hspk9yqXE6vrT1AyvQPDyhCVG/Itjpnvllx+g2o:CZ6Zv1tQb4CV/1v9wcN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647866708, "uuid": "62e2b102-cb3d-4c36-b7c6-9755e2457f0a", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647866708, "uuid": "b8cdbe8b-6ff5-4f83-a35e-91f33001bf3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866708, "uuid": "ec2d794c-241d-44c0-a12c-8a5e2e62acf8", "value": "SWIFT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "055bcfdb-a8dd-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647842777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647842777, "uuid": "907b69be-d102-4108-a60e-3cbda0e13e1a", "comment": "Malware payload (Loki)", "value": "634d5a826172f63f8911d769a91fa13f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647842777, "uuid": "5daca639-419a-4968-8845-8fd3a66678c4", "comment": "Malware payload (Loki)", "value": "9894223dde15736ccaddc4899a4e7a3ee831d2f14a83a2e6ae075785bb131027", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647842777, "uuid": "b9c6a531-c1ed-48ff-9986-f2998ef2a584", "comment": "Malware payload (Loki)", "value": "2a5cecf35cd3058246888c4fa64acf3e8ece9992", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647842777, "uuid": "c84b94a4-1522-422a-a6a0-348415529a92", "comment": "Malware payload (Loki)", "value": "0a38495365f6fb4d08a60e774e7c6ba2adfaa68410cae92fa7fe219d18f6a70393dd10dea28ddf26d1cb8d5a68f89777", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647842777, "uuid": "909af899-cff1-497a-b0e4-bd8df4dd7656", "value": "T1F034121392C11EBAE7B715740AB3B0AADB75C2E962A7454B37581FB31420F46D81BEC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647842777, "uuid": "7c632429-670a-496d-b4c2-ab6a6d5ce923", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647842777, "uuid": "6bd2688e-d962-40a8-860b-95b2538d99e9", "value": "6144:rGi+gLdKkvuEZibxlc+Go79hoTL1O4K8zWYMT75n1KOUd605:aCI+u5Go7TgL168oX9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647842777, "uuid": "cc757667-b69e-4048-ba33-aee4539cc5e4", "value": 244705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647842777, "uuid": "efb0dc8e-dcbb-4155-9b1d-826f71ce7318", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647842777, "uuid": "8a2c0d61-f143-49ab-bd12-545ab0d9fb9b", "value": "KARASEA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cb8cc68-a8f0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647851084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851084, "uuid": "0089c385-975b-43fc-8294-7a12c3e78e7c", "comment": "Malware payload (Heodo)", "value": "88532419c6d70a5a8c78b9759bcb12a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851084, "uuid": "a3376a62-8af2-492d-8d02-606ab7d41d7b", "comment": "Malware payload (Heodo)", "value": "98fedeea3007a075bb54d12f1c7bd6df60c68f52605b6674533bc089c21b4a89", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851084, "uuid": "8eab069f-70f7-439f-94fa-08574f64e69f", "comment": "Malware payload (Heodo)", "value": "adf68b8ce24856889d41b97c51838e4e8f6d1419", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851084, "uuid": "111c70e8-20f4-484f-87fd-c092981f92c2", "comment": "Malware payload (Heodo)", "value": "cc43f6ff362a4e1afb9974b765580cc1fea69b7e4bf520d417ada865904c788f154193f05dc621fcf6082d1045b14312", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851084, "uuid": "c36b1298-1770-4407-be32-36e11189ee39", "value": "T185056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851084, "uuid": "8f89e5e8-c241-4757-87af-3a25db007835", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851084, "uuid": "4c8ce98f-3428-4bc5-8068-c7bba790d6da", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rh5CGNHrH2tZ+d+:gMV/rh5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851084, "uuid": "6fcdbb59-ddc9-480f-8768-8f50929b0a48", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851084, "uuid": "d9ca1f0d-56d6-4f24-84a9-54b8524313e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851084, "uuid": "3d07200b-6986-4927-9b8a-c34c45aebaff", "value": "88532419c6d70a5a8c78b9759bcb12a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f78f276-a8fa-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647855357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647855357, "uuid": "5c2659c8-f70e-4b81-aa6b-01e1f590d851", "comment": "Malware payload (Heodo)", "value": "6b4b6782dee0eba8a47661a48bc4e193", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647855357, "uuid": "1021beec-e6c7-45bf-aefc-004604f6a077", "comment": "Malware payload (Heodo)", "value": "991f7ad9c45a60bc8c1eae61a9ba1fef07fedfa8bd66303292c27bff97ad63be", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647855357, "uuid": "d3f9c667-b536-42a4-89a9-ef3d3a653db4", "comment": "Malware payload (Heodo)", "value": "b09d0b1f6ced2dfd8875f2c7f0fc386f73cf8afc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647855357, "uuid": "85653408-4d63-4175-a725-a648fb4f87e8", "comment": "Malware payload (Heodo)", "value": "886ad65168f19f136b6725e3533316d7dd1c90eeef3a0cbdf83e2488c254911a0e4da301a34feca4c104f928b406433c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647855357, "uuid": "aea0efd1-5fb8-47a9-9276-13dcb8255b18", "value": "T1C9F2A031F2E29B59E477583C478CCAF8D77DDA2246067E2C308A13BC5F123566A4E24D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647855357, "uuid": "15519161-2d4b-4d44-b607-7ef48351fd36", "value": "768:whtqi5eiNlAjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooood7O:whtqigGUOZZ1ZYpoQ/pMA8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647855357, "uuid": "ebfa081c-831c-4ea0-8cbc-a649ae5eef84", "value": 36475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647855357, "uuid": "471bf2b0-84a7-4ae7-ba96-d8952055217e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647855357, "uuid": "5e699aa7-0de9-4768-93b4-20ad13e590f0", "value": "SCAN 21032022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c3988d-a92b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647876678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876678, "uuid": "52b1616e-50c4-4f68-baa9-f8bbc3572da4", "comment": "Malware payload (Heodo)", "value": "fb181a4fbe014a7d76fd104f898fd8de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876678, "uuid": "04282727-d90e-48d9-af42-f5f3bbbccb33", "comment": "Malware payload (Heodo)", "value": "992cf5ac021e92a23872c712c88f81a89cb5faf3acd6368c854ac43b910ce7b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876678, "uuid": "42c13202-7ce6-4fed-a840-17603c02856f", "comment": "Malware payload (Heodo)", "value": "bab8edf93aac85c758a33de771531f6553569397", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876678, "uuid": "876ee86d-a941-4db3-a4e6-efa8d82ed2c0", "comment": "Malware payload (Heodo)", "value": "cee64c6e8a2899190553f441648ac5b0eca5dc789efbdc349bd41bf041dd3f2216e6f7a7f8e359ec8e130576805488e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876678, "uuid": "bcab0718-644f-43ae-b5e1-574ce2b7c8c3", "value": "T1EF056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876678, "uuid": "61c83eef-8912-42c4-a7d8-9337e878e543", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876678, "uuid": "a03e2fe9-ea8a-4206-ab46-42177f6bbe04", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rT5CGNHrH2tZ+d+:gMV/rT5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647876678, "uuid": "8a1f9a08-2568-4fee-a5cb-e127b0c96b34", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647876678, "uuid": "7840f232-85a0-4bca-84eb-8f460ae2afbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876678, "uuid": "89b443c8-b454-44be-8db4-08c344f0cfa6", "value": "fb181a4fbe014a7d76fd104f898fd8de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24720aac-a92b-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647876330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876330, "uuid": "a53f57eb-f639-456a-a99e-b47bdd1155b1", "comment": "Malware payload (AgentTesla)", "value": "c3c521f00e5513df674794024b6361b8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876330, "uuid": "703c4496-91db-4285-b552-4486efedebe3", "comment": "Malware payload (AgentTesla)", "value": "99571855867582ab9eaeba0d84481a6a22ce779870e2fb7c54d2d8b50d024df2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876330, "uuid": "6757b590-603a-4c21-b030-2fe6a9d79c9d", "comment": "Malware payload (AgentTesla)", "value": "f1c3987ea3ab290497b3100414d475d4a4250431", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876330, "uuid": "7e1fb68e-4710-4593-9b8c-00e4c5eb7749", "comment": "Malware payload (AgentTesla)", "value": "256acf5e35286181cb88fcb02a656d62d1b9ed59ce9c335711182f81867abb632a391546f0d08f59033e801d92fe3593", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876330, "uuid": "2fc06a5c-0773-49ec-90b5-361b0e12fea7", "value": "T15AD48C7A155C9233D97BD2318620101AF7A1E0EB7912ED1DBED31B850D136C67FCAA2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876330, "uuid": "c6f7dc63-83d7-4986-85b5-00d589500017", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876330, "uuid": "14bd6b50-97de-47a0-ad36-6ce3a17eef0d", "value": "12288:Qh6JwEwLJkCEamhbFce7xlUIbJ+aBhtb:Q0JwfLeC/mhZcclUIlhBhF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647876330, "uuid": "813dc143-e567-4017-8f6f-a8905c1ad098", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647876330, "uuid": "f43a22dc-ea65-48e0-8469-df63ceafb61e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876330, "uuid": "1188de8b-d528-4aba-921e-436c826f8ee7", "value": "PARKING LIST, BL AND TELEX.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "119bd9b6-a8ba-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647827765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647827765, "uuid": "2c68f844-a36f-4ed7-965d-c125e4665224", "comment": "Malware payload (RedLineStealer)", "value": "46ba58a31571270b72af74c36b048414", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647827765, "uuid": "d4151b0f-63f0-4890-89f5-c42338fe7945", "comment": "Malware payload (RedLineStealer)", "value": "9989eb35d1fd25b884bd2994f7abd5c855c97b80a1a22b9dfca837f9db278e50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647827765, "uuid": "30295926-63af-4254-b93c-6c5133a474ac", "comment": "Malware payload (RedLineStealer)", "value": "6a7754eb273370194fbc0576264390b7f37c7cdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647827765, "uuid": "5ca3c5b1-dfa7-441c-8d07-3f41a160ab74", "comment": "Malware payload (RedLineStealer)", "value": "63c3feb227ada379ebda3442271b3b0a2395187b0f2d6c0b9fa14eb18e70018b302b9cc8da81f3af87b1454a274e3112", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647827765, "uuid": "80942eef-03bf-4f64-8d77-3ebbd0764ac6", "value": "T1EF94F132B943CC72C09715706565C7B05ABFA43226B489477BA81B7E4F703D1A6FA32B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647827765, "uuid": "8e4a7b94-a9cf-42be-a8d6-057dc570e3f5", "value": "96d1326af78fa7583bdf297d06673dc4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647827765, "uuid": "d9dfbb25-a1dc-47c1-8d56-05162268f0b5", "value": "6144:qcUrzGigkhgHBGLwopaOtwIyyn7Eaj+USeZiLdDV7:qcUraigkhgh8pNt3yy7ljdA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647827765, "uuid": "2f15481f-63ef-4088-9045-3b67c3180b0a", "value": 413696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647827765, "uuid": "28703a63-24f3-4989-ab83-e9539b68869f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647827765, "uuid": "c0f157d8-0905-4d98-b870-42e7bbe6a5ab", "value": "46ba58a31571270b72af74c36b048414.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45e72a68-a90f-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647864360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864360, "uuid": "db933f33-cbe1-4440-a5bc-ff4a214077e8", "comment": "Malware payload (Formbook)", "value": "7700a0d1b07e63f054a730fbf9156ef0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864360, "uuid": "5a7d5abf-db0a-4532-8f4e-5ad32e11357c", "comment": "Malware payload (Formbook)", "value": "99b4df04fc5236a12bcf96a4c6ec797b2555189915050d7a0a1704f4f69ab770", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864360, "uuid": "85259077-47de-479d-a517-50fb26e00472", "comment": "Malware payload (Formbook)", "value": "6995f2e5f4544b3e99489364bccc56084198c61d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864360, "uuid": "e8656e44-43fa-44a9-9774-0570d35165ae", "comment": "Malware payload (Formbook)", "value": "02189b68295145fb343b46966d07d33b50f96602e26e61ae7026008219b835cf1d2d387a320ce60c5faf9c6b7e26c056", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864360, "uuid": "591fe35a-3a68-4bd1-83d9-ffc8d5979563", "value": "T1B8165771D910E0B6EFF32278F4AB245C1948A43486CFB99B639D0CD54ADB2BCC91F529", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864360, "uuid": "3145fc13-a558-4eed-8805-410f63302bf0", "value": "99c2cae0b7316add27de679470515124", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864360, "uuid": "f4ac7e4b-a7b4-4dcc-a6c5-85e422e3cc30", "value": "98304:IDWrdQJJ6qOobDtlLCSvKBXRAtiX2CVQmYRx6uiNnA9gEEtwPpAK3q2M:D6KPktlvIAtSNn6gFtYrzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647864360, "uuid": "411a30c2-20af-4b39-9033-bca8fe907a85", "value": 4344320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647864360, "uuid": "46e219e2-19a4-464b-96a9-e044c60cb8b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864360, "uuid": "bebcc8da-8e48-418b-9a61-ea5131f111f2", "value": "AutoInstall.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3678058e-a8f1-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1647851449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851449, "uuid": "5fdf706e-57b7-4fbf-88ce-4bffcd8ac7d1", "comment": "Malware payload (NanoCore)", "value": "56eb8432225d40035eb895b08b6ed309", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851449, "uuid": "7439de0a-bc75-4300-9200-ba465672765c", "comment": "Malware payload (NanoCore)", "value": "9a6371d636d106c4b21df91ab7125b85499eda9b2b5f17a1766f452b14fe44a6", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851449, "uuid": "8dab1fb0-81b6-4960-a32e-020f926a6d67", "comment": "Malware payload (NanoCore)", "value": "011e37199f0d96c05b498bc9d232c658a5f240c1", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851449, "uuid": "747eba61-a9ba-49a1-afe9-0cc62c911a09", "comment": "Malware payload (NanoCore)", "value": "b06b7fced429a361a769d8be17cc0faf2ae7c4b611cacacf9b3880be5b201c34f7c3c3d601ef66478deb08eb1f341d72", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851449, "uuid": "740894b6-e848-4c9c-ba57-5077cd86c624", "value": "T1433523E5B7781232D877557208B40144077B3A9F2903FF609A09E4E58B4E3AD1B6BBF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851449, "uuid": "6ba337d7-60dd-4c15-9e6c-4499e3650f60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851449, "uuid": "3d2b098c-77f2-49ae-b9b4-fcdf9fbdea07", "value": "24576:jjwl9XLFyDVjnKCmujATFXWEZbmgi/jyzviyHZvVu:jjuXBYZLVATFXWybmgiLw5vV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851449, "uuid": "27e52fe3-ef22-4869-a08c-76e681d9e5f3", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851449, "uuid": "74341db8-d2f8-4857-bf32-478eff51971c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851449, "uuid": "1a967563-a7d5-4768-a9ac-aa8e9d5ae42a", "value": "DHL Express Delivery Information_Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8bb1eef-a947-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647888578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888578, "uuid": "e2d1c792-82a2-428b-a656-cfc1454289d3", "comment": "Malware payload (Mirai)", "value": "947555a47ac8c4015c1313e374f30510", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888578, "uuid": "6e24559d-b530-4737-83a2-674b9fbc1a0f", "comment": "Malware payload (Mirai)", "value": "9a976cee69a6a3605c3d9e160e56883897e11549a2d17dcf37f5ef58bf7d5c5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888578, "uuid": "1f10f81d-789a-4ef8-9b81-3ca8c618872b", "comment": "Malware payload (Mirai)", "value": "492ae8423e9151e21bdc11c7b0c9dfbafd085623", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888578, "uuid": "0223097a-07cf-4ee7-9480-00e27bb67996", "comment": "Malware payload (Mirai)", "value": "85db67e15c529a7156622dd59c30c1538f5759dbc6a983cad6b3ca993c6decb7eb227dd5d0f08065e09e911ff5526780", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888578, "uuid": "15ea31ca-9cf8-4f14-b595-ce909cbfb32a", "value": "T1B0E38E02374A8803FAC75AB4252E97F167BAFAD551F1F889131AC77D0631C3B444ADBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888578, "uuid": "f66e453a-d7c1-48cf-823e-79a220fa7820", "value": "3072:Hzj7Qj9ChXVaXeNTa6CAwW9ZCMUW2xQIv/D:HLQJgVKeN26CAbU/Q4/D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647888578, "uuid": "4713b874-9fca-46b5-8191-3d282dd08672", "value": 144620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647888578, "uuid": "d86f71c0-c989-4926-8afb-a57f40b362b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888578, "uuid": "e47c24be-ab8b-4cf7-81be-54804555be8e", "value": "947555a47ac8c4015c1313e374f30510", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b326930-a8f0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647851054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851054, "uuid": "f853c463-613c-44fb-a2ca-48bb58c21842", "comment": "Malware payload (Heodo)", "value": "a0da77283c8d0a9a968fdb1201a6b72d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851054, "uuid": "494c2bae-0f33-4545-bdcd-725f07d3a086", "comment": "Malware payload (Heodo)", "value": "9abe7b59847388be6bb6b044b1463cdc10ba73de50f721cfccca09b881c9592c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851054, "uuid": "3e0343c7-a5f3-45fc-9c07-b52fd90dec15", "comment": "Malware payload (Heodo)", "value": "437726701abd5dded800c667ccf80fb52699df0b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851054, "uuid": "57cd2524-b88e-4e63-ab5a-f32f7e0b420e", "comment": "Malware payload (Heodo)", "value": "c02cb663e4e3568682d0b5b974f5c627b52fd1565401c899ca4e478a08897a9677e8a581719e8161ffa176b978553df3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851054, "uuid": "3f9b7214-51c5-4ad7-8f92-36b7f5d3bd60", "value": "T1E3056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851054, "uuid": "735abf6a-8216-4971-8d7e-ef99ef086ded", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851054, "uuid": "2c39fe08-8078-472c-be0b-5fe1760beb2e", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/r+5CGNHrH2tZ+d+:gMV/r+5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851054, "uuid": "78ac855a-1793-48b9-82c7-44ee74e75e87", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851054, "uuid": "d72fd804-71a5-47d0-863a-3fe5786c7690", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851054, "uuid": "f80b8b29-9ef1-4683-a134-8d58ab5665db", "value": "a0da77283c8d0a9a968fdb1201a6b72d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf98c559-a928-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1647875328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647875328, "uuid": "79aa3ec5-9fe6-4d84-9995-57c468c08ff8", "comment": "Malware payload (AsyncRAT)", "value": "200adbf1f5262782b34bd98ad0f009a7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647875328, "uuid": "f483103c-b2ed-4782-9c07-50cca01e9517", "comment": "Malware payload (AsyncRAT)", "value": "9abeaa7c4550ac2529c0f2ff9490b71b5885f774605df156228d8fd6bbfc8aee", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647875328, "uuid": "b7f010d4-f98a-420b-b5e9-a4293e0a593b", "comment": "Malware payload (AsyncRAT)", "value": "e95387e90bd2281daef934d36ee2da6b9e95ff98", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647875328, "uuid": "87bb9625-e278-48c4-887b-7c2bc31315a1", "comment": "Malware payload (AsyncRAT)", "value": "b7712ed8677d2a50fb33cb6ad8692c207f0a9185d2de194f93d9e855bba6c7e4a3915fe9241817bbf7a17533eadc2179", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647875328, "uuid": "ccf5a656-f4e5-494d-afbc-d2df180da352", "value": "T1BF94BA2C3B551A62FD0EC9B04B6D9E04FB661F83224CAD96F7EB15CA874F0572D84CA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647875328, "uuid": "1a5ce4ca-19eb-4e08-8c0b-bd7404bf9bd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647875328, "uuid": "40ac875f-8c6c-4b1e-a0b7-c3821eb7d63e", "value": "12288:NWomZD1tsD6E8uRVED6LnMnAA6zgT3UUUUUJUUUUUUy:qMMnh6zgT3UUUUUJUUUUUUy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647875328, "uuid": "f6ab24d3-f930-42f1-a2b7-19b4284fcef0", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647875328, "uuid": "7070dcab-03f5-49dd-a33c-8f26dfabd9b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647875328, "uuid": "d3bd6e15-ec3d-43a9-9e98-d0ead715cc92", "value": "200adbf1f5262782b34bd98ad0f009a7_Slip_07.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b4a3b7-a8e9-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647848341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848341, "uuid": "3c142357-3b68-486e-9603-54ba7edcce11", "comment": "Malware payload (AgentTesla)", "value": "e740c2c1eff36ba6260451add4a3bf07", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848341, "uuid": "e93ba1b0-d27f-4790-8e6f-44fd8970f205", "comment": "Malware payload (AgentTesla)", "value": "9b98b6431bc46c8023efc3c33b96f9a534e3c00b03f7b01ef8f29086a70f9be5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848341, "uuid": "f11a9895-cc81-46ac-b440-619c31b3105c", "comment": "Malware payload (AgentTesla)", "value": "edb245c8a9dc0b657e47c03a55fa5ac0e1b008e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848341, "uuid": "fae7ecc5-4731-4999-a4e4-1529063a99a4", "comment": "Malware payload (AgentTesla)", "value": "ce36dd5dcea6d006e4bfb2b6f784b19c55dc613381e0ffd86908e0578a43789fb964eb3193bad4076e46a1f8ad47199a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647848341, "uuid": "5756bcf6-8589-4e27-893e-0540dd161ec8", "value": "T147F419BD715472BFC877C1328A945C64FA50A8EB630B4917E4931B9A9D0F4C7EF840BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647848341, "uuid": "1760f865-cd7f-45a9-b0d5-dbfaa2f7805f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647848341, "uuid": "ae57a291-500e-4df8-9cfa-4aab43f2063f", "value": "12288:EBjjmh4tQ7lEphnthMVd0MOciWEWzPJVN7pTMT1S7jhgwKhki/b6u2lqUpRruhwP:EtmhQQ3b79Mc7lg8c6Xlq7hzvVYas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647848341, "uuid": "2bf32679-7980-429c-9e8d-7ef4e6a37793", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647848341, "uuid": "ea4ff79d-ae6a-45a6-b97f-a33cd0306cdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647848341, "uuid": "c978191c-d8f8-4d44-9079-ecea9bc674ea", "value": "PO#801644.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "545b545a-a8e1-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647844627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844627, "uuid": "14dbe790-1363-4b18-ae7c-05533037a183", "comment": "Malware payload (Formbook)", "value": "d119ed414c261fad55fa88b5200d09ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844627, "uuid": "afdcea53-dd1b-4d2c-bc7d-c227906f30f0", "comment": "Malware payload (Formbook)", "value": "9c686bbba644469a2fe639de221469d4bf9eba11c65be9cd0fd246e080d5f5b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844627, "uuid": "791945b5-a334-4b15-83e0-8a80b8101418", "comment": "Malware payload (Formbook)", "value": "7d6e114e4bd119c96e348647ef8df43ceea92384", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844627, "uuid": "50ba7486-724b-429c-b56f-0cc72ccdaa7b", "comment": "Malware payload (Formbook)", "value": "4c42e94f02d5522734bd419dac1cadf6f406a6226821704dc146220f39905ce187b6396cdfafa85f7c6fc2ed35cee4ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844627, "uuid": "fb9fbbc1-51f6-4223-9ca1-334e69c74921", "value": "T1C0F419BD715472AFC837C1328AA45C64F650A8FB630B4917E5931B9A9D0F4C7EF840BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844627, "uuid": "aae229cf-1e63-47b3-89ab-b5daec751178", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844627, "uuid": "91511903-5883-4888-8c2b-f22adefd184c", "value": "12288:kcYc5u2jG6Ph++y99RiZwZ62wal8ObiA+l77tg/Ie+U8wY9CdLxO03KPXp:z359GpJ2oKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647844627, "uuid": "3d559c3b-b940-4980-ba1b-abb17115b45a", "value": 774656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647844627, "uuid": "fb242445-df13-4799-b07d-28274a3c470c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844627, "uuid": "8f984921-2619-4332-88c5-e80cb32785a2", "value": "MJ 00000178263783400.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b6c81d5-a8f0-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647851189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851189, "uuid": "a5bc133c-a165-431a-811c-bbd61f4cbdd8", "comment": "Malware payload (Loki)", "value": "dfcbba14753e0c9c895a78af0be676ad", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851189, "uuid": "d2848377-d005-441f-8fb6-00f4b896496e", "comment": "Malware payload (Loki)", "value": "9c6e1d408d9d3d70c6a3cce1eb3a98a8a80e3067d6c8a8a6d0c9fad6bb9cafd7", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851189, "uuid": "7e8b9ea0-fe4e-4510-bede-fc7d996cd476", "comment": "Malware payload (Loki)", "value": "008a2c948db1e4b571a414cebaec771c5a67ecc7", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851189, "uuid": "11792c95-0f0f-4673-8604-e655ad2d5a8c", "comment": "Malware payload (Loki)", "value": "29d3410ee3ef0ea7ac0c58a67892c4c0a7515617d9e177705fc9a082ffbeb25d982496a926ed51a71218270e08e11fae", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851189, "uuid": "659d5a96-d52a-476a-9ab5-ee2240b35ab8", "value": "T198141280EBCA490CD596C6B1057AFF7EF089BE0D5E709609EA0AFA5D1670A0504CEB7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851189, "uuid": "3f04fe14-4f3d-4134-b62b-4093b1ce376f", "value": "3072:BtB4IpBtCotqvXdNaPdHP7pWjv97r0YnLk/1pnoBmlnA6MWbyULuMlg1ZSIh1NLr:tfB48YilHPFk7r0YnLC4mW6teULBW1Z9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851189, "uuid": "158e3c03-5975-481a-980f-2ba880673a09", "value": 190680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851189, "uuid": "0b2b96d1-2d67-4662-8861-9b2ea30b7e04", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851189, "uuid": "e687dc21-d45e-44c5-a0df-010cc898a3e3", "value": "SOA TRANSMASTER.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "636d5a6e-a8ba-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647827902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647827902, "uuid": "98725150-1185-481b-8c24-358981516a26", "comment": "Malware payload (RedLineStealer)", "value": "e105a6c2be8b5520d15ec75a470bf8e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647827902, "uuid": "e4f655e5-5dac-46d7-9ca4-59ac0f2c412d", "comment": "Malware payload (RedLineStealer)", "value": "9cb30c1b919995bef4fa43fdb6b1172eba2fc096c1655f5040f7ae819bbef78b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647827902, "uuid": "e3f529f6-c891-4754-b3ab-cd6ce8bcdd28", "comment": "Malware payload (RedLineStealer)", "value": "c2e07dc85645a0148238b40fd9e0a48ae2da9d07", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647827902, "uuid": "289a6fc1-735e-4e7a-8645-26474027398e", "comment": "Malware payload (RedLineStealer)", "value": "3600311aec78837bc586db43e80114d19176eefcc5eeb9b82d261dd07c85f913f7a26ce60b1d7d6b2ea48da81e4b4520", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647827902, "uuid": "56fe0ac0-fb94-49a2-8b16-61298c4e61b2", "value": "T14284F122BAA3D072D4871631A825CB706A7774312575894B77A90B7D0F703C1ABBB39F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647827902, "uuid": "d6f12af8-4fdf-4b4f-b037-a963a034399f", "value": "dd74d0a493381cbdbb2d3a82a03effd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647827902, "uuid": "8a1637be-e3e3-494a-86f4-2f225048218b", "value": "6144:6bhMLla9vAzbNUMoD3MrIQrKz80AbYdvcYOLDO6Eg:OhMLs9vAzRj43cINAMdcYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647827902, "uuid": "c79a4fac-70ba-42c1-b172-ce3e8422856a", "value": 404480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647827902, "uuid": "93a101e0-0703-4fb2-9f5a-b7b1f75040ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647827902, "uuid": "d4c1cdac-694a-4910-b229-db8b611dfa42", "value": "e105a6c2be8b5520d15ec75a470bf8e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce8b2b4-a8e8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647847809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647847809, "uuid": "8bbce450-f86a-4e8f-9a12-c5aacbd3c106", "comment": "Malware payload (AgentTesla)", "value": "621c4ec4fe37705a2ec21e319c035d84", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647847809, "uuid": "42eeea55-5117-4ab9-82f8-6efa401be308", "comment": "Malware payload (AgentTesla)", "value": "9d7a5c688d2cd9b019edb1d23d48db97ea989ca54727e1e1ed3aee5f2ce97ce4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647847809, "uuid": "d06dba21-1358-4160-a642-450cfe474668", "comment": "Malware payload (AgentTesla)", "value": "a3fc5c7b6d1979485ea0d69cb82bbd5241720fc7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647847809, "uuid": "4ee2d358-beb7-4b3f-8aaf-1bf72eecd1bc", "comment": "Malware payload (AgentTesla)", "value": "6e7a60812bf57701ebf54bf7b8c6bc8ef5b70e174cf0b1da945c8238b45fbcb57db83edc3d9c5aaf5c994814185ee956", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647847809, "uuid": "54e28cad-8315-4e93-96c0-4d674bc35780", "value": "T189F416AA94585263CD3B97314632C835F252ADEA7831AC1C69CB3F533E772C63B8151E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647847809, "uuid": "de63e59f-b550-4bc0-8d1d-d60d30193185", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647847809, "uuid": "9b4139c2-705a-40bf-a060-93da897ebbec", "value": "12288:FkyrWtf2hHD1LTB4B7JaJjXeP7r9r/+ppppppppppppppppppppppppppppp0G:FlWtf2pX4B7ERu1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647847809, "uuid": "ca340ff9-0988-4029-8f4a-7cdf17c6798f", "value": 726528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647847809, "uuid": "69254671-61b1-4323-a24b-2dfe951dc7fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647847809, "uuid": "1215c33b-bda0-44fb-841e-d64add8782ff", "value": "PAYMENT CONFIRMATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e95d6aa5-a95c-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647897705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647897705, "uuid": "eb8cf128-eb24-4e0f-a87c-7bf958819ec8", "comment": "Malware payload (Formbook)", "value": "e4b665eeae130b33a97727459114c023", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647897705, "uuid": "ff7a7b5c-ccd9-42cd-aafe-b16b6027a39b", "comment": "Malware payload (Formbook)", "value": "9d8c0893744dce163560846851bc4dec8f03b23ff614bab31952ff5c7b623e5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647897705, "uuid": "ca06b2bb-a5d8-43bd-9918-0e162047c4cd", "comment": "Malware payload (Formbook)", "value": "a72b2b67fe8191004f025b05049015a5861b7214", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647897705, "uuid": "0dae9d30-0f75-4dc2-9812-6c0e75e1a490", "comment": "Malware payload (Formbook)", "value": "f4b0c775dda87661f69b276788432431d02568c835ff58cd1ae3d594cdb763bc78ce43e8d7383dbd65c22c698ce9ce7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647897705, "uuid": "47ad6c0d-c2b5-4eb9-84b3-c820c989c227", "value": "T1D3C47B7A15AC9233C97BC27186600016F3A1E0EB7922ED1DBED71B950D136C67FCA62D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647897705, "uuid": "a6e948c3-dbcb-4518-a75e-bc0021170495", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647897705, "uuid": "fc7893a4-33dc-47e9-aa6d-97f26de49018", "value": "12288:I21JwEKn2bAj9iQEElCm9Dc4sAJyCoELAR:IqJwB2gZEZGch4oELAR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647897705, "uuid": "470ea6d9-98b6-43a0-9f2d-db03b6b91197", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647897705, "uuid": "6ef0c902-4eac-44be-a332-8af2f4795768", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647897705, "uuid": "cf95fc75-4ffb-441f-967c-7c860df4c8cd", "value": "QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f0e04c4-a8e5-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647846417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846417, "uuid": "f7281996-bee3-4678-a326-0686fbddc37a", "comment": "Malware payload (Loki)", "value": "f08837df2d5b410cfb7a96c107fa8f36", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846417, "uuid": "e09ad086-0125-4f19-a68f-4a7534ccbc02", "comment": "Malware payload (Loki)", "value": "9d8c3ad8d745b3617e17316bcf3104a1ed9f4993ede1cfd72e68d49f8d52f551", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846417, "uuid": "d30a400e-033a-4816-8380-3c866aed7cfc", "comment": "Malware payload (Loki)", "value": "da808dbb9213e2e0d4d1c739fbc27358077a0425", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846417, "uuid": "31e06186-6121-4423-a000-c4ed7db8af6c", "comment": "Malware payload (Loki)", "value": "eaa3b6d7fb4c5212cee60ddd9c434baae7945e853192fcbb59b13bd6b8f1de560364c064300c10cb8a3a350fb5cc678a", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846417, "uuid": "e558e010-b9da-49d9-9c4f-65e9bea339b2", "value": "T1E715336CAB695BD30EBC4D3142CD261A4DA27EE6A6480A11ECFE47CCC65EDC4D3E8521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846417, "uuid": "96ad61e5-0ceb-44bd-9587-0c50e3c084a8", "value": "24576:OPNaYvLGrooArfQtTlSpu4vRP+48ybicjIVV:OP77fuTMJZxrb58VV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647846417, "uuid": "b8cd22aa-aa89-4bdb-80f6-b9b433f58093", "value": 897776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647846417, "uuid": "1f4ef7c9-b03a-4bb2-92fd-57e5c692c240", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846417, "uuid": "0872ae9e-1f9e-45c8-9e56-6f23fe73461e", "value": "New Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbfc67c6-a8ee-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1647850438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850438, "uuid": "b339f131-fe47-443d-9ca1-8a24acd6fe99", "comment": "Malware payload (Gozi)", "value": "70ddf6f837dc763af27326e346a20727", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850438, "uuid": "cbe170ab-9267-4f41-9b62-cbf3acbb3469", "comment": "Malware payload (Gozi)", "value": "9d9be6c628204970cf06fb9faeaf69fa9100721db000ee9caba78330a0349cd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850438, "uuid": "4460febf-d66b-4128-a83d-e40a5401ee0f", "comment": "Malware payload (Gozi)", "value": "80526da73dc3d39d1c96fc99d485af711b5961b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850438, "uuid": "ecce372f-9c88-4fbc-a151-f0547a1ff867", "comment": "Malware payload (Gozi)", "value": "dce8d8a45090716e0348977616b02dcacabe02a894ba81fc413d2b7e326ae47c70f6eaa97b7b5100a3d60259cb83f0b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850438, "uuid": "f7e0d6e0-bb92-4ba8-95f5-70cb062af66c", "value": "T1CC74AE40BAA0C03DE1B312F8797593ACB52E3DB15B2154CB62D66ADE16366E0DCF530B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850438, "uuid": "0d0ff23d-f626-40cf-9d70-3811272b800d", "value": "e0099c0ba3b564d2d3b0381e49f6db7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850438, "uuid": "b4ffef65-fd27-41d2-868f-69367d2d8cac", "value": "3072:e7GUJKmPyl4Wf+dCg+iwnu9PtyGbhY6yylQF7yHuknf5ZQr5xK4jaL0KzzD8dXsI:GqJfiCpi9hY6RlQ0Huoq5c4j+ysAfxF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647850438, "uuid": "e8e7dc07-a1b9-4132-829f-b5dbe3ba44a0", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647850438, "uuid": "dd56904c-be3c-4fbb-8d1e-7971a30ecdab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850438, "uuid": "8ccd0ec4-ccb8-494d-a449-0b9a55730bc3", "value": "9d9be6c628204970cf06fb9faeaf69fa9100721db000ee9caba78330a0349cd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "723b6c63-a915-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647867011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647867011, "uuid": "1cb4c6b1-0dd5-46c8-9e54-47645572fd3a", "comment": "Malware payload (Heodo)", "value": "829a9952d09fda35ee7b43499428458b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647867011, "uuid": "35a72394-af54-486e-b096-6a098d452c4d", "comment": "Malware payload (Heodo)", "value": "9db9322dc50d8b8d4781683fafe08de8119059e2e6ddcbe100e4586b983fc54e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647867011, "uuid": "1c77fc1a-c43f-402b-aef9-cae275e0f1a8", "comment": "Malware payload (Heodo)", "value": "18ba7f4cf99fee99259b6db6088df47a917956ba", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647867011, "uuid": "0aab4af1-cfc8-4cf9-bbe3-f51a7c934a07", "comment": "Malware payload (Heodo)", "value": "b65ce83fb2d2e134b544ebaf170822f48fa9e4ec6d0a2c7e28a51e084bb56fc55ad3d62f63bc67e6749b6b5dd6ead68b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647867011, "uuid": "c7876f80-fdd2-4198-bfc0-572b9c6c8a25", "value": "T125F2A031F2E29B59E477583C478CCAF8D77DDA2246067E2C308A13BC5F123566A4E24D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647867011, "uuid": "3b24db72-db9e-4f7c-acda-f2094d24d63c", "value": "768:whtqi5eiNlAjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooood7O:whtqigGUOZZ1ZYpoQ/pMA8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647867011, "uuid": "a080ede2-b20c-49b4-84d1-0bf47e9bf077", "value": 36475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647867011, "uuid": "bdd02eec-9fc1-46ec-838a-1c19ba2702e0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647867011, "uuid": "cce6482a-2100-4dd9-b29c-f2858cfca85e", "value": "File_32644720.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "846b79e2-a8e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647848144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848144, "uuid": "c4a94b76-3202-4798-b26e-2217816b7328", "comment": "Malware payload (Mirai)", "value": "f6d134d9dedbf021f507b8132926a5e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848144, "uuid": "cf166160-5338-4a8c-9159-6de716be929e", "comment": "Malware payload (Mirai)", "value": "9dd179737497fde8cdd4fd1ea8c94786247e8abd1c3b32675870ffddfe05b57f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848144, "uuid": "1c4f5e53-96f8-49f8-be92-c5a6c15a585b", "comment": "Malware payload (Mirai)", "value": "f903e8463c735b6764ea719c5fc350024f609764", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848144, "uuid": "80018178-2579-4361-bd4a-9f7e9ccce251", "comment": "Malware payload (Mirai)", "value": "f81f452dc21fe54eb8f7248a1b459a17e16998ee1f501e3d259f4a490cb7ffa94acabe361efa5295679da5549a883ea6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647848144, "uuid": "5862fe90-b123-4325-8229-5fcc5b04a3c0", "value": "T14ED32905D9408B67C6D22B7AF7AF528E77232BA897CB331156286EF42FC179D1E39110", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647848144, "uuid": "b1efe9a1-5f6c-401d-9e6b-a3ec62c6d2d4", "value": "3072:uLfltud9pSeQoIrKBidaXZxbWr0vrYNlt45hwfqaO97D1ytXCmy/QsYJ0Yj/:+FdaXZxbqlu5hwfqn/my/QsYJ0Yj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647848144, "uuid": "afc0bd6c-7c9e-4f7e-b4a4-a4e2d4e86161", "value": 130434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647848144, "uuid": "cd52a96d-acc6-4aa8-9c53-e06851051914", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647848144, "uuid": "b970ef1a-d753-4ed6-b000-468eaaf19e0d", "value": "f6d134d9dedbf021f507b8132926a5e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c85ec03-a922-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647872424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647872424, "uuid": "f802c252-496e-4aa9-8cd1-e974ead4519e", "comment": "Malware payload (Heodo)", "value": "bcec56937c9b8a3a58df64645d733c7a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647872424, "uuid": "8e3d5983-93f0-4d6c-8c4f-47e9b882f14f", "comment": "Malware payload (Heodo)", "value": "9e051eb34ea07fbd964424f168b6c815e1211207aec204aa9dd865ae396aff58", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647872424, "uuid": "805737d0-b301-4dbc-80f1-4c857f23aaaf", "comment": "Malware payload (Heodo)", "value": "11c12ccd2189d57c523a3eb04e61793c6317f2c3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647872424, "uuid": "a81fbd44-8085-4ee7-b39f-40554e873f96", "comment": "Malware payload (Heodo)", "value": "8c353bfbbbf82d98b63d23df79e6629075b96643ec83bdcfd744888d8a2d38af77c6aaa65352428cb647b2907b8a33b1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647872424, "uuid": "26c6e7ef-f0f5-4bfb-bf10-95290497f43a", "value": "T142F2A031F2E29B59E477583C478CCAF8D77DDA2246067E2C308A13BC5F123566A4E24D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647872424, "uuid": "ae4cb84d-6321-446a-a455-e210c34c5cdb", "value": "768:ghtqi5eiNlAjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooood7O:ghtqigGUOZZ1ZYpoQ/pMA8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647872424, "uuid": "7ac0d885-6478-41d1-b35e-221618bdc7de", "value": 36475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647872424, "uuid": "4fc1d920-cf02-4777-894c-6e4e0296eba9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647872424, "uuid": "e5df0307-2339-4b30-827d-ea73a99f41a2", "value": "INFO 507.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1e79a15-a91d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647870554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647870554, "uuid": "44532408-437a-4e7d-b0e3-a7f150918ef9", "comment": "Malware payload (Heodo)", "value": "52bd98e0bbb270cfab6e82d8df538e12", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647870554, "uuid": "6bc1f31a-c2ed-403d-b60d-d68e79392311", "comment": "Malware payload (Heodo)", "value": "9e0d40d5b78f321a333767a396ad5dd8d790fa10a1477af99849a31ada4510f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647870554, "uuid": "39c8ddb0-b286-4e61-8ceb-b388af0ac9d4", "comment": "Malware payload (Heodo)", "value": "a6fd9db09157fc9ce025752989581966c79d6bd8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647870554, "uuid": "9c8bdf25-d078-411d-b66e-35b92dd9e58d", "comment": "Malware payload (Heodo)", "value": "d44fa348d7d9bcb2d1d2efc3d456fed5efc46adf57a213ffa8a20ce5e586221d55a491d5728e77b733654afc4738f6e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647870554, "uuid": "8075dd9c-79b2-4431-8eea-cef18c0b2d8d", "value": "T161056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647870554, "uuid": "c5bca2bf-79cb-4192-aa2f-4a0a310d20e3", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647870554, "uuid": "6fa1a1b6-17d6-4b93-8613-e4b75fdeae34", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rI5CGNHrH2tZ+d+:gMV/rI5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647870554, "uuid": "0a663ba2-ace1-4ee8-b48c-cb85eb4717fa", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647870554, "uuid": "0449fd2f-6c0b-4922-8f23-c2c0fe1fe67b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647870554, "uuid": "2ca662d1-d498-4dab-b5ab-648ab6066b68", "value": "52bd98e0bbb270cfab6e82d8df538e12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec9f7f0e-a8eb-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647849178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849178, "uuid": "36b09985-dd31-4014-a838-aa6b0ba68460", "comment": "Malware payload (Formbook)", "value": "9ef155fc7dc3fc903c46e89b301d9d21", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849178, "uuid": "a5b83ab1-8223-4863-b1cc-cef7f7b11cb2", "comment": "Malware payload (Formbook)", "value": "9e9829ad6570ba7f19654421a74172b2e1c8950092f910f7cee26f47970011cc", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849178, "uuid": "47408a86-b3b1-4fc0-a280-612264e6235d", "comment": "Malware payload (Formbook)", "value": "677fdce77f816fa35e73c057bbcf7ab1f0e20994", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849178, "uuid": "77195816-10a6-4d23-86c7-8331c689526c", "comment": "Malware payload (Formbook)", "value": "cfb7232e2c6479728570d8e8c42225e5eec453e1e90ea4237cfd1166b98bc26d002f290e0607444e3f9bf898e2a0261f", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849178, "uuid": "c4b5d9d1-4fd0-4e29-9c78-17df0fbb0007", "value": "T1E3B4238D5ED58E16B9477C84F9D921B870075A3ED6B28EBBC47EFAB64F480830263C15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849178, "uuid": "fc0014eb-5d9c-42ed-9a9a-d2a31bfb7237", "value": "12288:3iUDi/+B8ywtRBU0tjDWeODeiMcAsTcxlPwCkL/GOdJcmtr:yUYfRBU0tjDJOyiMcAs4Pw5/GOdJfr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647849178, "uuid": "ebe4fc90-cfeb-46b4-b1a9-05d6ede442eb", "value": 528862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647849178, "uuid": "8731dfd1-d766-4c7a-8b60-52a0d50ea788", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849178, "uuid": "00463c88-8993-4c35-9c2e-33a4f02e96bf", "value": "MEDUAE670644.ARJ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aca333b-a8f1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647851430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851430, "uuid": "0f2866ab-d084-4f76-917d-2ea683d4a0da", "comment": "Malware payload", "value": "15f0cb9f3c41a2f79cd72dfa6ae50db8", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE ISO", "colour": "#AF335F", "exportable": true, "hide_tag": false }, { "name": "EXOTICLILY", "colour": "#D74DC5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851430, "uuid": "bef23cb5-482a-4bc9-88c1-9fb08dd732a6", "comment": "Malware payload", "value": "9eacade8174f008c48ea57d43068dbce3d91093603db0511467c18252f60de32", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE ISO", "colour": "#AF335F", "exportable": true, "hide_tag": false }, { "name": "EXOTICLILY", "colour": "#D74DC5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851430, "uuid": "93ae34fa-393f-4331-a5ec-8c6405b4846e", "comment": "Malware payload", "value": "b3a3a97dd7933343011faaae8462ccbe3b48cbe9", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE ISO", "colour": "#AF335F", "exportable": true, "hide_tag": false }, { "name": "EXOTICLILY", "colour": "#D74DC5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851430, "uuid": "9f47c927-2dfd-4a8e-989d-35a44d5ac248", "comment": "Malware payload", "value": "9ce85d89e8bed87dacbac1948d1da907dc34a98a152fdbca009594d171b4b9456dea7842eff01606c769abe9d2e9017e", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE ISO", "colour": "#AF335F", "exportable": true, "hide_tag": false }, { "name": "EXOTICLILY", "colour": "#D74DC5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851430, "uuid": "89640f6d-cb53-4df7-a850-4297d87e1251", "value": "T14CB57C16A7A804F5C9B6C23CC997960BE7F2B8150770EBEF06A846B90F637D1163E744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851430, "uuid": "a80ae0d5-a4a5-4704-9dc1-835957a8f4cf", "value": "49152:2R7M9r/8AmAJXPasx29pSvKtxqJ7w+dIM9qPGrfepLX:RqSv/J7H+M91rmpz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851430, "uuid": "078edca2-3e41-4a9c-b70c-8a4dc5097bb3", "value": 2387968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851430, "uuid": "c222461d-1f3b-4854-b99d-99a0108e8631", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851430, "uuid": "417aea45-8e76-411e-a17b-0f6a767800e4", "value": "BUMBLEBEE ISO (3).iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "933cc31e-a8ed-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647849887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849887, "uuid": "ce23bfe3-3360-45db-9a24-31798218aa2d", "comment": "Malware payload (SnakeKeylogger)", "value": "046d42189caa546f05aafc741ad5b057", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849887, "uuid": "f54eb8e1-c9f8-4adc-9a42-7fad65ac0272", "comment": "Malware payload (SnakeKeylogger)", "value": "9efcd423fcbb0f32d81b43bbe36e534ff3ae9b2dec33a36d54e8b655e6dc8bfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849887, "uuid": "3062298d-f259-47e5-9732-6243362389fe", "comment": "Malware payload (SnakeKeylogger)", "value": "64f24a7cea797e144a7714b5ea930694d34abe0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849887, "uuid": "ad7e0f6d-af26-4b2d-9e92-0a298197fa5e", "comment": "Malware payload (SnakeKeylogger)", "value": "47f475b42e17ecf9a3dbd1d3adf799eab1d9e7a4df03dedfcd04368dc3bad9a6ca97f3d37fe452e6dc8cd24c2cc94228", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849887, "uuid": "8d156709-8ace-4102-8c86-324bfbb52e7c", "value": "T161A41264B287AE05DE55C670D07ECB9CC77E7A006097D3C32B91F2A22E53D734A4AA47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849887, "uuid": "83c3776d-cf62-457b-a8b4-a72e8e2aa1c9", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849887, "uuid": "f782cfaf-936d-4bb6-8348-d91d9dcef6c4", "value": "12288:7fLSn769wpenK/y2gRfVxcS8yRmJCut5hG/qBeqCJ:rLSn+wpeK/O2SbmMuleseqCJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647849887, "uuid": "b05d609d-41af-41da-bf50-1b91aaad45f2", "value": 467618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647849887, "uuid": "0c066f9c-bc8e-431f-be36-4fc0f9394b4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849887, "uuid": "a0589e0b-1c6f-4998-9fa8-2ee48bdd7b91", "value": "09876543234567890-09876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77002c75-a8da-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647841679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647841679, "uuid": "9dab2c00-2a5c-4193-acbd-f8c9d732f962", "comment": "Malware payload", "value": "1a00e6b4dee62c22b8d7dc491dac37e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647841679, "uuid": "2df5d5b3-62b7-41b1-bd68-43b9770284ee", "comment": "Malware payload", "value": "9efecb531b16bec1fd2462313ad0277af0855baa86c62103255d4f6b2b7ded9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647841679, "uuid": "ac449ec0-dcd6-4d5d-af87-ef681eb758d9", "comment": "Malware payload", "value": "e11e7793a5f08c1d421bb957eb655300863f9d42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647841679, "uuid": "60e9acc5-9c63-4430-8834-9dcf179fd25a", "comment": "Malware payload", "value": "281ffa863da86d2a3b57410b932f9b4e30129e29560440211e295092a6dd43103cdefdeca889febf753a054b0a756821", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647841679, "uuid": "9aaa390f-4639-4826-b3bf-72fab0c3d252", "value": "T12F81210A985148A3D98FCAFE0E77406C3BB8655121F0457189374CCAEDF3F91BA16EAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647841679, "uuid": "99b85a61-c7a6-4745-96c0-07706b03d15b", "value": "6cc2ba1dc8cce18b2184b2c4fc569781", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647841679, "uuid": "7b534a54-75e5-4cdb-b77d-472af367e7af", "value": "96:uvrKTgrm0Myg4gn0AZmVgWTzo0rEW0AGwBb:uGsRWt5qzrE1AG0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647841679, "uuid": "f351c50a-209e-4ee7-ba03-6ae3af80fca8", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647841679, "uuid": "0def62ad-85f9-47a7-972b-223e6d52f9b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647841679, "uuid": "3a10fb94-a7d6-4889-96a4-383941ac25b1", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.12579.7729", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e09baa8b-a8f0-11ec-9275-42010a9c0029", "comment": "Malware payload (BazaLoader)", "timestamp": 1647851305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851305, "uuid": "b1f7cf0f-b410-42f0-9831-0d7c06bca1c1", "comment": "Malware payload (BazaLoader)", "value": "b1bde76849fc4801a0369c7097600863", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader ISO", "colour": "#54D70C", "exportable": true, "hide_tag": false }, { "name": "EXOTICLILY", "colour": "#D74DC5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851305, "uuid": "a5aadd43-3356-4c68-8c7a-1ae02e471db5", "comment": "Malware payload (BazaLoader)", "value": "9fdec91231fe3a709c8d4ec39e25ce8c55282167c561b14917b52701494ac269", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader ISO", "colour": "#54D70C", "exportable": true, "hide_tag": false }, { "name": "EXOTICLILY", "colour": "#D74DC5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851305, "uuid": "062b436c-155d-42f6-92cd-43999de66c5f", "comment": "Malware payload (BazaLoader)", "value": "2050daf2e7882297afdd549b61d70d27e79fd836", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader ISO", "colour": "#54D70C", "exportable": true, "hide_tag": false }, { "name": "EXOTICLILY", "colour": "#D74DC5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851305, "uuid": "3b9655f6-995e-4ec6-9cb5-efe3cb4bd774", "comment": "Malware payload (BazaLoader)", "value": "0f04d3d0d8ccae685b5494a9722ef263d44f812dd64a2979989a1e7c2a747cd05e7ece21b37032da2e37d7fa53c64122", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader ISO", "colour": "#54D70C", "exportable": true, "hide_tag": false }, { "name": "EXOTICLILY", "colour": "#D74DC5", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851305, "uuid": "8f6b5419-b703-4789-b0b0-6cd95ffff8f6", "value": "T16A445B6DAF4C25EAFBEADA335AC97865216B336609935ECC120DA3D90B133617F011DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851305, "uuid": "9e8cd417-2e71-47ef-a56c-4d128aa35068", "value": "6144:AWnRr/qJy8CQnzX473venaGyRAU9uBXP:Bn9qJ5rnzoLvong6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851305, "uuid": "214f23af-5431-4a0e-a39d-4c05c834fe0f", "value": 276480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851305, "uuid": "0b42f7db-e544-447b-a08e-f9d12672b063", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851305, "uuid": "210676a6-a431-4283-89f5-100ad7ad3245", "value": "BazarLoader ISO.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fa8dc69-a90f-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647864403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864403, "uuid": "0d3f70e7-6155-4923-84d0-50a4445f120b", "comment": "Malware payload (SnakeKeylogger)", "value": "d46a3ee33bd92a4c142d0063357cf57d", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864403, "uuid": "4501b3e4-56a9-4856-9e2a-f57d1ad30bba", "comment": "Malware payload (SnakeKeylogger)", "value": "a11b8f5d11c6be4fba6811145542991759352bd8fe14615bbc0424c53eb09eed", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864403, "uuid": "bba962dd-6cab-46a4-bc03-3685b4ec127e", "comment": "Malware payload (SnakeKeylogger)", "value": "1aaaadf3aa9f5e9a0bb616dedb4b944ad7f1c0f8", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864403, "uuid": "0fc90818-65e9-4dba-b93f-2495ac23b09c", "comment": "Malware payload (SnakeKeylogger)", "value": "4613d6e2ca095b082846e11165f20c3df6744f411da3a86786ffc4e04cba3d9bd9cd3dd5549c506c38ff2e2550a1cc17", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864403, "uuid": "58e7ffc6-5e9e-4d52-ba9c-70f615759937", "value": "T1CDA2E061F5C4B09BE7D09F3319D613A04EBF25C9781AAE5DA1AE24BFD009C09E445B2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864403, "uuid": "566d42a1-8d6d-442f-b7d8-f3b0004f83ce", "value": "384:VNNsAnWcf50uzbEgeBuyVbh6x7jipo1/f23dw+N5TQDFjWvn2O3/NiJ2ITRLzinr:VNNnnWYyyoFVl6xCpJNw+HQhjWOKI2Im", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647864403, "uuid": "d7ec60cf-fcd0-49dd-896d-619e36d5acf0", "value": 22514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647864403, "uuid": "ed9ad2d3-4f93-42c6-bcbb-d443b694bfe5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864403, "uuid": "c8bffc01-95e2-48e1-93c3-ac5f664adc4a", "value": "Wduepapsz087654367890.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "718b4512-a954-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647894068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647894068, "uuid": "aa8215d3-7c3d-4dd3-ac6a-3f4cfdb7f153", "comment": "Malware payload (RedLineStealer)", "value": "7cba65b7f0ef55f454d089848e2a8380", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647894068, "uuid": "2672de3f-29b0-4272-9f10-75175e08435b", "comment": "Malware payload (RedLineStealer)", "value": "a13966e3bdef7b1704d1acd367e852b294bcca44f4239179ee84316443b9d356", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647894068, "uuid": "86e27c7e-abeb-4d19-8384-e3be14709074", "comment": "Malware payload (RedLineStealer)", "value": "04f8f4492c060077aa3df34bdd562cb36c01c7b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647894068, "uuid": "1c8e04a4-94f1-4587-9346-9b5ef25ff503", "comment": "Malware payload (RedLineStealer)", "value": "359f1809f5eb574008c10dafaac8dc09a16bd9f3f2b1fa848772891a4c3f4c291c0e8814cbd19813978a624720856894", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647894068, "uuid": "6c2d20f8-2925-4c5e-860b-b638ab4b1121", "value": "T1731633B93A8E27F0C447EF791C1E7867234BB861025C230E65BF95E775D2782D8920E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647894068, "uuid": "378245fc-8475-4321-841b-8f9afbcc2730", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647894068, "uuid": "41840d14-18ae-4c93-88ae-90fc2020ef18", "value": "98304:orMSPJ6ZyB7VKDzTWsPfLfWKlYYUIFWoZyf0Y5NMOOR/yPMfG9r6:tSx6Z/DzTFXyKCYUsWoIffNxQLar6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647894068, "uuid": "a7fc2141-dea7-4467-b9ba-fccca019141f", "value": 4133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647894068, "uuid": "b4ba73af-cb6c-444b-9ca9-d26f1b6ce612", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647894068, "uuid": "9ddaa08b-b510-4d95-8825-560e8283c7c9", "value": "SecuriteInfo.com.Variant.Fragtor.66835.17639.19452", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5857dffc-a8f7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647854083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854083, "uuid": "bb43495f-1e13-4cd3-9a54-9c242155e890", "comment": "Malware payload (Heodo)", "value": "b66d6dad474006cbccb102a9e2ed1dec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854083, "uuid": "6a4e353d-d108-4455-a23e-3e21ceac935e", "comment": "Malware payload (Heodo)", "value": "a15c431ed383d9a8c75bb1c80bee782eb5828bb0a03d78f5e1a2718b2d7acccb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854083, "uuid": "61b88042-825a-475a-9715-a22191144c6c", "comment": "Malware payload (Heodo)", "value": "7a0c19651442c1b0e9340191cdb6ea746d152544", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854083, "uuid": "b9e8a5e9-32fe-4239-babb-c3e369905919", "comment": "Malware payload (Heodo)", "value": "b31c9da24653442b0846878ff21fe5386249e1501916ded753cdffdb1951cdaa4091092725e2395e3528c0ed13a7ee5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854083, "uuid": "c8556bd2-4f04-449c-a997-ea1569763a0c", "value": "T1DF056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854083, "uuid": "742ec78d-3235-47e3-9ee5-8926413fc517", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854083, "uuid": "5433ce72-1053-4213-af3c-6fb30b0e98eb", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rL5CGNHrH2tZ+d+:gMV/rL5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647854083, "uuid": "183542f0-f3b9-4870-9a45-59ba710d69c9", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647854083, "uuid": "043632b3-4935-4b05-a940-fa565ca571af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854083, "uuid": "89b1595a-0590-444e-9abb-418831dcf1c4", "value": "b66d6dad474006cbccb102a9e2ed1dec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1ad417e-a945-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647887760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647887760, "uuid": "3abcc626-8ace-4513-8a91-25f615343d99", "comment": "Malware payload (Mirai)", "value": "0facc710aad8f20aeb874e8f647eff43", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647887760, "uuid": "91d0bfc2-e273-4a74-a58c-72afce288821", "comment": "Malware payload (Mirai)", "value": "a1b1a4a99507c297afe1f4426b9b728f990b4689dda09ba83d3fec53df5048c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647887760, "uuid": "1765fbb1-b3aa-49f6-ba08-dfafc9c8a9cd", "comment": "Malware payload (Mirai)", "value": "822f34faf87c02a08b4ff460f6bdc7c01b07069f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647887760, "uuid": "29d7e273-cd25-4c5b-af0b-e4fd3d84d12b", "comment": "Malware payload (Mirai)", "value": "8e0bb639e141483987e764fc4c498de7e5accbfc3fde5333c87a21e6028ab6cfa002c86e93b6804c8d4eb76d80f90855", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647887760, "uuid": "251850dd-b303-4692-ad9d-6134041a1f8d", "value": "T1ECE3AE14D4A1B8B0CBBA9B3025EFDD361F535A6446071D360A560F9121B7AEA381BF3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647887760, "uuid": "d12f8ea9-0728-49da-980f-2e8c6291c01c", "value": "3072:qe/g5W04KBCrqit5DfB3qSHyKyNuVK065LxVIQKaOl5ims/4:R/V04z3Df1RHyjNoJa9VI/hs/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647887760, "uuid": "7c74c065-5d55-4b3e-b89c-52e1981fc772", "value": 154716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647887760, "uuid": "a25072b6-6bae-4fa5-9779-41e2cf1e8b27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647887760, "uuid": "3fa9ced4-9d66-43af-85f5-4849a6ce3d1c", "value": "0facc710aad8f20aeb874e8f647eff43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce55368-a8e5-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647846360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846360, "uuid": "d5475d0c-eaec-4a52-a0c1-08d35a665704", "comment": "Malware payload (AgentTesla)", "value": "3613773fbf8572f6fbed2c4e2dd0afea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846360, "uuid": "74ad6e77-f417-4499-a637-38f944817325", "comment": "Malware payload (AgentTesla)", "value": "a1b314c2bffba860a728261b057cfca79035882cded006f28a95b0de01fdf23e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846360, "uuid": "b51d8bbd-a72b-44ba-abdc-7209256f7b1d", "comment": "Malware payload (AgentTesla)", "value": "d7cc5f1c415f78df91f34ee9a3be06b9935e8900", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846360, "uuid": "597f8658-2433-49c7-9a67-7b14f1bd8364", "comment": "Malware payload (AgentTesla)", "value": "b017ee2be33e68f980e3f514f228b2997d7934a0cc1d18d03d8ea1031b3d197ca56948c3c7029806d1513611ecfddf96", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846360, "uuid": "ed2331fb-a67f-4f31-bbbf-a004adace64a", "value": "T18B42C0DCDFA2798598A58E741374F12C8957E86A8441E6A8CA134F48F17C4E3894B37B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846360, "uuid": "956a1f95-82c4-4a15-a7e3-738b23d4787f", "value": "384:z9CelYKh6p2ntXQreipynFiLDWolIn99A2w:x/Wc6p2n9QKhnGO9mr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647846360, "uuid": "55a379a7-28d1-41fd-aa29-bbe4638b4949", "value": 12546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647846360, "uuid": "6d48bafe-1f7d-44d3-9f02-e0803d33a75d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846360, "uuid": "9dbb462f-d9e6-4d58-a4a2-28430cadd2e8", "value": "XHLK00987654323456789987654.Z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4d3cea6-a942-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647886477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886477, "uuid": "360c08b8-dd1e-42f9-9ef8-55aa1cd061fa", "comment": "Malware payload (RedLineStealer)", "value": "27005ae88ae97e0e550ab4fd91e1030a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886477, "uuid": "e625c3a8-32d8-4bfd-96c7-bacea91615f1", "comment": "Malware payload (RedLineStealer)", "value": "a1bda40fbfae6df4f90f546a04e7603f366c883eed3a80ed3d1adf3a71edd1b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886477, "uuid": "350c33de-35d5-4916-8b13-9f523f4a27f7", "comment": "Malware payload (RedLineStealer)", "value": "42e554602ca4fa70ba138db6326b66ab8f8822a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886477, "uuid": "fce628be-3d90-42c3-b47b-0224a36f07cf", "comment": "Malware payload (RedLineStealer)", "value": "07f4981866a9fbf5f9070eecff0d8726e5fee99ae586e225a33d6ad36595473dab00a9fe3191912c747c6de29cd4725e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886477, "uuid": "ba2a07ee-8b9c-4e76-80f5-92878f518aeb", "value": "T1FAC423D7A282FD4FC19E0AF4A55A2E47C78E6F04C6D6B037F0B94604DF15863E2489DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886477, "uuid": "c58a7fab-06d0-4700-8b1f-69f10d0b136d", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886477, "uuid": "29474032-1ce7-4866-9859-3fbaebdc659b", "value": "12288:ZQVU2BR5+kBRmMqVP1b2uxlyQS03ULaHNqrxlKIQNo0uGcCt1Qb9IsYt:ZM5cXzKkEaHNYK3Tu7Gq9ps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647886477, "uuid": "16424d88-0732-4462-8f88-d7cf7a80207d", "value": 567808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647886477, "uuid": "536600be-628d-4cad-ae65-ef9bdfad365d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886477, "uuid": "7b42a683-f6ba-44a8-a00e-13319dc48da3", "value": "SecuriteInfo.com.Trojan.PWS.Siggen3.12947.14017.26590", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0827231-a8ac-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647822019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647822019, "uuid": "c37da8b4-2e53-4f24-91b7-8f442bdf2e1d", "comment": "Malware payload (Heodo)", "value": "341b42bee292bb86c4b698e9d10501cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647822019, "uuid": "7d6240ea-ecf7-446c-9601-fd7da7b4102b", "comment": "Malware payload (Heodo)", "value": "a1dee5662b39f06276d9184017dcbe34a0b87a4f90058fcef71f66073df91cea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647822019, "uuid": "645b74a8-99da-4c3a-a5b3-26be6a090dee", "comment": "Malware payload (Heodo)", "value": "d631fc75e55b3aa405c345dd5448a445e90f1d2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647822019, "uuid": "4e18e133-6294-4fa1-933e-6aed334f38d9", "comment": "Malware payload (Heodo)", "value": "4da199a31e0ece9defef90e0007102a720f2755bddf160af55baf07b71073e83e900bff4d1a19f2ff6a4033c241ddba6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647822019, "uuid": "ca0ce7f8-791e-42db-b659-172fb467473f", "value": "T1E7A428123CE2B072C89BD0348FC56164855FF5F5AFA6727E62FD629C4B24DA18E17B02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647822019, "uuid": "bebf8344-c17e-4cbd-8ac7-3a87dfd8b556", "value": "3881d76bffe56c7cefb6ec7d56cb4aac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647822019, "uuid": "abd6e2a4-953a-483f-816c-6847262b9a15", "value": "6144:2zP28Xoxy3TAaZOO+kbEWKdguBw423quMsLh+tEgrtenN6YlXmcwT:2zxTlZP+W2x/23q7sEbEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647822019, "uuid": "eba070c3-bd51-4cfe-ba21-c8582da5859c", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647822019, "uuid": "cada687a-9d73-4872-b8a3-082020ec544f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647822019, "uuid": "ed8b5e8e-4b60-44a4-8b55-7f840b27d464", "value": "341b42bee292bb86c4b698e9d10501cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4212de9-a8f2-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1647852089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852089, "uuid": "2857be2e-ced2-4699-8d9b-9bc52a35f169", "comment": "Malware payload (NanoCore)", "value": "abcd0f40cd9864b95dc406babae4aab5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852089, "uuid": "f655e4af-8cca-4f8b-87cf-e973f0615e38", "comment": "Malware payload (NanoCore)", "value": "a1fb53720f755909dee2f5fe9c8015ed9b5e52817dd9a91d6ed7762eaa9faa2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852089, "uuid": "3caad1bd-ba98-47c2-b41a-aa41ad246ae5", "comment": "Malware payload (NanoCore)", "value": "b5f8e11f505b239e5f827ba3d16391db877c8aa6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852089, "uuid": "20f71963-a600-4956-b21d-90d9a9f65ce7", "comment": "Malware payload (NanoCore)", "value": "653c0eb433749686e0295caf1648a1027224fc4742c63bbd3477365410c3070ce2b208d62fc9adf0c4037732c9332425", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852089, "uuid": "eb871d7a-a18e-4e3c-a8bb-cd58736c087d", "value": "T15D744657765B4FD7C1E635F7686572CE4271AC214E12C257B7A8383EF8B3B92CA00126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852089, "uuid": "513b6bfd-b42a-494e-a3ca-1f69c0579f13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852089, "uuid": "3d965f36-847b-4f70-a089-f5c3cc192851", "value": "3072:LrW4DSp8DP3H4exIj5DxcUuiZz0mDZR52F4A+Ts712N0t5RZDf:LrWKSqPoPtBuiZzj8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647852089, "uuid": "c5e7d78d-7ad8-422f-80d1-c732997c53f9", "value": 340992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647852089, "uuid": "fb61e0fb-39fb-4140-bd36-ca22a93c5954", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852089, "uuid": "078b3df5-ff11-459b-bff4-20d9d7b54acd", "value": "Payment details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c5a57dc-a8df-11ec-9275-42010a9c0029", "comment": "Malware payload (Hive)", "timestamp": 1647843755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647843755, "uuid": "7b466fe7-41ad-49a6-9266-f6559e06506c", "comment": "Malware payload (Hive)", "value": "689d783fdaeeff17f2c3a9471ad716d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647843755, "uuid": "90a223d9-dcbc-4b43-a62b-846cda4ded0f", "comment": "Malware payload (Hive)", "value": "a261a73cf75f1300ff5eb593c555591cc4b7cc440aa11bd12f3cc2b71952fd83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647843755, "uuid": "62d6af42-5e05-4f72-83b9-0d6d765d82fa", "comment": "Malware payload (Hive)", "value": "81470d45a77510d7061576b46546de28a5d7d068", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647843755, "uuid": "1253fb1f-3161-4b91-bec7-8ff09932aeba", "comment": "Malware payload (Hive)", "value": "322ba5a14d67bf33ca35d3fd9a03ddbeca36f5a7a2997ee088595ae6156e2a4ec62e55f3f6d687da168e972da3e5a449", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647843755, "uuid": "fa89510a-177e-4b3c-8624-752d4dd8745d", "value": "T1A9264A43FC5190E9C0AED130C666C752BA317898573523D32B52EABA2F77BD4AE78350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647843755, "uuid": "b6cf8fa3-9956-48c9-90c5-bc2c00be6ff1", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647843755, "uuid": "4ab0b7fc-b030-497c-bd94-6811012df9c3", "value": "98304:0lf33xyFpOLLpX2tOEOQQQQQQQQQQQQmkVE:mtL0tpkm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647843755, "uuid": "4cfc005e-a604-4738-8830-ec65a7307c75", "value": 4653568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647843755, "uuid": "65952654-b7b3-44e5-bb07-b6e7ee1d0b61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647843755, "uuid": "2aa818a7-7130-4918-b77c-5192a80e92b3", "value": "32311396.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b04404-a956-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647894748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647894748, "uuid": "c922e7f9-07be-4dba-a49e-d0e489bc5a6c", "comment": "Malware payload (Formbook)", "value": "e5d39dbcb30238929cf0ace419b207e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647894748, "uuid": "625bb7de-784e-4caa-bc72-44e4b04ed025", "comment": "Malware payload (Formbook)", "value": "a27690306574d230791d1625c7657c8460a1ad5a3bc0187e28a7620f30da14fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647894748, "uuid": "c7c9ed5b-f484-4503-90f7-fdafe4c21439", "comment": "Malware payload (Formbook)", "value": "f5c499e26a082a97ab0c4f2fb8dba82f719a37be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647894748, "uuid": "cb67aa66-2ee4-41cb-a3d2-c65d6d6eb7cf", "comment": "Malware payload (Formbook)", "value": "b693f52a4e5347c67bb8de57bd11771d85b78e83caf8a5c13ffddbf5f17bb7c3619e8ba6eb1bc196f905ce73241c8bae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647894748, "uuid": "eb29e485-1d3d-4234-9624-9f74b465488a", "value": "T11B45E1AC325171EFC417CD728EA81DA4AA6135A7670BC60BA01705ADDE1DE93CF206F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647894748, "uuid": "2d842d08-dcfb-4958-97fa-e8a4c878db69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647894748, "uuid": "9c871bbe-a47f-413d-b91c-7f5b7d494256", "value": "24576:+by9e8ItJePeyuFyVU7/78m9w9BxanVR5VVuj+olvm:+aOtJePe/Fyuf19w9BxIT5VVu+olO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647894748, "uuid": "d20473b9-64ec-48fc-8f90-65a206fac53b", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647894748, "uuid": "8d0ba228-270a-4f7f-92d0-6912e09301e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647894748, "uuid": "4107e0a0-8239-4fc8-b0d0-4005e2727977", "value": "??????.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64499184-a90f-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647864411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864411, "uuid": "1c3cd196-f16a-4e8b-bea4-a10e4de996ee", "comment": "Malware payload (SnakeKeylogger)", "value": "3b266923951ccdc6b9a9e32a520301ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864411, "uuid": "a6920a24-2ab6-439d-b55c-29109d00c1e5", "comment": "Malware payload (SnakeKeylogger)", "value": "a2b395bd126d99e0396834a76aec0a9210fcc88d4c8a97be89877da2c6c05ba1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864411, "uuid": "2a23584b-6868-46b5-acaa-6b022875f3fd", "comment": "Malware payload (SnakeKeylogger)", "value": "6e9aefbee51b8b7f32e2bb27a55d0e4d83760eee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864411, "uuid": "c62b8b44-ce37-437b-8c78-834df387ce13", "comment": "Malware payload (SnakeKeylogger)", "value": "c957287d3ff687b46d25de3b9aacc166230b2d793a789806e9e48bd920ec33ca31eae5ecd2b7c08f6cdfaed2989356ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864411, "uuid": "15219cc8-13f6-4569-a4b5-905eade36f4d", "value": "T115133B0C77CC7A91C27C79FECAE7459843B6B1E36A11F71BAE8412184943BDA6606F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864411, "uuid": "8a1eeced-8bab-4220-93a0-466271b86b3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864411, "uuid": "cda6eaf2-c7b7-4970-8438-9705a06e105c", "value": "768:LTfu7egXXHGVYGq+UYmhMArVKmXUu8JMd3PsuMCUIycyrsR2vZb:ynHUYGqimhH59fMJvvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647864411, "uuid": "9f25ea49-2964-466b-893e-0b813ea46b45", "value": 41472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647864411, "uuid": "f7867e3a-ac7c-4ec3-b204-e72278f54574", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864411, "uuid": "f00b1c54-c956-492b-9ed9-918509bfa4bb", "value": "Wduepapsz087654367890.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c481f8e-a953-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647893657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647893657, "uuid": "c2a9f8b0-3412-46de-8b5d-42a196b4516c", "comment": "Malware payload (AgentTesla)", "value": "be19085405defd8b94a15c3d501cb399", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647893657, "uuid": "551e20f2-7c14-4a79-9c1e-a78b38bf9915", "comment": "Malware payload (AgentTesla)", "value": "a2c73f0108d65ffa6c74e78bdab083604b5593a504821467cd08804974f18285", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647893657, "uuid": "caaaa2c8-8f88-4b98-b22e-3781497f851f", "comment": "Malware payload (AgentTesla)", "value": "64a10a7ed586b788eb550a8738d811b698d04002", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647893657, "uuid": "703b2ea9-1c27-475e-87a4-37114b5d655c", "comment": "Malware payload (AgentTesla)", "value": "11f436867571a24ddd6d369616664a0ab8e01e28a49bf386f0c4cd3d142f67e628f4e000617972a455f45a952dc2b6de", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647893657, "uuid": "1d0fb108-af31-4847-a472-0a3a090d0fc0", "value": "T1EF35231AB3636925C4AE123702AADB410B77DB862443DE897DCA33184E337D7425F76E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647893657, "uuid": "7a1f66cf-c7e6-4c31-a179-8dc0de96c513", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647893657, "uuid": "5ced881d-bbc8-4949-be99-db84d54fd17e", "value": "24576:539cnMcXw/03N5D41+GGMfRcXnihtW0tXMJMjNkjlF:5NcnHw/03XDpv4Tk0tXMe5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647893657, "uuid": "21df582e-e4ee-4bf2-8db7-dd92799efef2", "value": 1074176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647893657, "uuid": "c3865792-4a51-4c70-ac5f-c330ca8e05e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647893657, "uuid": "a60be8b8-b3d5-44a5-b675-5b49398bb71f", "value": "HisseSenediEkstresi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5457d6a-a90e-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647864090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864090, "uuid": "7ad555b4-c483-4681-8ebb-cdd1959ba74a", "comment": "Malware payload (RedLineStealer)", "value": "0fa24096b7b7f5ebc66fa9f671d21fa8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864090, "uuid": "fa9dfe53-8b19-4cec-b437-b195dc5b7a72", "comment": "Malware payload (RedLineStealer)", "value": "a3f9d2f8201cd06a0a68841df40fba976c8b4ad6d3fd6ed067ced53507906911", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864090, "uuid": "88ab7460-ae55-446f-bb1d-f57bef87af09", "comment": "Malware payload (RedLineStealer)", "value": "0bfc66b9aa50812b0e7d91f0c41926ed564de70c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647864090, "uuid": "fdf43162-51fb-47d0-9b92-cf9be184ba02", "comment": "Malware payload (RedLineStealer)", "value": "9c83c72cabfe82a23daa92dbfd7e86a72252798f2728052706ef909859ec16e3217d65d701cde18127eda0d4a0d5958e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864090, "uuid": "72a1fc20-073b-4a03-866b-4fe34f3271ca", "value": "T16A94DF84B7A0D03DE1B702F4797993A8752E3DA06B2165CF62C62ADF16346E0ECB5317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864090, "uuid": "69c761ba-9266-4178-8185-c1dd9621d152", "value": "5761b9d43ffb6d646c886cb4b6f3b2d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864090, "uuid": "f51fa8eb-6b72-4909-9ed1-709138f68a9e", "value": "6144:4y0xjS5OKZgyodQ8YnXOFbqWVwMQ93shJmqPEV/Zb0GpHz9dnzji/Zhr8+Ko:N6S5OKZkdnYehqWIQmqG1HRZQZhw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647864090, "uuid": "cae5d657-e633-4f76-b932-14c888496dbb", "value": 417280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647864090, "uuid": "2889aa97-2bed-47ed-b535-fafe5ccd388e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647864090, "uuid": "6c7ab2b7-681b-46fc-9a15-f458dd26d34d", "value": "0fa24096b7b7f5ebc66fa9f671d21fa8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07adbce6-a8f9-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647854807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854807, "uuid": "9212a90d-f20b-4e46-a559-510df91f88bb", "comment": "Malware payload (Loki)", "value": "655e3593804bbf7aedbe74b5b934a3d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854807, "uuid": "bf1f6ef4-470a-4e05-8a09-f083ea791f9c", "comment": "Malware payload (Loki)", "value": "a412808c2aef2609219df6ee319513d57a8590d226bb8f0f136ba16e3c74f48c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854807, "uuid": "b96269c0-1af2-42f9-b1bf-252b2c24f63e", "comment": "Malware payload (Loki)", "value": "c98b6db23bbe338c9bff1fc6ee290c4ec13f9b16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854807, "uuid": "476cc996-da51-4276-9f0c-cf595fe112ef", "comment": "Malware payload (Loki)", "value": "848df12402948989d2bf2dce0cb7cef9250e63d8ae430a71c103d846e784fb784f58f72513a37762aa37ec58a5a8deb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854807, "uuid": "57faaf58-3de5-4f8a-94f3-8b67b364bd9b", "value": "T10F1523813B6C5572DD7BC670FCA9B44007F1A0EE7242E7A49E48A8C62D177248B2777B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854807, "uuid": "2e43bd31-08bb-4383-b99a-2b413fac8a35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854807, "uuid": "08c75638-6a6c-4713-8018-2e80bad09e4c", "value": "24576:QNml94MmFh4GRdWnvDxGoSNdJcg6VEoa6q:QNgdE44MvDiNdJ96Taf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647854807, "uuid": "5c9e1280-329a-40ca-a85d-f906c0fd3bab", "value": 922624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647854807, "uuid": "9e87d9ff-ebc1-4941-b6ce-adcfe0e537e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854807, "uuid": "9c87195b-9d81-4dc6-a8bc-a5833d04e760", "value": "655e3593804bbf7aedbe74b5b934a3d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa5ba3c-a929-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647875830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647875830, "uuid": "c0175591-2b78-409c-bfcd-b87031bbf4a7", "comment": "Malware payload (Heodo)", "value": "51869c6352aa44ec55b11d638b782d1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647875830, "uuid": "8bc21f1f-f989-4ad9-9f33-b8ea6c357519", "comment": "Malware payload (Heodo)", "value": "a41fda6d1627558ad93e56be55f3a59a66e71d1ac3b7cb401de1e0683796e25e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647875830, "uuid": "fd8cf682-b46a-406d-8795-4524c324e426", "comment": "Malware payload (Heodo)", "value": "0b38116c78b955ce7d91aa20e4f22b256d94b39e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647875830, "uuid": "2b145317-2e3d-4008-85c8-1b1061332326", "comment": "Malware payload (Heodo)", "value": "7fa9a6f58bc1829a8449f7160ffccdb794c43ab22e4f1d6f25effc40991e138b1f2a3c884c14881a42fa61a7f4a40dcd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647875830, "uuid": "5d040cc4-a699-42b0-8157-db47dac6ec65", "value": "T158056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647875830, "uuid": "8ad693d2-c2c4-469e-aa52-901e54f9aede", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647875830, "uuid": "612f3e58-bcc5-4c41-93f8-885e486f5ade", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rs5CGNHrH2tZ+d+:gMV/rs5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647875830, "uuid": "d47d2368-1644-4398-982a-4158b0680e0b", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647875830, "uuid": "d5bd2795-f5f0-4c07-9c70-de75903a6489", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647875830, "uuid": "a87d7abd-fdd2-41a2-8fca-1c944616e5cd", "value": "51869c6352aa44ec55b11d638b782d1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eefad4f1-a8ff-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647857772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857772, "uuid": "00537260-df84-4c24-ba50-266b122e6728", "comment": "Malware payload (RedLineStealer)", "value": "2f79b70458c2dc473d74107f577f0100", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857772, "uuid": "d7ea7344-a962-4f27-8c97-80caabd0c798", "comment": "Malware payload (RedLineStealer)", "value": "a426c2090b8c2777661236aa54ce8eb143af9cc4c1aa8aa11261c6758a970921", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857772, "uuid": "4f556928-ddb8-4a49-8d70-6af83feb4631", "comment": "Malware payload (RedLineStealer)", "value": "e32c8f0bce272996d95fdae57c1ea74b0a48fd12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857772, "uuid": "b29e7cde-cc43-4b12-996b-d4a658d009b7", "comment": "Malware payload (RedLineStealer)", "value": "db247889bebf7a8b41bd70b8720402395278728236c0ac94a208913c18d28c1a2d5e4acfb4abb1253301bda849849852", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857772, "uuid": "9aa7b51a-25ef-4e64-9710-17dfff73c29c", "value": "T13394D040B761D03DE1B311F4797A93A8B52E7EA05B61A1CB63D52AEF1A306E0EC75307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857772, "uuid": "ea584256-363d-4e59-b72b-d48236f91996", "value": "30c85236402d607ec86afd7c1aadbde2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857772, "uuid": "b155bc08-4951-4bd7-9147-7601c6b32d1f", "value": "12288:6GlJrJzcl4DPk6jNDAwIgw5vdkQeG6Izl:fDJ4K46jNDAF15d0Izl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647857772, "uuid": "5eb81825-4e59-4eea-bf88-080dfe4be00e", "value": 417280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647857772, "uuid": "7d379cc6-e421-49f6-b377-f30d216e30f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857772, "uuid": "88670bd6-cf87-4ddb-a199-1e34c47e3cb5", "value": "2f79b70458c2dc473d74107f577f0100.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5af56c54-a926-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647874274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647874274, "uuid": "399bc67d-51a2-4cc5-a26f-ab565c14fc1f", "comment": "Malware payload (RedLineStealer)", "value": "88d84b94c84f68713c08e854d2f2a9ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647874274, "uuid": "19c6e350-8d36-42c4-86eb-b4d3f8dfc53e", "comment": "Malware payload (RedLineStealer)", "value": "a4291a80f585f6610d0860629886f71cb5a894ac4dcb4aa43ebbb11c409864e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647874274, "uuid": "2b35abbf-f5a4-412b-ba78-9370abde5016", "comment": "Malware payload (RedLineStealer)", "value": "08b864ba77fa6406942564d75922b3f54f9d35ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647874274, "uuid": "5be87769-23ec-4444-92d4-ad1525ea5e43", "comment": "Malware payload (RedLineStealer)", "value": "cc25146fb0e4d416ade2df247295f9ff2810565bb1060621eaab7e994ed7d05c8e55fed7020350fb0fe77d090c6627ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647874274, "uuid": "f0e8effa-5ca4-4a33-afab-9ff5824736e9", "value": "T12B94DF40B7B0D03DE5B712F879BA93AD742E79A05F2150CF22D66ADA16306E0DCB435B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647874274, "uuid": "8af12146-bee3-4032-8e8d-3b8e35230734", "value": "d626a2a864a52e91dc5f85b5e98029ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647874274, "uuid": "dcaf9660-ea10-4e4e-ae1d-2ad8170a8618", "value": "6144:vk07sUQRvqtudxOXFWQR3d3F9b6g+W+GqFgkDnalTr+iH+qRgpnhTaGcoX:snUQMtZXUyNnbh+NGq6kDalTy8WUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647874274, "uuid": "e64e8e28-1749-41ed-af3c-3d03c076569c", "value": 417792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647874274, "uuid": "c895d569-e11b-415f-a17e-4403bf5a4d8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647874274, "uuid": "5afa6f46-ee5c-4ffd-8f36-374e213e7534", "value": "88d84b94c84f68713c08e854d2f2a9ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0fab67c-a947-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647888565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888565, "uuid": "2d43ead8-40c2-4e1b-b339-519309a68fa7", "comment": "Malware payload (Mirai)", "value": "6805bb83f549f7b4bbb34f171bf8d4b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888565, "uuid": "5fe836b5-75b9-49fd-aa0b-105b61001ee6", "comment": "Malware payload (Mirai)", "value": "a4a8867813861b121fd6c3d5dd0524cef0a43b4ca255a6f8cb6b60488d0ee105", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888565, "uuid": "27a566ca-42b9-4982-ac95-a05683499bd7", "comment": "Malware payload (Mirai)", "value": "b4b1743ab8850ff1fc342683db74325f99f91efb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888565, "uuid": "ee5296d5-2c8e-40e3-bbab-53c492cc39da", "comment": "Malware payload (Mirai)", "value": "7836ea96a3d43f9ee3dcf1854f0a3a47ba403abe1b13d7b9553954eb4e59a8b4858b90e820d918356b5269c48e7cd6e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888565, "uuid": "f71c0650-818c-4411-9032-9272ee087aff", "value": "T11E93A286AC91451DC3C013F96B0BE79C2331FBFBD2D9B1329C14A694BB7D3992B2A541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888565, "uuid": "14e36399-5c5f-4cab-85e5-7641793bbb83", "value": "1536:6h+uvhfsTip4GRujMOWwyLbMuoC2yx5c0gVSPKBQyyk48phLOE/Ik:0+chfbQZ0viSS2d78phL7/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647888565, "uuid": "266bbad8-de4a-475f-8241-77ada93a0cd7", "value": 92480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647888565, "uuid": "a0476f7b-c3a4-4bfa-afe3-cd466cb1ee18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888565, "uuid": "eff94498-518a-4fef-acea-9af05fcb3f71", "value": "6805bb83f549f7b4bbb34f171bf8d4b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "088e1690-a92a-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647875853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647875853, "uuid": "279f34f8-b218-4ad1-b21f-73f7a264375f", "comment": "Malware payload (Loki)", "value": "c07fac8b1e36f598366d2a4968ce2ccc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647875853, "uuid": "29f1a6c3-669c-4a73-a0fc-7bce1f88d32b", "comment": "Malware payload (Loki)", "value": "a510389aca7e39df029d0f4974f63a70010270f589bc7f6095d523687196f08f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647875853, "uuid": "772e6466-82d3-4396-ba5e-798f83d6426f", "comment": "Malware payload (Loki)", "value": "bf572ca8a1bf8798522ebbfa9bd1025e13f4b052", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647875853, "uuid": "cbb1578d-f827-46ac-92f3-e6c5a2fe0f38", "comment": "Malware payload (Loki)", "value": "a79e6d95003f5ec0e9820f91c0c96151b9add31a8149f97c625591261cb536fdde444ceeae7d7080f37fd9bebe75ae86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647875853, "uuid": "169cc076-1532-48cb-aae4-2606741e7558", "value": "T193C49E6336D5547ACEA80530302BC290EB357D4826F5CB0DBEC6722F1D7299AF725E25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647875853, "uuid": "f2b5ccc3-bf39-4276-aa53-353bab3688d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647875853, "uuid": "25308f88-3189-488c-aec3-ef2447e3460d", "value": "12288:qm7rT6mE5Gl15PpgNcVrGAEtUvWmAnOKmXxA:rPwGbVpkctOtUTrV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647875853, "uuid": "32c2dcd1-de1a-4ed7-9bc0-2de89bdf4a45", "value": 574464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647875853, "uuid": "5e33efc0-88db-4245-819e-21fbacad3706", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647875853, "uuid": "05fce93a-ec9c-4de6-b66a-e479cc145edc", "value": "A510389ACA7E39DF029D0F4974F63A70010270F589BC7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a4059b-a947-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647888655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888655, "uuid": "09f8384e-96e4-4629-9d5a-7fe4947f27f2", "comment": "Malware payload (Heodo)", "value": "462498c23bc922cecf1df2afc5c6be0a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888655, "uuid": "a4289a47-6a96-4d14-9555-a031884a0f9e", "comment": "Malware payload (Heodo)", "value": "a54b99c74c0131dd19ef4b210264e05765b6870d3d53c967a7167f915586e05d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888655, "uuid": "7f88bde9-1e38-44b5-87cd-98d6b0ca7d9f", "comment": "Malware payload (Heodo)", "value": "c7ee6a1e1140ad10ee97495863bb1fa2b1c54080", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888655, "uuid": "ac79169b-2872-4ca9-a7a5-35eef156f5ee", "comment": "Malware payload (Heodo)", "value": "0e09f08f7e20628d004c448c605f0af0c100bb0b1c2f564e015bc3d09343f8c8f90264ba7552fd31aef952579a92e609", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888655, "uuid": "e7b87871-8231-468e-8563-d438592bc673", "value": "T1FEB43A11BC916832C36FAC7456073262588EE7F0DBD1F26FA3E0495C9A7C5E36624BC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888655, "uuid": "7dd4e767-ca88-4d02-8fd4-893347c3a227", "value": "14e6ae8d1400b6271725b3f01025b85e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888655, "uuid": "ac1b4e8c-6a24-47ee-9193-298f104ed573", "value": "6144:VikzyaB9eoCyx/mEhHB5RYSJ/xR+qiCjzQNPj79GkqbscgCG5qH6scI:VNnCGmyHB5SSJp80zQN39GkUGQSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647888655, "uuid": "3b0d9e66-3777-47ad-87f8-ac518765bf73", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647888655, "uuid": "47cbccb1-30c1-48f2-9243-01fcde95bb00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888655, "uuid": "a9eb2c45-7d80-442f-a9c0-31148d35cca6", "value": "emotet_exe_e5_a54b99c74c0131dd19ef4b210264e05765b6870d3d53c967a7167f915586e05d_2022-03-21__185045.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89bb1802-a8ed-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647849871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849871, "uuid": "3e23e011-838a-47b5-a2ff-b8e784869d12", "comment": "Malware payload (SnakeKeylogger)", "value": "8fbb80cc8d6b91e64777a8695eaaf610", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849871, "uuid": "b5071207-76f0-4988-ad73-4e10b1787993", "comment": "Malware payload (SnakeKeylogger)", "value": "a569028632b2427d1e6ab6e617ca8a31404a71a79822eb3dbfdd63f72e12de45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849871, "uuid": "cd5d27c5-f9bc-4187-8d45-ca80629bde20", "comment": "Malware payload (SnakeKeylogger)", "value": "1eacb0da57799d1e5e3ad0c758a55320b6a68c08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849871, "uuid": "891158af-7ebd-45d9-92d3-56f0b0193fcd", "comment": "Malware payload (SnakeKeylogger)", "value": "77393875472ffb53521c64462badda37c7900fa828cc60126724aa77993c91db41b29ab9259397fd5d983a2d540a6147", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849871, "uuid": "6def03d0-6164-4a25-b0f3-c408e2a653d6", "value": "T13A35E1BC32A1319FC857C9728DA86CA4AA603577570BC60BA017059DDA1EBD7CF246F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849871, "uuid": "fc8f83ed-e152-4ebb-b7fc-7c3916d0805d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849871, "uuid": "4a1892a0-629b-4225-9ec1-ff7f889fd141", "value": "24576:z39btf4SMl+YXMjlOmqXWciOB3U6a2vsJcy8FW:RBw+Ycje/3k275W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647849871, "uuid": "2acdcc01-3143-4793-8d11-4ddfaa1e6494", "value": 1094144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647849871, "uuid": "ad8264cc-d597-4e60-bac8-784471784788", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849871, "uuid": "6dfbb32b-13b4-4ffa-a69d-ee8026be3242", "value": "20220321_3339477993743000000,xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73d398f0-a8da-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647841674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647841674, "uuid": "5cf63444-3d45-45fd-bccd-766bbb217408", "comment": "Malware payload (RedLineStealer)", "value": "4503eea48e2168c4af4b9adc960437b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647841674, "uuid": "a4ca9cea-6fce-455d-a41c-5142279c009a", "comment": "Malware payload (RedLineStealer)", "value": "a575035cb2e33a23dfacbe20e1b5126c99dfd8640ac5c48b2a63d9d001f644cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647841674, "uuid": "6f352783-329f-486d-a128-7a9eccecf538", "comment": "Malware payload (RedLineStealer)", "value": "b02246414a34293e171f349aeb1cb0cbe5d4da38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647841674, "uuid": "04cd6ea4-ae55-4795-9da5-ef048b3038bc", "comment": "Malware payload (RedLineStealer)", "value": "89430c69528bb5604c4c88e4f30b4409d3600b1cb6262da6a28ed22669b6cdc7c2fed194c2b0a035f9c1de4f6aedb23f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647841674, "uuid": "c2514675-7702-40bf-9ff6-eaaf57a60eff", "value": "T11E84F122BFA3C072C4970530A824CA716FBB743115B489877BA907BD5FB13D1DAB635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647841674, "uuid": "d8bf7d51-dfbe-4b50-9f53-24d3ba69ab68", "value": "dd74d0a493381cbdbb2d3a82a03effd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647841674, "uuid": "96e7b4e6-d146-4e06-b4ef-97d6135c7839", "value": "6144:Do5LWO1UARgzPyFZt+FBLB/CX8BeHcWliMAOnT0TGiGem:Do5Lp1UARgzPy7oHBezCTZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647841674, "uuid": "c25c7913-35ec-4dcd-93e2-4f5622cad294", "value": 404480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647841674, "uuid": "3b0973f7-32f8-4022-b522-5fa06860174a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647841674, "uuid": "0ea1718a-0c6f-4d64-aade-00dae86ece96", "value": "SecuriteInfo.com.Trojan.GenericKDZ.85453.7957.10097", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e84107-a8f0-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1647851119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851119, "uuid": "0c5d964e-bba2-4a8b-8dee-47ddef4b1b25", "comment": "Malware payload (RemcosRAT)", "value": "d84e2afb471ed8d588c67db2b1905900", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851119, "uuid": "7c7bf5f2-2861-4e24-b140-cdb35e935eb6", "comment": "Malware payload (RemcosRAT)", "value": "a5a6ccd8f08f56827c455ee84db9ff679b16f9016ab902f74a894c360a68aefc", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851119, "uuid": "877a84cd-a0bc-45c5-8bf1-6188db54cd75", "comment": "Malware payload (RemcosRAT)", "value": "803b1ab30e2b5023065fe167d43e8f79a4eb6d14", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851119, "uuid": "039de0b9-cabf-48ce-b912-acc06704172e", "comment": "Malware payload (RemcosRAT)", "value": "5a63ae95f454db9ef79fb4476db93a2894ba363f252ee1d94fdf957d7d6d59724ca73fa6199f7f603e34365425f45b27", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851119, "uuid": "83a230da-f1ee-49ea-8b89-16a54b48da91", "value": "T17692E3062B418145F05A5A3C1ABC9BC99D27BCFB09725B5D60A47EA80F3287D4FB3363", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851119, "uuid": "476eaefb-d6dc-4bae-958e-5c286de54359", "value": "384:2CNL1uuJHvgS3pmD2EJvaVjlukrAGlCvh3z5:2YL17JHv/pFEJSJRrAGQv/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851119, "uuid": "ca455a5e-6a97-4da7-afa5-e7716c597210", "value": 21000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851119, "uuid": "982be7bd-82e0-4a10-b361-2ea8504a6156", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851119, "uuid": "7f42166e-628e-47a6-962b-27d2b246959f", "value": "Purchase296256AR.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65a82dac-a8f2-11ec-9275-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1647851958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851958, "uuid": "bfc83f3b-b967-4cb1-af0b-51e34b65750f", "comment": "Malware payload (STRRAT)", "value": "fe71c6401ce1eab9b84d0688c0d13e1a", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851958, "uuid": "ceec5586-5778-48e9-a99a-541c4f7b1e9e", "comment": "Malware payload (STRRAT)", "value": "a5bd637826fbf8d5ac93ac65534490a7b1bd6b9277f4913d6bbea6a35cbeacfc", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851958, "uuid": "7dd0468c-3cf2-4ed6-a968-782a54b5f2c2", "comment": "Malware payload (STRRAT)", "value": "50fc89ec2aaea0c8fec316a9f9c0982bdc2b449c", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851958, "uuid": "a0d3aae2-d023-4c6a-afc2-088178b92d53", "comment": "Malware payload (STRRAT)", "value": "4bbf81886dde7d803d68c6d88e700d4eabd3f9f7c96044206ba63234d4b18bdf81c7e35df01e455c5afd522e802a0073", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851958, "uuid": "ca0ce0b2-43e4-4a84-b5f8-c31d34353d17", "value": "T13AF313C8F648453C730D2BD1796AC368D703D2165F3EDB5A1B121E4F690A88F1DABA68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851958, "uuid": "337ddf42-eada-4b2d-a678-35ee727567b6", "value": "3072:/TQmTWVftFA6WaUIzmxTU4VHtk4GeidU+xrqMg5gntd+5QvH2K/UdYRbAb9gvCgR:/TQm61FpUIzmxTnNk4GDVrqJgnts5Q/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851958, "uuid": "d88f28b6-2fa1-44d7-8f3f-da932a866343", "value": 172714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851958, "uuid": "cd8a6f12-bb20-487d-8d1e-697aea52c27a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851958, "uuid": "8c86f137-97b7-4566-ba03-93310ce439c8", "value": "Quotation.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ba6d869-a8fe-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647857202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857202, "uuid": "df2bbfdd-d122-4a73-bcd9-32f3a6f9c8c7", "comment": "Malware payload (SnakeKeylogger)", "value": "37e6affedbfff4d51f4e3852efdc0201", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857202, "uuid": "9aa1d337-3309-4dd6-9041-c709998e225f", "comment": "Malware payload (SnakeKeylogger)", "value": "a66069c58994dce50cfffa303187b417040a0831b43b358f180e3b7f7c32e5fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857202, "uuid": "f81366a3-e239-49eb-8aa9-59d2bca98d41", "comment": "Malware payload (SnakeKeylogger)", "value": "fa5b1b036691f6ef4136ebbf3d3d1d1c4281bebc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857202, "uuid": "63a1ac54-71f2-4bda-adf0-490da5c40ec6", "comment": "Malware payload (SnakeKeylogger)", "value": "510527d3c49dba2df57816e947f745b8445c6e8cedf920f630862df6978e4554399c9c9fb0607d3fe6458e720f33cea1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857202, "uuid": "d3b26350-bb86-4295-a588-5941add86961", "value": "T1F66533521BDEE2F6D9869B79402557FE6E2023A4E70DC4287AF513A4042E37C19CBB73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857202, "uuid": "d3261a8e-bbce-4906-9fd4-f3e6b56f20a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857202, "uuid": "2381da9e-703f-4845-b4b7-a17e4e6645c5", "value": "24576:AYbALH++NANpic3ZPSoiL/4PbTt0/wSZqUcsxxnXXfSVfTOXgiPgzIEEIyL:TALe6ANpROSTtQwSBP2TOXVCIEED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647857202, "uuid": "4d1bdf77-e603-41a7-babe-411599622d81", "value": 1532928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647857202, "uuid": "e9ac2c44-b61b-42b4-ab91-0c0163895914", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857202, "uuid": "f0431cbb-f7c4-4a18-b396-c5aadb8de113", "value": "37e6affedbfff4d51f4e3852efdc0201", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67fa80d0-a8ba-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647827910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647827910, "uuid": "bd8be3b3-49a0-482b-a234-ee5cd7e85b06", "comment": "Malware payload (RedLineStealer)", "value": "5a50d1389cf1589d90d36d11c37aa677", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647827910, "uuid": "06c528ed-28ed-4fac-bc34-556907f26bc8", "comment": "Malware payload (RedLineStealer)", "value": "a6c58dc411ddd6fae1977d92e601c483931fc6cba08bf003a23cdbeb74244b48", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647827910, "uuid": "38c1dc54-f785-47ba-bd59-5090bc087ae4", "comment": "Malware payload (RedLineStealer)", "value": "390d43d909860055971ee7bfa619ca149ecfd284", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647827910, "uuid": "054d5038-3289-4ed3-9c14-0b4c433049b5", "comment": "Malware payload (RedLineStealer)", "value": "257112845f9fd7431b2e95df81c3cb49658963789b4ed01bffef3cc4856e312d5387d2d898cf1607076b235785ff568a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647827910, "uuid": "ddbd18dd-76d0-4c2a-972d-c0ec1d7c6be1", "value": "T14894F122BA93D431C49789706921CBB1667B303226B59D873B98177EDF313C2DAB6707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647827910, "uuid": "2fd84b74-354a-4cdc-8cd3-e084084f7b76", "value": "dd74d0a493381cbdbb2d3a82a03effd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647827910, "uuid": "7e123002-c1dc-42eb-b3fa-37fcc4068de9", "value": "6144:ABKSKbu+X74bSpndpVwfBXQj5AgVEZftD1mzeAEa7G:ABQbtX74bSgfdQjBEZlD1OeM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647827910, "uuid": "ce22feba-92db-491b-9982-c758d78c0d44", "value": 414208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647827910, "uuid": "a608add7-ac27-442e-b6a5-103bca103f3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647827910, "uuid": "0918d84d-93ed-4571-8825-75ec2cf6ee8c", "value": "5a50d1389cf1589d90d36d11c37aa677", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96d8364a-a8e3-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647845598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845598, "uuid": "de3e227c-d2d7-40ba-a561-fadf13337ef9", "comment": "Malware payload (AgentTesla)", "value": "5e639fa1eb21dca58a3cef5b94c42a95", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845598, "uuid": "513537b7-3095-46ab-b61a-251590a5fb29", "comment": "Malware payload (AgentTesla)", "value": "a7474c79b6c77ab22ce14784f8b6801f7a8c8e8e3994f06c1e40ef2a9b4a8b6e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845598, "uuid": "261a4580-e6cc-4d44-a2f8-de87ae1aa100", "comment": "Malware payload (AgentTesla)", "value": "3ccb33553146ef27fb46ecb1fcf86d66580dcce4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647845598, "uuid": "6ffd2488-abd0-40e2-af27-9d2d147ebffc", "comment": "Malware payload (AgentTesla)", "value": "d77dfac5209432f7bc0a6376a4569b64b40135afa05cd23f6225c899e91d06c53aa7fa9ab6cd74783b6644367e642926", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845598, "uuid": "e63a5374-6d8c-4c82-83b6-82d7d018f778", "value": "T18EF1F900DBD84B36EFB3477258639781C334E362685F9F5F2488125E6E123E90561FE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845598, "uuid": "b6266462-e1a9-4b5a-a292-ac95547bdb71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845598, "uuid": "e189fba9-8d88-4098-98f3-9c60556b78e7", "value": "192:ZKHoXXQ8j6qtL1iPbLZl0QtOVOeE4zPl9:ZKHonQE6EL1izN22q3E4z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647845598, "uuid": "f65f9dda-bc83-4f58-88fc-cbee53776221", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647845598, "uuid": "304c85ee-3365-46d0-9fb2-dcc1d1398b75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647845598, "uuid": "e719631f-1e39-468d-a564-5e0f1f5c24be", "value": "DHL Delivery_BL.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e98c28a7-a931-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647879237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647879237, "uuid": "e7111d59-f858-4922-8172-55d9c7361e0a", "comment": "Malware payload (RedLineStealer)", "value": "b3884930cc3286499ee035e4c71d2333", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647879237, "uuid": "4a3e7102-554d-4e58-8b1a-5d753f275e48", "comment": "Malware payload (RedLineStealer)", "value": "a74f9ed962019491f7d2995e4c03ace954c0d4bb81cddb3e79cedd58c40dc6f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647879237, "uuid": "6a86aaab-51c3-4a32-a74e-ff08fe7cc332", "comment": "Malware payload (RedLineStealer)", "value": "d1742fdee0063bc03e9ac7e5dfdf0eff670d65ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647879237, "uuid": "37fe876b-c9a4-444c-bc76-3f2f437235f4", "comment": "Malware payload (RedLineStealer)", "value": "491ce06d34b5244f384e4bdbbff6c8caa5de4f942bad21273da8b320c1a78bb810ff68d132787a937cfde5a169417128", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647879237, "uuid": "c98ad3e8-04ed-4b83-abf6-f659c31b7da1", "value": "T1C315222356B7BA52C0B9703C82EF9975AB46BE50754B4FB7C32C302CD97D6116B1A883", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647879237, "uuid": "05e718c9-b529-4a80-94d7-2932522f8c8d", "value": "970b2366a571046cf63ed113531746fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647879237, "uuid": "6f90741d-c4bf-4797-a5d1-15952a783d7f", "value": "24576:BZfd6yZ0JvkdI5clSx4OTAiuodachtBxcMmBWL:BhduvkqSypccDP5mBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647879237, "uuid": "ac90b1e3-64b6-4882-9bf0-3f6ba53a354b", "value": 888064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647879237, "uuid": "eff57f66-e067-4f20-924b-575bf8280844", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647879237, "uuid": "aac7eb15-f39a-4951-b467-f264f638691c", "value": "b3884930cc3286499ee035e4c71d2333", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deda2fe4-a945-11ec-9275-42010a9c0029", "comment": "Malware payload (Hive)", "timestamp": 1647887809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647887809, "uuid": "6d59dea9-4ae1-4acf-b69b-818d37e2ff2e", "comment": "Malware payload (Hive)", "value": "92d0366537308d4b6e0ca530f49adb6d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647887809, "uuid": "46d39ed1-e304-410b-b785-6881e12a06c2", "comment": "Malware payload (Hive)", "value": "a77afefb588db0b105f4c7dca156dce1abb413a3e5807f45b9bb61dd55215779", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647887809, "uuid": "8eab656a-f929-45f7-914e-42da895f15cf", "comment": "Malware payload (Hive)", "value": "064af3141f95c53ebb49b8eeb72839d80b151a05", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647887809, "uuid": "63a78abb-cf3d-4407-ba86-ed0dc32fe378", "comment": "Malware payload (Hive)", "value": "b36c123bdd81a3d17bda6c5b5d488beb72520dc254e603dc2f6d4e5467da217e57ac7e13c5e9e33fb94508054616e088", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647887809, "uuid": "997079f8-2605-4d35-96f9-5992ddc649ae", "value": "T1A4C5D041EF701665E7C86375DCFAC244A3B9CA154253B7886F6840BDB9E829E241C3BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647887809, "uuid": "4ec1e888-db69-42b6-b763-3eddf6fa5959", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647887809, "uuid": "13b17140-ca5a-4da8-9425-da3b6c91fca9", "value": "49152:MSosTfwdPylzoNwAHHxUWeIMVINkufnZ8i1awNcdZmrmF:MSlodKlgw0xUWvMVINkufZ1ncdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647887809, "uuid": "1d3bebbb-340c-4e70-a89e-24d860b80dae", "value": 2647552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647887809, "uuid": "5cbb5c14-e01d-4140-a824-a67e9c763464", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647887809, "uuid": "629b11c5-302e-4f7d-b139-18b20090bbac", "value": "92d0366537308d4b6e0ca530f49adb6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ad6984a-a93e-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647884447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647884447, "uuid": "9ee8daaa-762c-43e1-85e3-13e2629c648a", "comment": "Malware payload (RedLineStealer)", "value": "ad1de0e5c5a9921b0542897bb70d1324", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647884447, "uuid": "5b650dac-12b3-48b0-b156-0bd27a6e03bf", "comment": "Malware payload (RedLineStealer)", "value": "a7af8bc3ff607773d9d99b94cb560f379c4f5456235a7722cf3565c34bf5f0af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647884447, "uuid": "058b3fa8-3c8e-461d-91d5-f4499bb7c929", "comment": "Malware payload (RedLineStealer)", "value": "37388607cd27e7601d87dc345252ac16b2f957df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647884447, "uuid": "d8911e72-e350-4bdf-a42f-c23d86cd8a1d", "comment": "Malware payload (RedLineStealer)", "value": "178f3a1cdae315763c818bb3728486d441b368b610817c861fb3265cd482d6abb9c947f93bd302ab88a75462b17b4ad1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647884447, "uuid": "280f5eb1-03ed-4698-997d-9b231a211c78", "value": "T1B784CF00BB90C035E5B752F449BAD3AC792E7EE05B2554CB62D91AEE5A316F0EC3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647884447, "uuid": "b34f9e28-c0a7-4a19-ad5a-f6da26c31679", "value": "748f08eada0979fa8642d413794a1a5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647884447, "uuid": "35186649-c61a-42dd-a63f-53c3b749f475", "value": "6144:ZGxb85BEBpTsy5nuqnzTGYtgsN8WNCv97MQ3BSx3mwwojy2ySzzo:ZsOBEBpTsyc8zT7tge8ekxy2imD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647884447, "uuid": "0e890c82-8029-4c9c-8721-481b5d20638b", "value": 379392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647884447, "uuid": "d4943cdc-cd33-4d1f-8a70-08106aa18e88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647884447, "uuid": "cb4cf808-198f-4cda-b227-9f5bb9e3b1fa", "value": "ad1de0e5c5a9921b0542897bb70d1324", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e06c5532-a931-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647879222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647879222, "uuid": "79cd5411-47f1-4af8-b39b-e457df023db0", "comment": "Malware payload (RedLineStealer)", "value": "9ed6f7053be5ed5306aedf9c13afd431", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647879222, "uuid": "1fa66356-95f3-48d7-95f9-35062718c1c4", "comment": "Malware payload (RedLineStealer)", "value": "a7ef7c5a5d760dfb846d69d9bbd043274cff0e428c1949d406eda531c0946362", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647879222, "uuid": "2228caeb-6384-4654-aed3-6e80f7b2661f", "comment": "Malware payload (RedLineStealer)", "value": "678e0c340de159d2a67e6803fca3d555d42eb5e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647879222, "uuid": "f945fbd9-aa77-48d0-ba9d-d6e81750d311", "comment": "Malware payload (RedLineStealer)", "value": "7f3379043f41d501e31ee060cd226f58abad5a22a1d771d0de1edee866a346e7598c9d97253dcbc9bdc93612fd8ec24f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647879222, "uuid": "a586dfde-076d-4c6d-bd0f-d45ca89d49b5", "value": "T10694C040BBA0D03DF1B702F4797993A9B52E3EA05B2154CB62D52ADF16346E0ECB1367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647879222, "uuid": "367da6d5-8181-42ca-845d-d5dfb48f59b5", "value": "d626a2a864a52e91dc5f85b5e98029ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647879222, "uuid": "fd4147dd-906c-4701-b9ff-bd263fdb50d5", "value": "6144:v0P/4bUgN/FiD1eURHZgFtDLaCCfi5MyYHGP5QpJiTt90lxk/0AIaoX:cobUgNADcmKfD2xfirsY0Ja0+/TI9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647879222, "uuid": "7b31528c-9eee-4002-ae95-0831e80ec110", "value": 408064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647879222, "uuid": "274c9c56-5b57-4b7b-942a-9ef6a72f9b3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647879222, "uuid": "2c3383bc-6f97-4fc0-a434-1430f89947ab", "value": "9ed6f7053be5ed5306aedf9c13afd431", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b38d765-a8ed-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647849873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849873, "uuid": "f45726c8-982f-46c5-a774-662f50c84051", "comment": "Malware payload (SnakeKeylogger)", "value": "f7a9cdd819a21d7550ea5e1b3f6c5f8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849873, "uuid": "81c63d49-f0f1-4158-8556-2e3dc7f2185c", "comment": "Malware payload (SnakeKeylogger)", "value": "a83758b648bd3ce298c83dd73ed5d699f7a9d8626fa9af9ae1e0f2d4cf59d2f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849873, "uuid": "5bb4a05f-c990-4e2a-a43f-b8a835364e37", "comment": "Malware payload (SnakeKeylogger)", "value": "73978a5f39abf5585213bca53ca5d6481aa03601", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849873, "uuid": "fd6d8922-d822-4096-a819-fde185782ebe", "comment": "Malware payload (SnakeKeylogger)", "value": "fc24e29592484a6dca54fd3cc846d1fb737c7dfa07b24e4162304216b9bc7e6d4889ca7f193ef78c3c506fe52baa9f40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849873, "uuid": "f3c538dc-66a2-441d-be50-2c460c5d0b4a", "value": "T1222523B937B00633C4C98B3260ECF4411B7244AA6506DBB8DCD1F68D0FA67295A79E7D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849873, "uuid": "2e52fef6-2f8d-4732-822b-b5e04c380d05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849873, "uuid": "a151bcbc-96e7-4f77-a305-d60a414bd310", "value": "24576:za/l9Nc/70VCCgJ58Qd/TqfShvowd2435tmMF/2R:za/Nc/70gruQdmfUvowd2abmm/2R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647849873, "uuid": "06be3560-a91c-40ee-aad2-1cac19ac491d", "value": 979968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647849873, "uuid": "70100a7d-8e49-4b33-90e5-bf13e88d8f58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849873, "uuid": "ce05f6e1-89be-42a0-abaa-2443963356ac", "value": "20220321_3339477993743000000,xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba71a490-a914-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647866703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866703, "uuid": "914ed8a1-3a2d-4148-b0fb-dff8e2ca17e3", "comment": "Malware payload (Formbook)", "value": "051f219b60f28e5f80409678e96b0b45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866703, "uuid": "775190b3-f2fe-4f9c-a8de-e2b3f1378097", "comment": "Malware payload (Formbook)", "value": "a84f468ab3b6b02a23528d874338ac770d2dde41f526995308eb2db3d4158cf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866703, "uuid": "4b051625-5362-4213-82b9-5290284b381b", "comment": "Malware payload (Formbook)", "value": "bf07504270d0ad9f991ffa7b9f35467afa833220", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866703, "uuid": "fe928488-6c59-46c7-b0b2-82ddc0128c43", "comment": "Malware payload (Formbook)", "value": "1b30809026270c129a832467ca1479e5c757d1bcf1a38b94807f28cc4c31dfdf71738711457ffa85e467e9bacf83dca6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866703, "uuid": "fce9297c-7ed3-46af-9a3d-c65e096bd3f9", "value": "T10A64120B51C1DAFFD9C219B80AFBDBAAA3BBDB85135204676F342CB53C6295F4C05422", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866703, "uuid": "07fae566-f7dd-487c-9036-c48bd283399c", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866703, "uuid": "fe24626a-50a4-4114-a966-df0e419968d7", "value": "6144:rGiDE5U/HmX1Ag8KVRfGmNaWDv+JDr5i9LfQgToRazViEw5wIMDw+cYGZZskz1dj:vE5GH286RTfDGNA20oM41hWwoGo219", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647866703, "uuid": "f1c31885-2bf8-4959-b8f3-afbfbf490a4f", "value": 307733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647866703, "uuid": "0b280b5b-44f1-483f-af86-02b96921fed0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866703, "uuid": "037cfadd-615e-4f38-adf8-765ead1dd42d", "value": "rocce468890.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054fee6a-a95b-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647896893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896893, "uuid": "6d5f0017-5774-476f-bcb8-51045e744dae", "comment": "Malware payload (RedLineStealer)", "value": "546c62e3796d03b6610f5e813a12378b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896893, "uuid": "2e21707e-d7c1-4e55-a6ca-1d10247842c9", "comment": "Malware payload (RedLineStealer)", "value": "a866fa02bf6f9324d6f3713ed1533e4f0262a29a50ab0734e03fe6ed52df11fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896893, "uuid": "876bdd7b-1d03-4d29-8a9b-59e0f77803d9", "comment": "Malware payload (RedLineStealer)", "value": "c85a3ad4dd04eba2d2f9f347aecbb178b303643c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647896893, "uuid": "57b275c0-f737-4a3e-8868-9daeaedaf63b", "comment": "Malware payload (RedLineStealer)", "value": "d26e2c2e853f7bc17e82e43a78ca0c6e0c31b0d65d33053bfe3543a5b709fa3d2fc0efca15f51f6aa57346273bd1b6a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896893, "uuid": "95739ad3-8a93-42c0-a179-7e744d88a116", "value": "T17EC423EA9B428A99C11CC2BC1B557C6501EB5D7AFCF0B507D52A0B4660BC832BF342F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896893, "uuid": "a909d825-5e4e-44cb-b17b-68e7d4cc1bad", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896893, "uuid": "424cd8db-4805-4317-8207-e876c81ea41b", "value": "12288:LxHGE7/iuV8WYX3lEAlBw7ltQS03ULaHNqrxlKIQNokI1mcOeOvqlPd:n7/0XSAlBw7ltkEaHNYK3m1ZOeQq3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647896893, "uuid": "1d7bf738-e9b5-4103-90b0-df3a88adb29f", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647896893, "uuid": "1a5f514e-8cee-4352-bf8a-d1d4c300472f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647896893, "uuid": "115bbf4b-373f-4d3b-b3aa-2cc8a912c082", "value": "546c62e3796d03b6610f5e813a12378b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4bb0a7c-a8e0-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647844359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844359, "uuid": "f006de96-8a3e-44b6-8b21-84c788b9be43", "comment": "Malware payload (RedLineStealer)", "value": "8218c5cc21813abcd1171e410298bfc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844359, "uuid": "bf805558-f3b6-4c6c-9e2d-94bdbebe7fdc", "comment": "Malware payload (RedLineStealer)", "value": "a957723aadbaa9a920336bf0fa52211a2346ecdaab70d62a0755d1676b500169", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844359, "uuid": "c2b09c5f-59d3-4beb-bbe3-dd74fe3b3caa", "comment": "Malware payload (RedLineStealer)", "value": "42b2971ca06535fdbfc16fe1d92efda0bf741595", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844359, "uuid": "d14b24f4-d994-460e-91d8-21b83668609f", "comment": "Malware payload (RedLineStealer)", "value": "f8cd0d954ff5f5a89ee9926b77dbcffe606ba0af6bd0cbb795db27624b88c0643efb846d3bda7c9cdbf0fc01d4f7aad3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844359, "uuid": "3eaaf0a5-6637-4bf3-bcad-0ff96fdfdb32", "value": "T16536338F6BA18E57C1374EB0A7BBDD09C09F5C7A44CE3595D4F0AA8A8D73822CE41674", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844359, "uuid": "4711dc5f-9802-4116-bf4d-7181759a586b", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844359, "uuid": "a3acd8e8-28fd-4618-bb35-bbcba8b6d668", "value": "98304:05Osl5H3WISxQh6VfhPJZBA0vtagTxWaMTcO8h42J2wF7Ni:1K3WISxQ8bPvB71xTx+w5h7cwFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647844359, "uuid": "d4380746-7ceb-4031-86d1-e0f5001d46ca", "value": 5011912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647844359, "uuid": "1d6ec2dd-497e-446a-aae0-75339a6de0b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844359, "uuid": "46bf6175-60f7-47bd-bbc0-122bef49a13c", "value": "40779653.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40298e36-a8f0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647851036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851036, "uuid": "d5e2dbd1-173d-4885-b415-640c923d22af", "comment": "Malware payload", "value": "8d35b1dcd7dc327db037543cc2eee7a4", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851036, "uuid": "159b04f2-7b6f-4802-ba0f-f44e0abf1973", "comment": "Malware payload", "value": "a9fae03c03ad93f8ceb0b757d403c49e543723bea30519db2f133b887ec61ee8", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851036, "uuid": "f25ceee8-c9f2-4b10-ab44-7edd66c7cbd7", "comment": "Malware payload", "value": "1a3ecc122844c276f06c711cde3677fbcb59c98f", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851036, "uuid": "587d1678-e613-4771-9895-12a4e2343637", "comment": "Malware payload", "value": "7e218d899afba041d9ec24b02ea88f964c2efbbc6fd2ef9afbc9b8a6c767cbd4787a65f178a68b9788985e026304d51f", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851036, "uuid": "c24cf1ee-c9e2-4252-819d-9a994ccf1789", "value": "T1860412813F58970BE49226FC44766B9AC11BEC10E644860C2C0A7BDF9975E8BD7CACB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851036, "uuid": "5020b124-d70d-438e-8388-8e6c11e5748d", "value": "3072:GtWlkUxsDhbxjPQb9WeOC7yiWF8WY04sI1w5YjBhktIAr2c89S/bifgMzhHAuwPt:NlXmTjPHY44sWw5YNYTP89Imd1Apa8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851036, "uuid": "48e49d9d-d1e1-4f05-8147-4afb94a116b4", "value": 186424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851036, "uuid": "5d19b304-cd53-4c92-81da-ce78f1c6bdff", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851036, "uuid": "6689c774-8774-4857-9f58-8f17bbb631b5", "value": "Preorder20220321-789.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a695d1fe-a8e0-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647844336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844336, "uuid": "57156e42-237d-42a7-80ac-97eb933e78c9", "comment": "Malware payload (RedLineStealer)", "value": "f728a6fb28ce63562eba896ef9341318", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844336, "uuid": "55d749e0-fea2-4509-8bf7-fd2d53531123", "comment": "Malware payload (RedLineStealer)", "value": "aa13d099e8dfd198b840eb6ac8aeac05f829fca2b2a68d56b8d7ecc206d613f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844336, "uuid": "37022014-22df-4fa1-8b2d-ad2b21db8f23", "comment": "Malware payload (RedLineStealer)", "value": "068ecc6b2bd8db6cfb7bfab852a5ceba2d9a96a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844336, "uuid": "5dd5495f-51e4-4ffd-8428-38ce01a93720", "comment": "Malware payload (RedLineStealer)", "value": "6e88c5bbbe1dad7c72be132d1618876655d03042eb40b1d43adebe9a30cce3b025be37d12597d239a164c30b3f4c9de0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844336, "uuid": "853b86ad-04fc-481e-b914-9156cd0992b9", "value": "T16A36334EBF219D04DF0EA1FC07759C32CA2E236210E6522126FBEC7C925A477975762B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844336, "uuid": "30365db2-b661-40d4-a474-0d78c41228d2", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844336, "uuid": "8beaaab2-b131-4fc2-8eef-978c5871eab3", "value": "98304:ioAqkXloeawIlg/fKcHWFVm7Ph2aaFe6GfzUnAB+ehYx:iJqslRaw/fZMVm1ge3dBtYx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647844336, "uuid": "4c8acae6-2342-4cab-8226-2381fe6ac549", "value": 5017544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647844336, "uuid": "fe02ba3d-6e2b-4e76-bfcb-53679c27f9fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844336, "uuid": "8f5aa99c-f312-497d-8a14-67d19ec76480", "value": "73045318.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f750f7-a902-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647858725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647858725, "uuid": "b6c65136-c843-4ee2-b205-1959a43d7568", "comment": "Malware payload (Loki)", "value": "f92da4f7bbe76a682107ed2998c62c20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647858725, "uuid": "81a53629-5237-4848-b504-b258fd44cdcf", "comment": "Malware payload (Loki)", "value": "aa24ec4d75449a623095a651897f490584eb9a129d38762676c907c96fdf946b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647858725, "uuid": "25874449-081f-4975-9952-135e234f58b5", "comment": "Malware payload (Loki)", "value": "6b5bd3b392bc32c665d730e67fe87812292d5f85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647858725, "uuid": "8c38f973-6f80-4703-8a33-65f2d5713dc0", "comment": "Malware payload (Loki)", "value": "2a6c3405abbdbd648b053c3f7ec651732dba33c0cfb921765e767dcb276a27334d9e737a2d8986b7b84b1b1cd8a0409a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647858725, "uuid": "f0e47179-ea9e-4d53-9d2c-06fffdc9e489", "value": "T166350270EAEBCCBAC0751038907096110D72DFC65A03EBD8609D7E3DAD35743AA9A57B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647858725, "uuid": "13de8b18-89af-45c0-ab52-c6d73d9a1fa7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647858725, "uuid": "c016ce4d-7267-4c52-8edf-13230af62d8f", "value": "24576:mdc9xBTJzDxLSiH5+KOUWG4IgvRtTYld6OvYss9NUdog:mdkxxSEXVWG4IyBYldNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647858725, "uuid": "59473849-f896-45b3-8921-d2c00557b10d", "value": 1095680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647858725, "uuid": "24f0fb8b-ed14-4857-8f4b-c5dab9add8dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647858725, "uuid": "31c74e20-9407-482b-b1fc-43ef27349eef", "value": "scan copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5bac9f5-a947-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647888653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888653, "uuid": "f2e60eef-4d35-4905-a6f2-fc73cfaaf1ca", "comment": "Malware payload (Heodo)", "value": "f6b2df56faeec7219c8ab638abd3d257", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888653, "uuid": "f051b1d2-6530-4f8a-9617-780c90f8333c", "comment": "Malware payload (Heodo)", "value": "aa4ddf83c7614c7fce7282ea8d8597c78bf2ea628f529a9b983ef512e40faac1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888653, "uuid": "7a06d1fa-4881-4091-bb8c-15c229066746", "comment": "Malware payload (Heodo)", "value": "b393f1b8a73ccaf6e0c25f18dbdff3b1c4d9d1ab", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888653, "uuid": "77578544-e5a1-4080-a69c-3a1a4d25eac1", "comment": "Malware payload (Heodo)", "value": "9cf1a8d2b70de6ceba671b905213c86d32bd9c519d72fdfac512bfa3c00e5da84d2c4a9768bd0a4628f2086a3b613cfe", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888653, "uuid": "bfeaef0c-701f-486b-a6c1-144d333e4036", "value": "T187B43A11BC916832C36FAC7456073262588EE7F0DBD1F26FA3E0495C9A7C5E36624BC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888653, "uuid": "df49493f-77b3-450c-9176-b24f9aec2dae", "value": "14e6ae8d1400b6271725b3f01025b85e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888653, "uuid": "18197e9b-fb10-4d00-b445-cdbe2f427c95", "value": "6144:VikzyaB9eoCyx/mEhHB5RYSJ/x3+qiCjzQNPj79GkqbscgCG5qH6scI:VNnCGmyHB5SSJpK0zQN39GkUGQSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647888653, "uuid": "bfb90568-6678-43e8-9442-2620a0713999", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647888653, "uuid": "ab3e856d-e12e-4485-ac75-52f71ac2c1b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888653, "uuid": "eb9b2599-31b5-4a27-84d3-e13963b2cd88", "value": "emotet_exe_e5_aa4ddf83c7614c7fce7282ea8d8597c78bf2ea628f529a9b983ef512e40faac1_2022-03-21__185044.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3812133-a8fe-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647857269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857269, "uuid": "7e7492b2-6c9a-41ca-b430-d1221b5f6514", "comment": "Malware payload (Loki)", "value": "35e2bdf8ec69f9ca0bca535197a729de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857269, "uuid": "d46cd73e-2bf5-4beb-b339-9e04e6f32e62", "comment": "Malware payload (Loki)", "value": "aae4511c45c0254617b6fd19162092c32773bfbba5bbc406af64e782aa1f06dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857269, "uuid": "aa6c3e44-b004-4f28-89d2-e45b07e4f355", "comment": "Malware payload (Loki)", "value": "6992f51d8e4e8dae62bc2f6478a4adae7f9eba34", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857269, "uuid": "ed4c212b-53b2-42aa-8c8c-8162fc3fd1ff", "comment": "Malware payload (Loki)", "value": "09523aa838e43f9a04b9ddd146727996dce9750fd18f87e4b1d616680f64cabe5f82bcf1628016296f47c7ff46fe1780", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857269, "uuid": "588d5ce8-4852-4120-82d7-71cdd0ea9e80", "value": "T19054238266C08AD7CD5148B627F33B7EFB7ED144C2A03E670B687D36EB521C5418A49B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857269, "uuid": "46fb2e2a-bc6d-414e-b91a-afabf445622a", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857269, "uuid": "61b6fd3b-528f-4998-ab60-5b21d7916524", "value": "6144:rGijQ566Gy2U5HYwYlXoUAMyrn0lXqVZG/fq7DDO7wOL+LnlJk:Q5fGnrPR3AAqVU3qVOOn8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647857269, "uuid": "4c2283f3-e208-41cb-95ba-f2c58397b9db", "value": 303029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647857269, "uuid": "0110de41-dff7-4ea1-9bfa-dc1dd14702c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857269, "uuid": "395539bf-7b05-412e-9197-bdaa590023a4", "value": "35e2bdf8ec69f9ca0bca535197a729de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d30552ba-a8fe-11ec-9275-42010a9c0029", "comment": "Malware payload (Neshta)", "timestamp": 1647857295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857295, "uuid": "25ce7527-e7f5-4c50-9332-0422243763a1", "comment": "Malware payload (Neshta)", "value": "b76136e1f5090ad436a051892b6f2c5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857295, "uuid": "f8b144d0-e7ba-4bcb-ad66-3b24a4404017", "comment": "Malware payload (Neshta)", "value": "aae66e4930de3e86e7a4095dbba08680278f96f570a0d116e4616c12492a3073", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857295, "uuid": "d63c43a2-26a5-4434-a7c9-4339f5dadeee", "comment": "Malware payload (Neshta)", "value": "6e032202767689816fc40c43bb5d6049a2688e14", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857295, "uuid": "00b79b59-e88e-436e-8b69-8eb54c672992", "comment": "Malware payload (Neshta)", "value": "77cc3a0c06f31ccc22f250ae1c417168eb000ba08c96710eb3f6c9ae063d8300d78e19071d8f452ffe5d108327f2d2df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857295, "uuid": "118092fe-7d66-4500-918f-9c6c5afe0d14", "value": "T1126418B2FA51D235C8151E34D51786F84A239D61FF20A8AF7A9F3F2A3B323C6502515B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857295, "uuid": "f6d9fbd6-6bfa-4aa6-891c-a4d91e3ca5c0", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857295, "uuid": "c850080c-6114-47dd-90c5-21d82a1fad4d", "value": "3072:sr85CX6JcWUg3HxfMZTSjajSk9AEoDfTW17cFmX4U:k9X6JthflW1ATa1o24U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647857295, "uuid": "5236d6d9-7280-4209-885c-159cb880775f", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647857295, "uuid": "20af172e-ecef-4048-a883-a0acd167d089", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857295, "uuid": "56930086-795c-4240-b3b9-a7a61fa40ae3", "value": "b76136e1f5090ad436a051892b6f2c5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bc41184-a8aa-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647820883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647820883, "uuid": "b291d3bf-08e0-47e4-8763-f12936a61843", "comment": "Malware payload (Heodo)", "value": "cd8149dcd9098ffcb4073b37b6363738", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647820883, "uuid": "152c925d-445b-4f5d-ac5c-b8acf0de0006", "comment": "Malware payload (Heodo)", "value": "ab273081cdb34b8bcdf42a3824002a6e5c492cab33ae94013b12a892f3a78f4b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647820883, "uuid": "e0ae60fc-fb69-43a7-969a-e615816efa0b", "comment": "Malware payload (Heodo)", "value": "953236493253ee7eec775f82651480fa4542f181", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647820883, "uuid": "0672b25e-19c5-42dc-a2f3-68c3a4a1ac26", "comment": "Malware payload (Heodo)", "value": "2494f9abb9c5527cb6d17a127446fcb81e56c7c4a576f59b0f28e5514231ff0ec467efb285ddb64158adec8f27a0829f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647820883, "uuid": "5e46e19b-9334-4f89-8c47-cd86a3f7fc12", "value": "T142B43A317492B279C2EBD73408A35275B21AEDF157E274E36EE707CC4B366906E72602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647820883, "uuid": "5a6b4a38-027e-44ed-af6b-9ff4de28d61f", "value": "55cf9ae1e74cef637eafd17181390202", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647820883, "uuid": "158a240d-b55c-49a9-abe5-bea9cd658087", "value": "12288:7FFCpYDLbBHqKK85H3jw2VlMD4zeSvturG9+:7VDLbQKHVlMDOtv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647820883, "uuid": "75571752-d9a2-4662-b0b5-e83b5979f634", "value": 516096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647820883, "uuid": "82d0ffa3-5638-4307-bdbf-e0d7357c0376", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647820883, "uuid": "b1fd5cb6-4076-44fe-aeb3-c09fb54edfc8", "value": "emotet_exe_e4_ab273081cdb34b8bcdf42a3824002a6e5c492cab33ae94013b12a892f3a78f4b_2022-03-21__000119.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c1d7cc6-a943-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1647886624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886624, "uuid": "b1064518-f326-4563-b41d-d9af7f311d2d", "comment": "Malware payload (ArkeiStealer)", "value": "c51f4979fd499a0439862f0568f9b7fa", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886624, "uuid": "7976c387-6d1c-497c-b864-b0f9fcd02f79", "comment": "Malware payload (ArkeiStealer)", "value": "abc7f395229f5f05074280e01c2e3726aa409d14c0a43ddf52a0368d53462747", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886624, "uuid": "0d939c69-f91e-4340-870d-745e26f1ccb7", "comment": "Malware payload (ArkeiStealer)", "value": "341608fbbf8d58b22df7f7ecbc8fbae5e5dfbb30", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886624, "uuid": "280fb0ce-30a8-404f-a24e-25e97fcc7fa5", "comment": "Malware payload (ArkeiStealer)", "value": "73e23357265dfe174c2f3f1fed904663c50babe4b13a35d147ffcf0c374ca8ebbf6108ac51b0678c8e2a5344a6e82fd3", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886624, "uuid": "d2390fdf-4b11-4e56-ab28-568e57ac90f1", "value": "T16E368B385B09DD78ABD70232D06B751F24809935D6CFB08F379A0DC1AA8BDBECA9D445", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886624, "uuid": "1e617154-4553-40b2-9389-ff9dcbb13629", "value": "99c2cae0b7316add27de679470515124", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886624, "uuid": "3fe21ac7-aabc-46de-88d0-e7c7df7c69d0", "value": "98304:e+HSkNTNHweK16eii4Jeov1xpvaU447SGakU8quJ16jNVv1Wn2Xp8A6cCVk+bpTU:x8KivKVN16jXdg4p4R4b+bNxpxpO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647886624, "uuid": "a9bc8884-72c5-4d97-9c54-60b785cf6d4f", "value": 5210624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647886624, "uuid": "d6adfd67-d8ba-491e-bbb2-07d268c7d761", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886624, "uuid": "6088fa49-5646-455f-a509-e2ad32de4155", "value": "SecuriteInfo.com.Variant.Lazy.153959.1490.17744", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "048932f4-a92c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647876706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876706, "uuid": "9941978d-0be7-43a7-8d66-05922cd8cb2d", "comment": "Malware payload (Heodo)", "value": "7c2d4330dd2f4b76ec6d84961b6f0c60", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876706, "uuid": "90d6fe1d-74b1-47e6-91a4-2f94ef5a3389", "comment": "Malware payload (Heodo)", "value": "abf22544584af1250a57accf2ef2ac0bbce121c4b5c4cadb1ed5bdc403e3cea9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876706, "uuid": "b9d29096-ba4f-4b5a-8c52-d1b069c33919", "comment": "Malware payload (Heodo)", "value": "9a4f4cbac5baf912a2a3ff1f9678be40cd84f0cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876706, "uuid": "1b111504-07cd-4c19-a43a-3484a7cf3e41", "comment": "Malware payload (Heodo)", "value": "7cec77099ccd34994c02ebc0205541906e711b53edb8bb02ed0c7c9a313bbea62014e50a1ad2e04173f87ea9596394bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876706, "uuid": "6a031c73-91eb-4e64-a484-00e2d0023c0d", "value": "T1A6056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876706, "uuid": "3ba69fab-14a5-494f-8441-8eda46019ff9", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876706, "uuid": "60465834-f33f-4079-b65c-fa63d1123037", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rr5CGNHrH2tZ+d+:gMV/rr5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647876706, "uuid": "d3feaaa3-9004-46fc-83ec-c3fd62e26215", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647876706, "uuid": "2bc28781-c843-4968-adfd-03894599741d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876706, "uuid": "922d86f8-c426-4b5b-a345-25abed33ffaa", "value": "7c2d4330dd2f4b76ec6d84961b6f0c60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b5c6820-a94e-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1647891374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647891374, "uuid": "8979a109-1ee9-4e91-bf82-90c0f10337d7", "comment": "Malware payload (Smoke Loader)", "value": "455cb020d680db664dec42e78f3feec8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647891374, "uuid": "5036ceea-77db-4728-aa74-b598b856a0b1", "comment": "Malware payload (Smoke Loader)", "value": "ac0dea39e31162e552ee9ff40052c5e7e985dd55f065321fbe54e3fc1cc7fb82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647891374, "uuid": "da0120da-bd73-418f-8e3d-4cca0ce281cf", "comment": "Malware payload (Smoke Loader)", "value": "0aa46d8fbc79e5a2716f363a25900bd408351991", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647891374, "uuid": "75297cd9-75f0-486b-9627-6409933eda7f", "comment": "Malware payload (Smoke Loader)", "value": "8ad63983ab9066ba4e58ad6fa53751cd71a00d451354f9d2d1e9e113dace8bea0a019a3e6b86b89d03b0dea2ad834833", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647891374, "uuid": "812c6e89-86d8-4eba-9b40-f24704c6220d", "value": "T1DC549E50BBA0D03CE1B702F8797A93AD652E7DB15B2061CB22D26BEE16302E4DC75357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647891374, "uuid": "c482262c-10d9-4883-86a9-28fedfb28d54", "value": "4afe698a4ff3f157978858a4a5de1db8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647891374, "uuid": "0b1280b9-8f2a-4c69-8953-201eb660b45c", "value": "3072:4f77SiD6bN0QfZY3W/AGTohvgJnWC/d7MJjA/qsaTLtUl55bdr9omY7JUMjDiBfJ:AQ0wZYG/AOkgt/RMleqsmYBeJMfSj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647891374, "uuid": "917bfe04-84de-4fd9-8550-f0a673833be0", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647891374, "uuid": "6fb18423-e253-4c3a-85f7-a89562dfd2fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647891374, "uuid": "aa6630f5-6f7f-466e-91b6-98c4091b0991", "value": "455cb020d680db664dec42e78f3feec8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae3d497-a8e0-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647844236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844236, "uuid": "6565fd81-9b1d-4de9-9d1d-13b463c02be8", "comment": "Malware payload (RedLineStealer)", "value": "df31b02e39e38fa509b6f3d0c34bec05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844236, "uuid": "3e4bf720-aa87-43eb-b595-d7d1563d4f80", "comment": "Malware payload (RedLineStealer)", "value": "ad6a553ee500b65c2505e2e491158fda354667a516e3e0693fe66ef7b4c00a1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844236, "uuid": "602056e7-2b2d-42c5-8a8a-e0e80d3fcf7e", "comment": "Malware payload (RedLineStealer)", "value": "511658e8ceb5a0f86e5145dbeeb2ad43c8e656fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844236, "uuid": "096e5f67-19c5-496d-8f1d-7ebd73f5c363", "comment": "Malware payload (RedLineStealer)", "value": "91ee2de56ee112de5048959db86640b12e31f6bf9855aeafdd33883b651770c284bf371c5c68c0f692ee2c1484e8ac3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844236, "uuid": "6a276408-837f-422b-a559-5d6245d80c8e", "value": "T16916339E28DD7C82C0588B7860BD2CCE17DEBA6791849D7E6119078ECF90720AD375DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844236, "uuid": "1bb5dc34-d02e-45c7-8bda-a1361ef3177f", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844236, "uuid": "d416eabe-2a76-4304-b17f-37b40202c58d", "value": "98304:AafEKEZ0kOBp9AV3MKZepB+6z7b2mTudXQWXaPQZ:eZCB3ARMKIp+m61XaPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647844236, "uuid": "edc8db55-aab1-4f31-b78b-b58b5084bf7f", "value": 4176384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647844236, "uuid": "ccc153e1-1c4f-4c18-a2eb-c7b098cdcd00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844236, "uuid": "7c636fc7-6a65-4b53-98d0-ec79030ade40", "value": "36501328.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08621d73-a911-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647865116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647865116, "uuid": "96238c7c-73f0-4c20-8cf3-c37c01b22a8c", "comment": "Malware payload (Loki)", "value": "677fb0ebcea870a7bfbf484522805920", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647865116, "uuid": "2ccbdd7a-5348-43dc-ae12-52448e24d84e", "comment": "Malware payload (Loki)", "value": "ada1ced63f8bf083fde0b13bf6a498eb41bcd8a232d4c5755a71915bc32c746d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647865116, "uuid": "c176217a-41b8-4596-9ff9-05aa4f9cbd5b", "comment": "Malware payload (Loki)", "value": "51aabade1474b00740e681850798c26223d1ab80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647865116, "uuid": "d09ce162-4344-411d-9ae0-874ad2e98daa", "comment": "Malware payload (Loki)", "value": "1243d4f91894fd6f03c7576927255af84511177d357dfc4d6393d8f0e61954868ead287c61548dcd079f991b95de27af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647865116, "uuid": "a880d13b-f06d-40aa-ba28-f8700823508b", "value": "T1B4341303F9D46D67E0C244B50AB2FF6EF37B8AD44E691F830FB80F9B29711924A15952", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647865116, "uuid": "33c6098d-0d4a-4f0a-8071-4b31dc0af34b", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647865116, "uuid": "be8be0be-d184-42da-8138-a0ee5cc59805", "value": "6144:rGiqUgf6MgWhNU64XlPkz+OdJ5raGGhMX59:FMth1SavJtG2Xb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647865116, "uuid": "c19bdac4-1fa2-415f-bd49-de1bcb62baa8", "value": 241308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647865116, "uuid": "e0b2251e-f8e6-4ba4-9deb-51e1d6b5654e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647865116, "uuid": "67f49487-fcab-4f65-8d59-c20b876d119e", "value": "FEB INVOICES.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73af060a-a95f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647898796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647898796, "uuid": "53c435dd-fca9-4e97-b2ab-03c9b78d4cdb", "comment": "Malware payload", "value": "2a1d5b4479f110326b54620aa9ed942a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647898796, "uuid": "5c2588f3-82f1-4ac2-80d8-c807486ced46", "comment": "Malware payload", "value": "ae52df2a8d4cbeae82e2311edcfe035de28df126e962b10009c4ae133818a846", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647898796, "uuid": "b6695b15-1612-4127-bcd1-719e099504b9", "comment": "Malware payload", "value": "0d3c102e461e1fc0d85ffe05d329a2e525666cb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647898796, "uuid": "d7b3a068-44cf-48fb-9c08-86fed25486ee", "comment": "Malware payload", "value": "d22a76adde21a9e5cee281d85994cbf9a7355ec92f1e5bd2ff568d7c45aa0bf8e8c4c782405a5527e6408d35c5eafe39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647898796, "uuid": "05f5dee2-ea03-445f-817e-4eca2c5606de", "value": "T166F2B515B6A844C0E4A5453289E749118A34FC226B5017DF32D17BAF3F337D2EA37AD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647898796, "uuid": "72250a70-afb3-4917-8e27-840d53bbe6a9", "value": "d3d9c3e81a404e7f5c5302429636f04c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647898796, "uuid": "0716501c-1118-4bbf-a472-67af77b1f5c1", "value": "192:9X3Si9YaL0vt5kBmfvTeEUs4vhk78SggGCvgnKExBrOm5GJ1KDJD/oWcU:FbCaL0F5imnTehs4QwKQI1KDWWcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647898796, "uuid": "e6e01976-f9f6-4eb0-95da-4a3bb2709c4b", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647898796, "uuid": "45d3d460-b166-4878-b430-c86aa81d8de0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647898796, "uuid": "2cf6c51c-2435-460b-bc01-389c04bd8706", "value": "2022-01.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "141bca9e-a92c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647876732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876732, "uuid": "5fb819d3-334b-4239-bfea-56df84050d62", "comment": "Malware payload (Heodo)", "value": "fb5f9075588f01db502c1a862e25dd1e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876732, "uuid": "fae2c4a0-e3a9-4abd-af20-08d62c1ef803", "comment": "Malware payload (Heodo)", "value": "ae687ec5c82060bdf4e00480773abec0cfa4062dc8230c3ae116c185ea2f13fb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876732, "uuid": "850417b0-e8ba-43f5-bc53-b5f85feecfa3", "comment": "Malware payload (Heodo)", "value": "4a6dc3186a217e02111ecbe4e1503b9c4476585b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876732, "uuid": "8601891b-357c-4bad-b8ed-75adbc89b4b3", "comment": "Malware payload (Heodo)", "value": "19735c779bb64055ec0a481614d5c46f07bb4df9556247a85a0f3606f028a56443f6d52068674551ceed5baec61cb7d1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876732, "uuid": "9627cb24-ead9-4c43-8856-aa189955dec8", "value": "T12CD34A00F79381F3DC960DF225B2B22FDF6D1E036164EEE583A41F57ADB2245A26994C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876732, "uuid": "f3fe50d7-a507-48fb-9101-d1ecd289fc34", "value": "3072:lzVSb4I0Mx/zZU6yoreQck/IjYBbfR6R7p4d9G:lzVO4NA/mkeQckQcBbERGd9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647876732, "uuid": "ce371db0-9568-4224-806c-a825314425c2", "value": 141824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647876732, "uuid": "d09debe2-5562-43a7-a2e3-c5050f5c71a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876732, "uuid": "aa8520dd-17bc-4175-9083-5899ac74666a", "value": "ae687ec5c82060bdf4e00480773abec0cfa4062dc8230c3ae116c185ea2f13fb.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5492c3c7-a935-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1647880705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647880705, "uuid": "2d3e8674-a028-427f-8016-1188bdc7d0b3", "comment": "Malware payload (ArkeiStealer)", "value": "d790fed581ba982731fc4257763d93b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647880705, "uuid": "365b0f0b-0945-4479-9f4b-749edc32e2ca", "comment": "Malware payload (ArkeiStealer)", "value": "aebfbaf72b832cf446789cedf82459f71587f48b2d44998d64215fafaf4b5fb6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647880705, "uuid": "aac05a98-1ae1-4a91-9f3f-8d1688a2c7c3", "comment": "Malware payload (ArkeiStealer)", "value": "f91dbf1e6e81b266a1cfa1fe307fcd3b9d491b27", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647880705, "uuid": "781068c7-481c-419f-87fb-0d411b098d5f", "comment": "Malware payload (ArkeiStealer)", "value": "9153d47eea43ef6c21396ba23b7b30e85552af810212ac6fea3179a86c0bb0f015825b2855dde68f5eb87e9dbf12b1ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647880705, "uuid": "0d46523a-b393-44f8-91c3-69c2061dd11e", "value": "T161959C0067E49A5DF3FF0B7A3D7C56169832FCCBEA448A4F0938609D1796B4494A4BE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647880705, "uuid": "df886559-0e84-490f-bd9b-f902d1211403", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647880705, "uuid": "12b01fb9-8d71-4fd6-8aa4-2ec51bb86b1b", "value": "24576:DI2D0rREqq6uESr/Fc4ChT2mGyaysKznXth520JVV+3e/NZ44Y48ZO5wM8xV+YUA:M2yg6BSr/+4CT2mGHFKZh43eVuOWOsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647880705, "uuid": "59cd8922-3e56-4672-bd83-4950504bb9ec", "value": 1997824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647880705, "uuid": "992601de-efd8-486e-ba0d-be676eef4e91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647880705, "uuid": "2588eff5-8382-4052-ab5c-26929b4d7d57", "value": "d790fed581ba982731fc4257763d93b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb4cca84-a911-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647865443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647865443, "uuid": "eaed0180-7f00-4384-ad92-441892421c27", "comment": "Malware payload (Loki)", "value": "f1e0d7f5d82edd8e1ff2f501c2d9c704", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647865443, "uuid": "5ffdbeb5-ed2d-43e1-987d-c127bc00173e", "comment": "Malware payload (Loki)", "value": "af54c193b84296aca165ee36e2f4c7ebf1c7bb2c0740099faad17a5f1b26ed1c", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647865443, "uuid": "c2fcad74-3090-42b0-bdaa-924f4cf63f0c", "comment": "Malware payload (Loki)", "value": "072d5bca327e952d616aea46230799b48fa3fff7", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647865443, "uuid": "705e184f-1208-4a88-b621-ef2bed3b1ba0", "comment": "Malware payload (Loki)", "value": "05955b5bf721001615bbb66492f42e33181e67278206e715cb8253387579b7ec1a21297bccd982c61783f106372ea830", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647865443, "uuid": "ce6128a6-0fb4-468b-aadb-614efa85bea5", "value": "T1AF1533B2E7AEC90CBE2B6A512FC7F5BF079DA0FE0D1B763531263E50E5C91A40591424", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647865443, "uuid": "7e9005df-7bb8-40e8-b5a4-0189222ade52", "value": "24576:JUtqehqe7YWEWmKgMk+qZdEdBTZy+6oC5cS5:mkeh/7TEWmKgp+qZdENy+6EO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647865443, "uuid": "586dba82-780b-42dc-b639-6c4b2de195c2", "value": 888967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647865443, "uuid": "c0ec2b73-ab99-4d8e-9e94-68e781a80d0c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647865443, "uuid": "db6e80f7-b783-4350-9972-d553585a79be", "value": "SOA_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b392ad86-a942-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647886448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886448, "uuid": "2d9c4a54-071d-44d1-8941-3c37082ed777", "comment": "Malware payload", "value": "5b63cda540b81c5a1356209083567cb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886448, "uuid": "359cc8a6-bc47-48da-ae35-d4bb4591af3c", "comment": "Malware payload", "value": "af7bcb32cd16f313a65bddd6d04506346ad600c9971eb38760a634c3f2a3c5d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886448, "uuid": "ce28a9f8-0108-475e-a6fc-f278fae2d60b", "comment": "Malware payload", "value": "6d445471765189a19d6245210f81652b7d89c93e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886448, "uuid": "6453f800-de97-485c-9350-0ce617d4a654", "comment": "Malware payload", "value": "c7ba36f10c7c6ddf23574fb1df6bde5607e6ff6cf69e6a84dc4c8bc0b5e198916c2c0006bb79d64353e05459ff7ee99e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886448, "uuid": "2781eace-ea68-49fb-83fe-952ffc104fee", "value": "T12B25F1543F8CEFB9F29EA4F420786584C8976E990AF24024EF3F7095937EF45BA4A114", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886448, "uuid": "398e028b-61ac-45bc-81e9-72e7a6f46148", "value": "b2955b470572ea88891dd6aa35eb0db6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886448, "uuid": "823e59a3-4558-48c8-81cb-7e534549a9a4", "value": "24576:fbsqvdjGxsPpbfPu9IAxFwYdvOtzPJUfkDOnPQb2I:fIcjq6pbfPu9X+uOOkf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647886448, "uuid": "5304f903-d47f-48c5-9591-b823df90b19c", "value": 1051936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647886448, "uuid": "bad97fa3-cc69-4f58-802c-e7ac4be0c601", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886448, "uuid": "86d8f2d3-f383-4024-8e2a-d14b40da244c", "value": "SecuriteInfo.com.Trojan.MulDrop19.61811.25281.28043", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "005ae185-a936-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647880994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647880994, "uuid": "74aae272-d69b-4622-9e05-e58efed608a3", "comment": "Malware payload (AgentTesla)", "value": "da6e79118a4f698de42b4b6ae5a50b77", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647880994, "uuid": "d132ac86-0dc0-49cf-96eb-d762afbe76ac", "comment": "Malware payload (AgentTesla)", "value": "af8af387af3ba995e96d4f2f7da023bd9d137d03f1252670a36bd6a891930116", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647880994, "uuid": "87e76de9-e1f2-4316-9e08-c51f4c74f137", "comment": "Malware payload (AgentTesla)", "value": "59d8b1880f828ad43ab56ddae0197d29428b5b78", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647880994, "uuid": "0b8fe4ce-a8ac-4e26-9651-872ee6b4fe00", "comment": "Malware payload (AgentTesla)", "value": "ff3b96d0a5e25e26e95fb22e0af8443171a5ccb64d590da2557ef91f58914346416dd45dfeafeffbd6ec089a2efd15e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647880994, "uuid": "5d142a71-06e3-4223-8847-1544eb4c56e2", "value": "T10D45E0A021FF5EB2C17B97F1F851BBBA0EE07F08D601D2B9497368C592E6B25353450A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647880994, "uuid": "80207800-dd9d-494c-a669-c57be2419d65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647880994, "uuid": "198d38c0-7c08-445a-9e0f-d19cfd0b63f6", "value": "24576:499FzRbJxz20NG7cr+pnDMl562x0bdY2rGW0y8O542UTY0KCOZ6AN:Q7x87a+9D40dlpUU+OZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647880994, "uuid": "3d722423-dbfc-4043-ab90-54920bf833a5", "value": 1214976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647880994, "uuid": "dab5d104-2e4f-4c38-9400-5acf2ad61cb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647880994, "uuid": "c27662a7-faf4-49ac-9254-441bf8cc65f1", "value": "Consulta de Material 155_2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35cf61b9-a964-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1647900840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647900840, "uuid": "6c187dd0-2cea-4011-abcf-0e342ef1c9b1", "comment": "Malware payload (njrat)", "value": "cd9520e052cb5580d205c485cc419ad0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647900840, "uuid": "72c888b8-f6d0-4f8f-8900-e940bdaed77c", "comment": "Malware payload (njrat)", "value": "b017625071aedaddf14eaf489b325b0bd176fd8aed2d96f7e83c0517588897da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647900840, "uuid": "62adf7ad-6c7e-43c1-b51f-6e36b86e219b", "comment": "Malware payload (njrat)", "value": "9db822398d42451cd36cacd5081a6af79697941c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647900840, "uuid": "48e0268f-daeb-4adc-9e59-261374094e45", "comment": "Malware payload (njrat)", "value": "1f939f331c30d9f48348a8d261e8d3794eb6070936f3a2921f0739430c40921c6f74e6165eb825e95142971ff3b01c4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647900840, "uuid": "c40c2327-08a4-419a-b6f4-833c6cc667b2", "value": "T153033B4D7FE18168D5FD057B06B2D41207BBE04B6E23D91E8FE564AA37636C08B50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647900840, "uuid": "dc2ef785-1d97-4e2a-bd35-711d1521cfe5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647900840, "uuid": "c22f70a1-8bef-40e9-ab1a-f784035c872f", "value": "384:14nM6ikLRxdDsyNyyszHQxvDdy8mkz/rAF+rMRTyN/0L+EcoinblneHQM3epzXvS:ynbeyNBszHQxpy1kLrM+rMRa8NuIht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647900840, "uuid": "03922703-3827-4656-8593-c482a647887f", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647900840, "uuid": "952998e2-6365-4a5b-90a2-24c3ecaaa4b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647900840, "uuid": "42f0b35c-90d7-4e85-bf57-7b570379fc7d", "value": "cd9520e052cb5580d205c485cc419ad0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f033f62-a8fe-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1647857101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857101, "uuid": "820a4a72-d2b2-4a19-a5b9-31f311df083a", "comment": "Malware payload (Smoke Loader)", "value": "cfc2449e51ac4c9fb348f381c17c614b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857101, "uuid": "1aed7fc6-256f-4d6f-9edc-30774940f784", "comment": "Malware payload (Smoke Loader)", "value": "b0a99ef87d4c879d565c8fbb7ea87160ca8eef76b00cc3281d98224a9174769f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857101, "uuid": "8721b749-45fb-42e3-8207-33326afeb3a4", "comment": "Malware payload (Smoke Loader)", "value": "a75a3dfb6315611950bded5d19383d9c3a020b56", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857101, "uuid": "17508f5d-3cd0-48d2-9937-b01549c4e420", "comment": "Malware payload (Smoke Loader)", "value": "4831c4ded18040406923c92f0fd983cc19c679d32dd655df6a2554e397f23e33bda36e9ca940c9f0183102fbd3139c17", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857101, "uuid": "f2ce65ad-1610-4d05-97c4-bb42b5b55fe8", "value": "T18144CF117AB2D873C58655707825CEB17ABF7032167488873B690B3D5F303D2AABA35E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857101, "uuid": "869ca7a3-6f5a-4cb5-895a-0661dcda2cce", "value": "96d1326af78fa7583bdf297d06673dc4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857101, "uuid": "c0e431eb-e639-4c88-a3ce-f98f59d50e5a", "value": "3072:2zXg92AAxsjLEsaG9KFSZ8uQF3KCgo513rRy2B:0KNAxKLEsabFs8hFaE3rR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647857101, "uuid": "36f28344-9ebb-4394-94bd-c065ab74220e", "value": 268800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647857101, "uuid": "d54f6303-6f75-4721-9ff8-8dc6e44d4f8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857101, "uuid": "df9425cf-f74e-41b5-8ea7-da2d7477f1bf", "value": "cfc2449e51ac4c9fb348f381c17c614b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b51f574-a8f8-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647854517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854517, "uuid": "6463eb73-35c4-4101-b672-c5828430ddf9", "comment": "Malware payload (Loki)", "value": "4b6b08081deb43d374a1df4cd657fd52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854517, "uuid": "7bc0a4de-c934-4be7-b877-5d4ffefd7751", "comment": "Malware payload (Loki)", "value": "b116c0085e4c97ffb1493b872a7046048c59d81540bffab94fdca5fc728f0178", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854517, "uuid": "3b875129-3a5d-48df-a3a5-c2667f703f45", "comment": "Malware payload (Loki)", "value": "01a2671e2bf53a118b27e07be66b9e23e63999b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854517, "uuid": "3a3b0593-f90c-43c9-9c1b-eb182f7276b9", "comment": "Malware payload (Loki)", "value": "35473fcfb26ab3505c0a82f56332af4c486b5f6223492b1299c217b3c41193569cb2c4d9330b7c563426fbde7c03746d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854517, "uuid": "0b8d9557-12b3-4ec9-aed0-e2fdd9edb82d", "value": "T1DE341206A6D1B77FD22089F12D7AE53CC3B282F841731D570BB03FF56CA6A42495A636", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854517, "uuid": "ad4ef772-17ad-4cdd-8cc7-4d63b984105a", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854517, "uuid": "bd52a89c-d13b-4832-8680-3c8bcd68790f", "value": "6144:rGit+wxl4kYoqQPmgzZIYeTmW2BIY4wxcNyBu8+lfRY2/8om/:3ikMQPmgzZeTNa/v+lh/vm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647854517, "uuid": "61816c6e-f2ed-4452-a47e-a73a20923769", "value": 243636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647854517, "uuid": "1c413ef1-affb-45b3-b4c7-c8de06798fb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854517, "uuid": "a18e9659-ea2b-4fce-a5ef-ffb213e6c5c0", "value": "4b6b08081deb43d374a1df4cd657fd52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe19b2d5-a934-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647880560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647880560, "uuid": "78ce7653-0f2e-4def-8495-b4edb64362b4", "comment": "Malware payload (Heodo)", "value": "37d1753231dd163143e03fe00946bda0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647880560, "uuid": "c14a1d1d-5e7d-48a9-a74f-3cca3a5178c0", "comment": "Malware payload (Heodo)", "value": "b16b6905e108045b81ad1a9f72b275cc17e106d9932a094d959d32081fbf6d76", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647880560, "uuid": "a57d909e-39ab-4341-9a7f-45972037b4b6", "comment": "Malware payload (Heodo)", "value": "f0a27a625f2285e208416a1b95f1489bdddcc13d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647880560, "uuid": "d3ce6495-f868-4f85-aa50-04b83da5f240", "comment": "Malware payload (Heodo)", "value": "02c6e4258868d78df81e2a9db9273698102b472237533ec6810d0617d989e696b95defa48f20e4e0d4be09805e91e5a5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647880560, "uuid": "ff4decbd-8f5c-4f06-ade4-36cb982f18dd", "value": "T1C3056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647880560, "uuid": "2a02b8ee-0936-45cf-a637-23cc0b56ae2d", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647880560, "uuid": "b7101c1d-f3c7-47ea-9b07-73646a221451", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rR5CGNHrH2tZ+d+:gMV/rR5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647880560, "uuid": "afb3d2ab-e956-4af2-b11f-2c1f798da895", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647880560, "uuid": "1d40d072-894d-40d5-869f-fe0eb8e03ff8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647880560, "uuid": "fb0e7f4e-6864-4f26-901c-c539a8b630e9", "value": "rQJnoE.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42f6c366-a919-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647868650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647868650, "uuid": "780bf018-d537-478d-9b3e-1fedf2c42dc2", "comment": "Malware payload", "value": "ecd71d58ae5f828abf96255ded29afa3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647868650, "uuid": "f976b0a1-6e3e-48f5-940e-74b7cd3c6107", "comment": "Malware payload", "value": "b2156d7801743ac0ea101f7bc3d967e98f716471797241411fd7b9320d23cf2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647868650, "uuid": "01150b60-4fd2-4952-b3f1-f2419c8c0ee8", "comment": "Malware payload", "value": "fdafb78f6fc780731e635eda2a76daca539b2691", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647868650, "uuid": "1fc2654c-d751-4f17-ba7a-f017fae5ed5d", "comment": "Malware payload", "value": "a9b65766fc4c3037f198a5a600312baed698340373b4a72773b4582e067051fd25accc10f7097686d4344551746d58b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647868650, "uuid": "bb10c912-9c97-4f58-ab4e-bf88b73b9c2a", "value": "T18B55CF88F54071DECC1ADB318A75CC3496227CBA5637D10E64CB3E6B7FBE5978A110A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647868650, "uuid": "404a63b8-0bd1-4f79-a8b6-5c33c7fbc2ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647868650, "uuid": "2302e953-4829-4896-a1a6-abc32300d389", "value": "24576:bQlFd9KXktTAPDMUq+3DGgve460AChhFS9zpWJX1q:b4KUtD+37j0zgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647868650, "uuid": "978c1e78-c14a-4014-99ad-7c21c9eb2baa", "value": 1391616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647868650, "uuid": "c40981ef-68e3-4e29-a74f-9230358d034d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647868650, "uuid": "fc796b88-5dbb-4c88-aeac-6ab1fa41ee55", "value": "URGENT REQUIREMENT 3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15c66ebc-a943-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647886613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886613, "uuid": "6649ee3c-94ad-48e9-b9a3-c6dea054f86d", "comment": "Malware payload (RedLineStealer)", "value": "cdec9f81ef5845278cc8b945311269e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886613, "uuid": "32ead884-f5f9-4e73-82ee-36f232455b73", "comment": "Malware payload (RedLineStealer)", "value": "b29ec71330eeb654c585b2ad2c9965316b661eb375c8faef4eb6260dc0c3454c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886613, "uuid": "b930fcdc-8c28-4530-84c9-1b28a9757707", "comment": "Malware payload (RedLineStealer)", "value": "75601014cea3e3b38285f35941668f238a78c24c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886613, "uuid": "afc3ba91-472a-4abd-a008-a710d4b6da2f", "comment": "Malware payload (RedLineStealer)", "value": "a3846f1b2608a6a167feece52d185e5c373fb39482f1dadf05aea439ebd4c93bd57071b318bce4cf6889c1daf86fd58a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886613, "uuid": "f57ab065-1b49-4b6d-b790-13bcd5293a1a", "value": "T19B1633CEA6F28E61E285BE35E405B69C66C14A943B68CC12D3FA01D1EEE8347655CCF4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886613, "uuid": "3a9393de-1e69-4598-ba8a-70c756330b2b", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886613, "uuid": "f7347820-9acb-4357-b59e-1ca2c25279cb", "value": "98304:b9ck4euDv24z95v6H6Fpy2kKAcUjMLdmEtmh7YtfrSS:b99xQec9Qqpy2k7kgMm612S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647886613, "uuid": "d60aeeaf-983b-4d77-86bc-1f82fe8e09c6", "value": 4159488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647886613, "uuid": "a33f4d91-f44c-4c76-be31-45e2f4b34595", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886613, "uuid": "b17a9da8-8d50-42ff-8c0c-6152b5bcb083", "value": "SecuriteInfo.com.Trojan.GenericKD.39280332.17734.9653", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b18a2273-a92a-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647876137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876137, "uuid": "9988bbe8-d610-4514-8d54-7014978e0393", "comment": "Malware payload (RedLineStealer)", "value": "30a9648f1f85ba93054b373454c5cd98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876137, "uuid": "640ee90a-5d0f-4a4a-8e4b-16fab1d3183c", "comment": "Malware payload (RedLineStealer)", "value": "b2a7734032cceba89946cd19fc6a774dd403100ae762ab2f7703071aa1dd112d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876137, "uuid": "809e3da5-f919-4bed-ae15-1ac1ec3d334e", "comment": "Malware payload (RedLineStealer)", "value": "af88348808ab108eddce7dbadec13bad54eecb77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876137, "uuid": "c24ef5c0-caa1-4662-ba5b-3e48ef49c833", "comment": "Malware payload (RedLineStealer)", "value": "a0c827e19c203273cbca591affafcd0f4480d90734d2b0300580ea20de4358a1b805098a21bb657ec048d56f577fadd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876137, "uuid": "b8bbc3bf-a41c-4d6a-b51c-29d9e275c902", "value": "T10794CF40BBA0C03DE07712F8797A93A8B42E7DA15B2155CF62D62ADF06346D0ECB535B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876137, "uuid": "a29fa78f-d7cf-4de7-bf09-c157396073eb", "value": "d626a2a864a52e91dc5f85b5e98029ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876137, "uuid": "6c3407bf-d844-4a06-b8a4-bbd98ddcb50e", "value": "6144:vn/MWgzmBAcROx1PRATeFPjQOoMhFsXnarxP4c/P63u7c/RVC+hUQwV5oX:P3gzmBZO75jBjQOo4KSP4c/+hM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647876137, "uuid": "86d822eb-59e3-4646-84f2-8a37e175c6bf", "value": 408064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647876137, "uuid": "63699c8d-574c-49ee-95b9-89831c076159", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876137, "uuid": "0dc6d699-8d1d-49fd-868f-27fe2f32dbc9", "value": "30a9648f1f85ba93054b373454c5cd98.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91c992ad-a8ed-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647849884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849884, "uuid": "416ee9a6-987f-4a6b-bdd4-e64d9eb5b331", "comment": "Malware payload (SnakeKeylogger)", "value": "a14324f8142cd1b88a13dcd78763696f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849884, "uuid": "9c7091d6-2a65-4c11-8aa8-0bcc7317ab54", "comment": "Malware payload (SnakeKeylogger)", "value": "b3290a3fbb515f16464cc229377af2fb0c4e54764db5be91107523849acec6de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849884, "uuid": "3c20d03b-14cc-4aa4-a1d8-330e5360f9d5", "comment": "Malware payload (SnakeKeylogger)", "value": "e36db93c1031c85a7c272b677a6d5c08c1d3f442", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647849884, "uuid": "e1def38c-4f0f-4aea-aac4-87a2d96b4123", "comment": "Malware payload (SnakeKeylogger)", "value": "36106a8f6a199824a6535dd574d0734b449aa97a9d7742b713557349c053672d3b1b2558d43ad0dc2bb8a5e2999500d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849884, "uuid": "7406a708-5627-4a06-bd12-7dc0d43ecba6", "value": "T112E407B61A559777E937827185014127FA42ACFFB50B8C5AA9837B020D3F5C23FCA58E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849884, "uuid": "f62667e1-2f0d-4c17-bea0-774ac97ab2f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849884, "uuid": "252bd4ea-aac1-4eb9-bceb-712c4d0a63ae", "value": "12288:XDxFtg2xYxmiFlYFhbBofK+Wy/YDgX3yd2OluON4fA9uwkCp:XbdxYxmiXYloxgDs3yd2OluON4fA9uC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647849884, "uuid": "186b8b8d-9fd4-425d-b07c-46d229e43acd", "value": 666624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647849884, "uuid": "4112c631-aac5-4d57-ba11-36dbed4ea611", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647849884, "uuid": "318f2dfb-45d3-4e62-bbdf-c387123fe3b7", "value": "a14324f8142cd1b88a13dcd78763696f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73b662b0-a90d-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647863578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647863578, "uuid": "5fe47681-47e3-46e7-abab-6df4df76ac11", "comment": "Malware payload (RedLineStealer)", "value": "0447a651e88bc290efe5d7e191dbf955", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647863578, "uuid": "a6fcfee7-6aec-4ad6-8b43-f1d793bcd3eb", "comment": "Malware payload (RedLineStealer)", "value": "b3b7ffa196bbd746066f9c393c858805a0906ba2cba11bd20bb66dbd40f90ad6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647863578, "uuid": "e9e4bccd-2af8-49d0-a8db-ca9926b0dafb", "comment": "Malware payload (RedLineStealer)", "value": "47cc5f64bb3cc7cba6388fd09ba8f2e65478b357", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647863578, "uuid": "b0044150-ff6e-4247-8ec0-2991e896ef39", "comment": "Malware payload (RedLineStealer)", "value": "1e85ae097261fadcedbeddc054b8abb81d25e870b0d4d1e7426c061c97b43a449ec37c3eabfefcbf6d5fadf0f57571b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647863578, "uuid": "ff2a9f80-7ccb-4f74-99f4-efa17a115ecf", "value": "T119C42315ABDC3F8DD147DFB4232D3E799964F6799AB8789520AF9201057802FD30E2E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647863578, "uuid": "cd2ee84f-419a-4194-ae50-3ae4435bc131", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647863578, "uuid": "ba4e3b1f-351c-4b58-9252-0927313c1e5d", "value": "12288:1uULR9dECduTRJe9wJ7nYJyFQQS03ULaHNqrxlKIQNoj9M2K5yz2TplSvwdbkI:1uULRhduTRMwJ7napkEaHNYK3oM2KBt7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647863578, "uuid": "310556b2-d53f-4239-bcbb-1c57e8ec6f33", "value": 566784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647863578, "uuid": "f7e838d8-cce4-44f4-99b8-258352cbed15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647863578, "uuid": "4314e16c-aa71-41f2-a079-ba754a3ed5a5", "value": "dora v4.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1d2a35b-a8f4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647852971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852971, "uuid": "2c01e74c-50c7-4a79-b171-7f974be870a9", "comment": "Malware payload (Heodo)", "value": "c8954e4fa0b509a2dc54a270696386ae", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852971, "uuid": "5ab8c84f-c11a-4736-9b74-17b3c118ccc5", "comment": "Malware payload (Heodo)", "value": "b3e0a0ea16a40273d5d639aad8247f7d05d90ed4aa4fa358d4bcc81737364496", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852971, "uuid": "c534d774-e185-464b-ae9c-e08c56c2dcc8", "comment": "Malware payload (Heodo)", "value": "ecef071793a9e73d8add927b7429c814324e178f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852971, "uuid": "2613bce2-b525-4c94-a468-fd0f386a5a3f", "comment": "Malware payload (Heodo)", "value": "011dcd4076da6b5c14e35819f01c32ef963c4c252e070ebf448465b1efd94f8b95dcceb73aef486d9b5c9b163ef3cbc9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852971, "uuid": "e4a02336-1194-4d98-9bc0-84532413bb80", "value": "T145F2AF30F2E29B59E436587C4B8CCAF4C77DDB2252067E2D309E53BC5F126666A4E24C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852971, "uuid": "c4c4bd19-c1c5-4f34-b7e2-9f2c7932221b", "value": "768:KYKtm5eMn7AjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooXLR:KYKtmg+UOZZ1ZYpoQ/pMAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647852971, "uuid": "8f58f2e7-b142-4b9e-ab8f-3b93cbfcd46a", "value": 36591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647852971, "uuid": "c22fab49-64ff-4655-b08a-865bb7429765", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852971, "uuid": "ecfa01dc-931a-4173-9700-cd911702a2aa", "value": "OYR-21032022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bdc9e77-a8f7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647854035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854035, "uuid": "dcde71f8-5f89-4201-8d2e-4ee4d5165567", "comment": "Malware payload (Heodo)", "value": "f1cc88badbe8f45d9635f20409795eb2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854035, "uuid": "e8749857-20fc-419f-8236-d9c79023ad89", "comment": "Malware payload (Heodo)", "value": "b4d3857f11f3241ab6dee09f6553c225cfa869e26fb6c33f46ba8f67dba491c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854035, "uuid": "356a4e15-762a-4d0a-a4ef-b2287fe738dd", "comment": "Malware payload (Heodo)", "value": "613a56986bfd9d189004ba72b262dacacb31fb21", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854035, "uuid": "d9ae4f28-d68c-4b70-b666-3bff3c9f6531", "comment": "Malware payload (Heodo)", "value": "b2943692c0c3dfb5fb7f834764a985c60700651c4516ad9478ee3a104e81842efb317f3f1be9d345645e1217690cc3b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854035, "uuid": "94f2fd3d-5a3c-4f6f-abdc-25032a862765", "value": "T121056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854035, "uuid": "27f1d754-a79c-494c-8d7e-b491c11e1f44", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854035, "uuid": "4ed0d6e9-8db1-4981-9543-f7846a3aea34", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rk5CGNHrH2tZ+d+:gMV/rk5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647854035, "uuid": "97b4e10d-f941-4960-8bf1-b91ac3b9f594", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647854035, "uuid": "e672e1fa-f145-4e65-be3a-4abe85d5c4a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854035, "uuid": "cbbc3a74-3842-4459-b65a-c05243831ddf", "value": "f1cc88badbe8f45d9635f20409795eb2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17818926-a95f-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647898642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647898642, "uuid": "e6161a98-a24a-43f2-9108-932275556c28", "comment": "Malware payload (RedLineStealer)", "value": "e94390b3938c38f6018b47671120c0fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647898642, "uuid": "a1b2f92a-6320-42bc-ac89-cc061d6fcf83", "comment": "Malware payload (RedLineStealer)", "value": "b4d9fbf120d8426c061651c60dfe20a00762d8cf91879eb6453faf304b0ee2b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647898642, "uuid": "79af3afe-f15c-4d43-bfba-4735ba08e5b6", "comment": "Malware payload (RedLineStealer)", "value": "d4a943b809973979fd9c8ae8a66479cfbf346a41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647898642, "uuid": "25640643-7086-43ff-b5cf-5b43b414d6f4", "comment": "Malware payload (RedLineStealer)", "value": "a931651a4f509dd28be789d38e48bec92725ba1c3fa20a02c9ab9ad7aaed129c29f156884cdc23a9ea8a6a28fabd3900", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647898642, "uuid": "1945f21b-4734-4650-97f3-9f5862dad20f", "value": "T1AC84C010BBA0D035F4B712F849BA936CB93E7AA15B2151CB62D91BEE16317E0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647898642, "uuid": "41726e62-8a49-4a73-95fa-90d229457d52", "value": "42499a002b9d8635fd26126765c4da68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647898642, "uuid": "927eaea1-fc6f-4814-abaa-4645ae480e0e", "value": "6144:NmtFPsFsRk7yqht+Dq8BCzaMUJIGq8PdYdgCq4+fBiDxNog:NlFsRk7yqhUrqa7kmdgsGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647898642, "uuid": "1637d0a2-8cb7-460d-b0b0-53be91e3bd06", "value": 376320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647898642, "uuid": "263b2fa9-13e7-49a8-b43c-e6c073ed7e21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647898642, "uuid": "45375b40-160f-4b30-a493-03141aca31c1", "value": "e94390b3938c38f6018b47671120c0fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32bed81c-a8f0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647851013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851013, "uuid": "4394292a-f705-4100-8475-406327fbccb5", "comment": "Malware payload", "value": "3de63b9d61a3e3ee3aaa8feff5ccb232", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851013, "uuid": "82fda74c-886a-4f85-9f6c-05007bfdb0a2", "comment": "Malware payload", "value": "b4fa9ac87859d5afb912d0b5638c7df3db8853646848cab1dc9737cf555b2d23", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851013, "uuid": "950558f4-bbdc-4fa0-9226-44ee9b3047d6", "comment": "Malware payload", "value": "860648eb74e598ebebe4584a9a586b2c5a529e8a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851013, "uuid": "e8be7593-1191-4688-af01-3d59e2b30626", "comment": "Malware payload", "value": "006dc7de289dcd691cd2a5d284ca4c54ffe3f315dfaf0ab184ee7c81ad5cd1ba57e5d5c884b06fd64314bf697666c076", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851013, "uuid": "3920604b-0d16-440c-8721-4da1907d4f86", "value": "T1BB81087406FC2AEDEE1884434AB4FC5641E6B2C5C7C54A8D766C92E9031A706B922E0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851013, "uuid": "84fa4803-8957-485a-a54c-fde0fcc15ac6", "value": "96:qvXA3NklYBnjmd02IclnmhYEGVJf3NKnmDZ8:qfA9Bjm3HmhcVlNjZ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851013, "uuid": "76611325-0907-4dac-98fa-99fb21f81371", "value": 3954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851013, "uuid": "d313cb76-717e-4586-837f-8c1d9da7ade2", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851013, "uuid": "ad78a55e-b6d9-4c96-91ca-799cb355cb08", "value": "DOCUMENT ON FIREARMS.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d4bad5-a8df-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647843746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647843746, "uuid": "95faca5e-4256-4d11-abf9-7f9273ee3a93", "comment": "Malware payload (RedLineStealer)", "value": "38aa19be7c9df9e5956c6b2770133347", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647843746, "uuid": "ea156143-0ea5-4113-8d1a-e387fae2c203", "comment": "Malware payload (RedLineStealer)", "value": "b517436f70d5299ff5decc0c61ea633cd19204f90b2e048a598b24909c434254", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647843746, "uuid": "c253674f-8031-4fd1-b416-4076d7018489", "comment": "Malware payload (RedLineStealer)", "value": "b1053686702d07100cf84063f2050b8cd0e033a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647843746, "uuid": "dcbb4359-be89-4b95-9f41-8e3ad557a6aa", "comment": "Malware payload (RedLineStealer)", "value": "8cc5df972d4c1e98272b58fcda2721026f94584f4d91c4218d952500fb3bdc23a4eb6afd130521493491e92bfcfab501", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647843746, "uuid": "5ccfe875-860f-4252-929c-ef357276ad8b", "value": "T1F4C4235AB2D2AF9EC18EEF345E20DD8BD3894C1590B0B152D21B5B5CA9348CB7F4936C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647843746, "uuid": "b88a5131-f3eb-4727-b26c-fcc21a5814fd", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647843746, "uuid": "c0064af3-4bf0-4aca-b8fc-e453311b096d", "value": "12288:DlQUv7wQE3NXoJQo4OW/QS03ULaHNqrxlKIQNojTC+K5DyoxjFrkG:ey7wQyo4HkEaHNYK35+K5Dyox5YG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647843746, "uuid": "b7d30166-a940-4721-81ba-574ee3e10db0", "value": 570368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647843746, "uuid": "b7ad47f1-849c-4884-bc6f-2a494f807798", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647843746, "uuid": "496aa812-e5ea-425a-bc7c-631afe21f725", "value": "32189386.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f070fb-a95e-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647898565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647898565, "uuid": "2f9f1dc1-82c8-4f51-842b-b2d6f21d1f05", "comment": "Malware payload (Formbook)", "value": "1933f62207a449aa1093e06e8ff85ec7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647898565, "uuid": "929a8b1b-3a27-4293-b1de-26d19a0fcbc4", "comment": "Malware payload (Formbook)", "value": "b68d8c980c7538bcb4a50a754f20f2af683c2129021e8beba4b320469e2ee69f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647898565, "uuid": "6f32f705-4a36-4046-97ad-3e1d34a7de19", "comment": "Malware payload (Formbook)", "value": "e068b8f531bccea83fd0403ee2cc061a5a6693d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647898565, "uuid": "76b8962e-5392-4531-abf6-5bfeb097a6e7", "comment": "Malware payload (Formbook)", "value": "6aa2cb7b5e620f1bea4888d3eea8ff1c9ae6993e4ba7ece1ce138e5e117a334b5fbf626e0bb8bf28ddad16330090c8a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647898565, "uuid": "25523478-7598-4ad7-8ece-35df471dfa29", "value": "T1450508AD719472EFC867C1318E946C64F650A8EB63074D07A8931B9A9D0F4C7EF940BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647898565, "uuid": "c1c1bcc2-c3c5-4e9f-8290-6fa924d2fc96", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647898565, "uuid": "a366df09-edfc-460b-95cd-5fd8da738d0b", "value": "12288:pjf6NSqr9Omm+ReubHVn3532EcgC6LzFfBVuZZb8Dy+YX4iyNVGC/ZSUOyzknJ9y:pLUbr9IiYFaGCIF/u7+I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647898565, "uuid": "ee6ef956-2698-4624-86c9-26e7772ee591", "value": 798208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647898565, "uuid": "68dc6687-bea2-420c-a2fd-0f39bd90c65d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647898565, "uuid": "bfe1165c-ca86-40d6-bbc3-23134bb53114", "value": "INV997463 Parts doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7bc3623-a8e1-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647844848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844848, "uuid": "b0e30507-e8fe-4f71-95cf-690498baaf70", "comment": "Malware payload (RedLineStealer)", "value": "90dbe6ae7f7607b1d2538d07dca89f4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844848, "uuid": "9edf1600-2b4d-48aa-952a-35760b223e9d", "comment": "Malware payload (RedLineStealer)", "value": "b6b46d7c326cb92d5851645b8317d909f5e61246efcc8573018e3642eb8a745a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844848, "uuid": "ed8c9ed7-13fb-463b-a64e-502ee291a49c", "comment": "Malware payload (RedLineStealer)", "value": "9ffc020b1d1bf0e5159d2421116eac5349e25aad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844848, "uuid": "266f63af-b8d7-4faa-b2ef-711ec30c436a", "comment": "Malware payload (RedLineStealer)", "value": "faab3a11d31b29843e49552eae2028db06707a52588088b0ccf067aa56f3af7ad93fbad0f0a69b3ce806595fa20987bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844848, "uuid": "f1cf16a7-aed5-424b-8563-3ccd2e6f2b87", "value": "T19144CF2074C1C1B2C5BB013148E5CA799F297076477595EFB7D82BBA6E213E1A3362CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844848, "uuid": "a7f981a2-8487-46ad-a6a6-718cfa58bec4", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844848, "uuid": "24c29532-29d6-4ee4-a47b-e162ac17edc3", "value": "6144:0DKW1Lgbdl0TBBvjc/2NCmPyEcHVxSGn76jsTC:ih1Lk70TnvjcOFyPfHWjqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647844848, "uuid": "5d0590e6-5453-440b-93d0-2a1b2705483c", "value": 255488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647844848, "uuid": "da5c0e74-34bb-42a5-a2c0-1834efc142a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844848, "uuid": "b4818615-de1d-4072-917d-5a78ea8dc1e6", "value": "64162804.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eac5ee9-a8f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647852483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852483, "uuid": "39828783-655a-4c76-8708-b6ecfb596ae9", "comment": "Malware payload (Formbook)", "value": "f863366aa81997f2b9f31e3bc7d15316", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852483, "uuid": "8f9e7395-e746-46e0-94b0-0d064f8df6b2", "comment": "Malware payload (Formbook)", "value": "b71ecfd70a10c73be177dd8fb3a3dcfbc39dc06e7e3646b43c2901e75a79f4a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852483, "uuid": "1506d324-2737-45f5-ab28-e8a1d1aff342", "comment": "Malware payload (Formbook)", "value": "6df66bcc20c77a3a66af93f88af56f1cd2213ddb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852483, "uuid": "fd682bde-eab8-4fff-a6a0-658b02e6d2b2", "comment": "Malware payload (Formbook)", "value": "0559996bae817f0aa9c1010510f22b9b22e9e1b63313e923959e863a1f7e2ba59297be61c14e664415964e29e596fac9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852483, "uuid": "845e8b6b-5523-416e-9937-ac12f238141c", "value": "T16D2523193BB00031CAB79BB1B4F0F5710F775998B153EB14D58AA68A3E1FB150A1B93E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852483, "uuid": "7ca46d63-44a8-480c-9ae1-a7cb6edfd78a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852483, "uuid": "309511ce-092e-4d32-b49b-9193da085149", "value": "24576:uLHl9DaZ5T3XOBKe9c5TyhMcGwcE6ocD1js7suGG:uLXWpXOBKem5TyhMcNGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647852483, "uuid": "cd4cec7a-c35e-4594-895d-8bd19a37c431", "value": 1044480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647852483, "uuid": "7c2bf0de-acd0-46da-8a2f-b8337e2c4ccb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852483, "uuid": "680b395b-e3cb-44e2-87f7-00e756652fa3", "value": "f863366aa81997f2b9f31e3bc7d15316.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf277bd0-a8f4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647852967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852967, "uuid": "a4072ac8-6843-406e-be72-419bba356740", "comment": "Malware payload (Heodo)", "value": "21aa654dc731b98cdae7393ce69b0a51", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852967, "uuid": "90c85a66-e116-476c-a4ef-3d50b69cd6f8", "comment": "Malware payload (Heodo)", "value": "b72ebc1ced227284c1a775f64717641398798dddfb0835161d834dc3a4599470", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852967, "uuid": "2de24656-e246-44e6-a507-7b2833b440a1", "comment": "Malware payload (Heodo)", "value": "6355b52486361c0bd04cd0da2199777e0976d029", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852967, "uuid": "9088e3f8-3407-4b68-8b6d-17373f3c8827", "comment": "Malware payload (Heodo)", "value": "d39855dc0b69d49cbf611752de7b31c1609d22bd46d94c112da3b6957b908c1c4f8eb002a25c5b73a16da867baec3067", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852967, "uuid": "8b678755-8a97-41a3-a34d-9636e50055e2", "value": "T12303AF71F6D2CB99D12BA43C4788EAF5871CCB525245BE1C349922BC4F53272778E24C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852967, "uuid": "6e4da487-39cb-4092-a6ca-aab0896eaa8a", "value": "768:lBnpO75ZJVzXxjOZpqcVbZYpoRuBlIiOKMArOoooooooooooooooooooooooooo1:D0lpZOZZ1ZYpoQ/pMAQVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647852967, "uuid": "dd151c42-8b9a-4635-a7f4-563e309a5f30", "value": 38482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647852967, "uuid": "20abd08e-6c78-4268-ae4f-f8d52bfcaebf", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852967, "uuid": "43bbf905-4152-43dd-b934-fede0a93c5fb", "value": "Insight Medical Publishing.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ed6deba-a8f7-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1647854201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854201, "uuid": "020046b8-bd42-43d1-b274-2bd4b56c2bee", "comment": "Malware payload (NanoCore)", "value": "f6d31e5f8ffde788e0532fabbc88989d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854201, "uuid": "216334d4-e539-4317-b8dc-15ef1923aa50", "comment": "Malware payload (NanoCore)", "value": "b771e6a9cb56600b3cb46440bd7af362598c9904350163754898505d35cff4ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854201, "uuid": "af60c641-0177-4ce9-8c3f-75f7c311f2a4", "comment": "Malware payload (NanoCore)", "value": "aa3b9657270582ddbc44837b0d0dc6de7e67a142", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647854201, "uuid": "56140d7e-e14d-4bf2-802a-ce04d68a71ee", "comment": "Malware payload (NanoCore)", "value": "b169aafd3a53940de9cc172e7e0cdcede2ebaf4449191aa70661a1566a2ae611f2214e78cb85ca7c7ebe698f95b616d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854201, "uuid": "6c23ab6a-3dca-4860-a394-030c27132525", "value": "T14835237632EF8139C6942237D5FA55480BB00399B853EB89E894711D0D437E7AF13ABE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854201, "uuid": "81699e15-9249-4d04-91dc-047b03050ebe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854201, "uuid": "eab50fc2-966e-419c-9f46-a6e983782dc8", "value": "12288:ctvm9Z6eBFT3tVoOUCFqqvrzJ17h7mvWmrUkhhJLVQ695/eL8ONwCeHFhMo9aMYv:GO9B13fjFb6/lhYvNw/wwaMYy35U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647854201, "uuid": "e736f447-02d8-4002-a487-4f91e20bd3fa", "value": 1073152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647854201, "uuid": "935cad75-8e9c-4eed-8a04-85204d84fb98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647854201, "uuid": "fa7b3deb-e231-4138-8d1b-91be15d83455", "value": "payment-00789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e20deb47-a92b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647876648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876648, "uuid": "42e41098-bdc4-45bf-83f9-f6dfcc2aeeea", "comment": "Malware payload (Heodo)", "value": "bbf7fd0a2163d09f6949208910675865", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876648, "uuid": "eec7300c-b5e1-45c0-b29e-5dae1ed75417", "comment": "Malware payload (Heodo)", "value": "b777a68a5b22b0cebf2427d47c13fa7a633f66a23dad45f642289320a43de621", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876648, "uuid": "c8b9eca0-621f-49c3-ab36-7c0a96844b55", "comment": "Malware payload (Heodo)", "value": "1afc21d160d859c2b28e0da6a2919fa8155f0e6b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647876648, "uuid": "b0781ff7-3e2f-4453-b7ee-ba90c4b3b836", "comment": "Malware payload (Heodo)", "value": "05c023c9be0c0a0e597fc1661d01d9cbcd85b3dc238bc6e65f2db4b968504f2096f214f16a6f873aa6e013fe78745720", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876648, "uuid": "5347dd12-aa93-42ad-b2f9-9c315a83a196", "value": "T1E1056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876648, "uuid": "b7ac45c4-e966-4c1f-9da2-2c8b38963159", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876648, "uuid": "d32dbced-0ee3-4909-990a-6ff5a4b7a68b", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/r45CGNHrH2tZ+d+:gMV/r45tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647876648, "uuid": "cba733ef-9b22-41b1-b2e0-561f9b505c58", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647876648, "uuid": "df51a8e0-88d4-4569-a53b-b852cac61beb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647876648, "uuid": "ecc6d42e-d7b5-4e77-a3ea-df64509b9ba5", "value": "bbf7fd0a2163d09f6949208910675865", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9173433-a947-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647888605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888605, "uuid": "6dcf25f1-1db7-4cdf-bfb8-0638ffe3eb6c", "comment": "Malware payload (Mirai)", "value": "cb8bba6fde1dd951517efd463c56af97", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888605, "uuid": "9221be4b-5aa8-4cfa-bb07-4153410e3105", "comment": "Malware payload (Mirai)", "value": "b799c133a8d9ad3aa7cf575859efb7e8bc457c52087957d766c32fe76a154a66", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888605, "uuid": "b601a8ad-681c-4594-971c-15f21bef24b0", "comment": "Malware payload (Mirai)", "value": "b0cda4de61dbc4c36d14ea26614d68a2bd7238a9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888605, "uuid": "779c9d3f-8f09-4e51-9918-32c635f2747d", "comment": "Malware payload (Mirai)", "value": "98c00677fdb574ecd7e257b8f99e1765b66de9b487d8c459c4ca07f1988c65488423ed351ee56e96a8b884f61057ee16", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888605, "uuid": "485874ff-4988-45a3-aefd-8122556cb3d6", "value": "T16613984CF964A32ED6E1A6FFFB1C42CE7B3E0BA9B3DB32175A35095133C5A215629014", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888605, "uuid": "dc6a00e9-ded7-4b8a-bc74-6d53c3a7b25b", "value": "768:Slcq1QjUMDGEIXPk9G5XvohQVaWlsHpiguWItgcOC4dz6jXzYxnMWLU2:Mcq1cmEIXPk9G5XvohQVaWlsVuWIy4kU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647888605, "uuid": "0aeb68fe-a0c4-439c-8797-3cb129c1bb13", "value": 42104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647888605, "uuid": "6c71b3cb-b6ba-4a58-95b7-2843b7013a8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888605, "uuid": "64c9899e-71d1-4bfe-8670-f98b21c05a6a", "value": "daddyl33t.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3329f6c-a933-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1647879978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647879978, "uuid": "2f5962f4-54c0-44ca-b4e8-938914540663", "comment": "Malware payload (CoinMiner)", "value": "9c5bea6a72a2f471aa79a87d526c1897", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647879978, "uuid": "9208e1b6-5893-4e15-8a7a-2ffe32dd2822", "comment": "Malware payload (CoinMiner)", "value": "b840f10ae378fa15f8570f6eb208e2f280618bd49ade560eca00c93b6a4bd7d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647879978, "uuid": "0b1481ef-2397-4b3b-b422-dc82222f1be6", "comment": "Malware payload (CoinMiner)", "value": "4a22e3cf76389772ffab03301ffd7c3c65ce71e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647879978, "uuid": "56d2adc6-b11d-485f-9e65-80f9a6756b6a", "comment": "Malware payload (CoinMiner)", "value": "12869c1c7be93aff5a2080efed00664e86b4bd50a6cf5256f60c9d742c64f21bcc62784369acf5cf662143e53f523709", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647879978, "uuid": "1114ca69-cf42-43c6-aa32-0ea92afaba6a", "value": "T14A0433DD726072DFC867D472DEA82CB8EA6174BB931F4203902715ADAA4D897DF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647879978, "uuid": "4aa50487-b400-4f08-8c46-9fac944db663", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647879978, "uuid": "4cad715a-8a71-4546-9bd1-f29f228ddf5f", "value": "3072:ANFDYQOn76x8JGcsQsRcDrgNFF+lygYOAdwfvKnq2aSlTGvauQf:ANFM9nq+G8s6IZ+lygYOAdwfvKnq2aSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647879978, "uuid": "9cbedf05-295b-422a-b351-2bc1730cbb00", "value": 174592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647879978, "uuid": "b9ffd7b8-a153-459f-911b-3e7e90b5516a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647879978, "uuid": "46d124ad-ecc7-4e2f-966a-5365ff32b992", "value": "9c5bea6a72a2f471aa79a87d526c1897", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b558df-a8fc-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647856110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647856110, "uuid": "cace3859-f1c9-4cc6-8144-9118e4510d91", "comment": "Malware payload (Formbook)", "value": "8be0a414b8c2877b19284d66c31c7b1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647856110, "uuid": "df7dc264-1542-41af-8e7d-c45798a6948b", "comment": "Malware payload (Formbook)", "value": "b8620affccaa451b93959f0a3e853a960ede3740148c7da1c52372938fcbdcb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647856110, "uuid": "4f9d5afa-c98f-43af-a386-0fbc60676160", "comment": "Malware payload (Formbook)", "value": "85a64c0b9b780fd77258f009fde433ecba630617", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647856110, "uuid": "2b742d53-213a-45f0-ae4e-2a0fa1cfa856", "comment": "Malware payload (Formbook)", "value": "e7037bf1b639bae7116f6b761ebc61c88c9da341f7831799176ca4d80ebcb2afcab718adb829866423edeebcb4ad8619", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647856110, "uuid": "d1e937b8-d41e-42d0-b1ab-7dc184799953", "value": "T10BF409BD715472AFC877C1328A985C64F650A4FB630B4917E4931B9A9D0F8C7EF840BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647856110, "uuid": "f0cc8179-49c8-4034-9cb6-e7c800bd9d4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647856110, "uuid": "59d00c61-aaf6-45d0-8e84-def3b2597257", "value": "12288:Sz65BJMHRmnoxqUadbPOJQ/U5fpw/0ZUtZzEReQG6z00D3M2hat3L0aNBmRiXlZ1:SCMRXz00D33oFL0cBQkzIgQ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647856110, "uuid": "271eedd7-513f-40a7-8da0-067567917fc2", "value": 762368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647856110, "uuid": "9b0651d0-3483-4182-b6fd-0ba596c6fcc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647856110, "uuid": "71cb2079-97b0-459f-a47f-20cf5355eee4", "value": "Confirmation of account balance.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af15527-a943-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647886622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886622, "uuid": "733b74fc-b4ee-4fc7-bb7a-33d9ad5873dd", "comment": "Malware payload (RedLineStealer)", "value": "5f98f7b7c60dfc2f417652d3cf01c338", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886622, "uuid": "34ddb0c2-fa9d-41ed-8dd8-58b689e06224", "comment": "Malware payload (RedLineStealer)", "value": "b8baf4b97611ad4f58eda880c93409af5e13bc21957ca4084e0a5ad448085539", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886622, "uuid": "917d2a59-36c9-4cc6-a0ef-462894abb5f9", "comment": "Malware payload (RedLineStealer)", "value": "8c5e8ff1e9041bd96639c5cd8eb019d8d5da239e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647886622, "uuid": "ffe8b34c-51c0-4013-b4c9-8ddfd2e3fa1d", "comment": "Malware payload (RedLineStealer)", "value": "6f669fa00ea231bc9cafea78ef414ec688a1e6ec0ac453049fd173ddd098aa95ab777b5d1099c0a3729c106c1d7f9103", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886622, "uuid": "dccf72a8-6e90-441c-9e33-81bdb3534d3f", "value": "T185A49D2E36A18D90C6686D3B90A7C12447C3B78613B3E75DD83725A32E873E58D8D2D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886622, "uuid": "1a0783b3-4d69-4870-b7b8-4dfd6b723a37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886622, "uuid": "118c3688-a4cc-40c0-b847-30b33348ce44", "value": "6144:7V/YiEMhqtWwCUQr/mAxDd6WHGl1RUl1QjcMHsOLEze0+3qnf8MxdkS6jWT88k:hYRWJTCARdvE213MV53qkLS1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647886622, "uuid": "dbe81656-6a23-4248-9ee4-75623bb6277f", "value": 482008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647886622, "uuid": "ab2a5c94-64c6-4420-a236-77dd0978ce66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647886622, "uuid": "04deb10e-3ccb-4992-a734-bb58d18170d5", "value": "SecuriteInfo.com.Variant.Lazy.77001.30021.8393", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d2c37f-a8f1-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647851396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851396, "uuid": "fa568c8a-b511-4ca3-af20-0b55ec77cd54", "comment": "Malware payload (Formbook)", "value": "c35e715b05acf9eeacac083ec246eb42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851396, "uuid": "cf4661a4-ddb3-4cde-8954-54afa8c69e07", "comment": "Malware payload (Formbook)", "value": "b90fa0809a154339d2066bca22c9eff5d20ddee4cadad9f21661dc4e05475040", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851396, "uuid": "276a1347-ceb3-4f58-856a-11533bfb1bc8", "comment": "Malware payload (Formbook)", "value": "36bb672d10575ae58796a9dbbbda07f886536151", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647851396, "uuid": "b682e612-b0f9-48ed-95a3-8d8bd9ed563e", "comment": "Malware payload (Formbook)", "value": "992b4eea235e209633951b9a50f4d699277d62ef8b559f737c84534e5db73ba77af2e54e2f5d6692f793a155e1b55192", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851396, "uuid": "f71aea41-494a-45ce-a5b3-5d4855f2e53f", "value": "T1ED34F94334808598CE7D55F2B2178584339ADDBFD658A60C7BC873A35FF2AA20936B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851396, "uuid": "a43b37e1-9e9c-4ccf-a11b-4d1b30d0de59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851396, "uuid": "382a6ffc-cadd-4ba3-b352-df3a5d98400b", "value": "3072:Wy4X2qCu5Z6ZWaNlMMdG4UG/A2dedGTJ/7kYmwpWU7/3lLTqKnoBojSm:Wyhq+RHMAIGI2pjkYNJVqKoBo2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647851396, "uuid": "0e2c4669-9033-4da1-9821-5bca9fab4865", "value": 241152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647851396, "uuid": "c56f6992-561a-4698-97bc-b65120d3318d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647851396, "uuid": "195f0d77-720e-4999-9550-20e0f5e62707", "value": "Maersk Global Shippings.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d3c5313-a902-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647858789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647858789, "uuid": "0fa390fd-9dd9-49b3-bed6-1ebc44037375", "comment": "Malware payload (AgentTesla)", "value": "82f4af60e1e6d0aaf1c451892e1dbeab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647858789, "uuid": "0859134c-3fa0-4ba3-ae01-c2b659f5c97e", "comment": "Malware payload (AgentTesla)", "value": "b932e1459e51b6ef41d002cb1187a2c2fe4cc0f3a5332a6f838352f29d8b71d8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647858789, "uuid": "e1e96132-2b0b-41d6-ba71-556cee9ef78c", "comment": "Malware payload (AgentTesla)", "value": "dacb806fcb3caf50403267900d0b8af2268fd400", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647858789, "uuid": "f3ec615b-873a-488f-8299-a6e8768b1380", "comment": "Malware payload (AgentTesla)", "value": "47c081f69fd78d004fcaf52e7e8c473d97d33059d7af292082f7eef7e347b0d12660e6d555072473add4bff0ef5687f2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647858789, "uuid": "7767bffc-2d09-49f3-baa8-d106e28e8e85", "value": "T19CF419BD715472AFC877C1728A945C64F650A8FB630B4907E4931B9A9D0F8C7EF840BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647858789, "uuid": "915001d8-066b-4343-ae9d-42b7b937a535", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647858789, "uuid": "56360164-bb47-4246-88ce-558799594c33", "value": "12288:ESvvPv+qEJP1/IExP4jRXiF8y25MLnWZ2/KGnm4AZlt+MZ5RE+W3t+fweCp5zNTw:Xv+kRE5wfw/p5zkoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647858789, "uuid": "901b6ccf-cf7c-45bf-a8e3-dd0be7458dee", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647858789, "uuid": "48549815-8801-40b5-a572-a73b5b4e457b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647858789, "uuid": "e160fecf-7038-498a-ba4d-7e94ca9e90c1", "value": "ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "072967f7-a8e6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647846645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846645, "uuid": "6314e871-e3dc-41c0-97b5-889cc95353d0", "comment": "Malware payload (Heodo)", "value": "ae215bc24e6b97fcfc49c8a4096d7b6c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846645, "uuid": "bf457344-b454-47b6-bd68-2266c38d4489", "comment": "Malware payload (Heodo)", "value": "b99c6e3973b404407924382614373952b9777654f467c37c2debfc7b962f073f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846645, "uuid": "ecc8cd59-9918-454d-a8be-c653dfad8062", "comment": "Malware payload (Heodo)", "value": "0581fa3ed8831e4cc0ba12f5193b0be688ccaddb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846645, "uuid": "1c3b80e5-6c26-44d6-bb0d-725ddba0dfa5", "comment": "Malware payload (Heodo)", "value": "175eff00e03a93ebfeb45fd4a6d9c4e2f1b2a253c51fe61d7f45f3f3f9402a5efa0149ae4df775838e152f644f7c2d2f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846645, "uuid": "90d576c5-99b7-45da-8a70-e5602200c456", "value": "T1AC03AF21F2D28B99E036D47C878CEAF5D7188B424145BE2D309963BC5F532B66B8E24D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846645, "uuid": "81921e1e-4a11-4118-b9e8-b050686b8317", "value": "768:psnACdQR84jOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooFVIX:CA6gvOZZ1ZYpoQ/pMAeVIyP54T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647846645, "uuid": "1746c81e-182a-49bb-a422-3ed8f60b4456", "value": 39703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647846645, "uuid": "fe8c920e-e830-4eb7-b8a0-0a4acf3d0747", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846645, "uuid": "1bb2df97-5055-42e8-a2b4-dd9627d2aebc", "value": "2022-03-19_0948.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a69ec3d-a8ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647848476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848476, "uuid": "0fe5305d-aafb-44a9-b82e-48b4a9686e9d", "comment": "Malware payload (Heodo)", "value": "8135e9ee6457a71fbcd31be18f1a24cf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848476, "uuid": "1823f605-356d-46a2-912b-d5a3dcc2d455", "comment": "Malware payload (Heodo)", "value": "ba0347cbf988c3bc908fc8baa0637f2a8d8d9a9280f110dfb5803a2b264ad30d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848476, "uuid": "d78de244-b5ec-4e8b-9177-ad4fcb53d626", "comment": "Malware payload (Heodo)", "value": "6f81cec42119af9d2cbfe47c4c41f65bf67f7784", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848476, "uuid": "2a750acd-26cf-427b-ac03-5d197d236994", "comment": "Malware payload (Heodo)", "value": "aaab773e5205b4efc6016a82285397a3c894b3d2f7ee67eeb1846c8e46175899d9a363869de92beb41b6142a07f75ee8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647848476, "uuid": "52e48e0f-bee2-43af-8d2f-adeca42d333b", "value": "T1DD056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647848476, "uuid": "38a587a1-836f-4cb1-b9d9-ce73fb2bbac2", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647848476, "uuid": "73e2a29d-d5c8-4666-864e-4da8228aa521", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rG5CGNHrH2tZ+d+:gMV/rG5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647848476, "uuid": "17556152-e50a-43fe-8ddd-f61c15262a12", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647848476, "uuid": "7c9700ff-4bf3-4e77-b44e-e0ab07d597f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647848476, "uuid": "e49b874e-f9cc-4e42-8156-71760abc12ad", "value": "emotet_exe_e5_ba0347cbf988c3bc908fc8baa0637f2a8d8d9a9280f110dfb5803a2b264ad30d_2022-03-21__074111.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31e6cb46-a8ab-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647821377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647821377, "uuid": "ce128152-8874-4517-85fa-641080a55388", "comment": "Malware payload (RedLineStealer)", "value": "216ab83d397984b79dcf7ea28cd496ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647821377, "uuid": "7c5b5ead-8f9e-4d9e-ae82-d2fd85f1625a", "comment": "Malware payload (RedLineStealer)", "value": "ba369fc0ab105a2330b15756623661acea3b731291e3be4e0b9802d18da55dea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647821377, "uuid": "b9f3361c-2dc3-4a13-ad34-5fa0e8f534f2", "comment": "Malware payload (RedLineStealer)", "value": "7c7f6746017236fac0f52d27aa5c32eee9cfd754", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647821377, "uuid": "67466552-776d-4165-b339-c62b84dbc44f", "comment": "Malware payload (RedLineStealer)", "value": "3688d4d11a6214afaa152e1feb2f17fe2fb04ec0b51854e061e6967c3bd7b631a22ab337628846a0d17a397323f3271e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647821377, "uuid": "d07374a6-29bc-443e-8ac6-5fd7669420e6", "value": "T1C984F122B7E3C472C08318707821CA756A7F717565B9C98737591B7C6FB02C29BBA31A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647821377, "uuid": "f25b8854-60eb-41d0-b83c-ce4260ef8e5b", "value": "dd74d0a493381cbdbb2d3a82a03effd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647821377, "uuid": "17febc19-efb5-4538-bf5a-2a6063bea78b", "value": "6144:h7rLpm9JAX2bVtupFlI9I5KHaOPMcFDU15SO/H:h7rLU9JAX42lMIrOLJU3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647821377, "uuid": "38f7509a-c5e9-45b0-bcdf-b9a3790ed5fb", "value": 404480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647821377, "uuid": "a56b761b-9efb-45f9-b463-b3300460e98c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647821377, "uuid": "448d3d9e-3fd1-49f4-a04c-18c915b94b79", "value": "216ab83d397984b79dcf7ea28cd496ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "779d921b-a8e0-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647844257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844257, "uuid": "afe07e78-8b6a-409d-8015-fcc8cdaf6c5d", "comment": "Malware payload (RedLineStealer)", "value": "d7259c2dcaa221cdb815127a2075e7ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844257, "uuid": "7201f405-96d8-4567-8bf4-dfc59bf9ade4", "comment": "Malware payload (RedLineStealer)", "value": "ba3dbc27a7bdbdcef4661c6247a8aff667c1171aef8f33a0b6461bf262180c5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844257, "uuid": "ea1390f5-2914-4237-8e3a-b2ba46aaf0e8", "comment": "Malware payload (RedLineStealer)", "value": "87e60d8240b3dd33f0e7a39278c8dde1352cd36c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844257, "uuid": "c4d11dd1-c859-4d12-a622-37cd82c9e5e9", "comment": "Malware payload (RedLineStealer)", "value": "cd2d1885d31d1be4511e5674689b4d3d5fb42baf48f694985c1ac6c050902affea939dc0cdf2c6ed83fd2350247a2f43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844257, "uuid": "765cfcdf-6a19-464e-8e1e-c9aacc40b2b0", "value": "T150363341AFE9FE48CA850431468B6786C2BE70942FF4807135D872F3EB65539F98F268", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844257, "uuid": "f2ba2623-2f92-453d-bf88-621b3fe73037", "value": "fddc083fa31a17c938d0a17ec7cd3025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844257, "uuid": "d09bfbf0-7fb8-4290-b22f-88338c2d1d1e", "value": "98304:GWRfhUP8CWmb5opvBDl2ztp54m/809a10lisX6N1vLGsWjnD6EpeP:GWJhk8CW+GvTgt7Rr9a10lisXwRq/DTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647844257, "uuid": "1506c6a2-e02e-489a-a87d-b7c60973ca44", "value": 4905776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647844257, "uuid": "2df7d44e-c0c8-49f6-a8bc-c62a9ab77322", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844257, "uuid": "04a8cb59-9607-4eb2-92a5-fc8322e84519", "value": "36484027.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2413743e-a8e0-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647844117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844117, "uuid": "3167824e-ab37-46e2-9cd8-e91d80bdfec5", "comment": "Malware payload (RedLineStealer)", "value": "140f1ca1d23204b1ddedb94e2c8f8229", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844117, "uuid": "f661038e-d378-4b87-aeef-7e9e66d3308e", "comment": "Malware payload (RedLineStealer)", "value": "bac79cf2d4bcb54ed3d8d90f65d67ff94046f31f6ac05c7e04194953ae793f0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844117, "uuid": "f3f0b488-9eb0-427f-8d9a-7d80ea717b24", "comment": "Malware payload (RedLineStealer)", "value": "389a773160a14c8c3102d1c911cbd4c9f286bddb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647844117, "uuid": "ceebf805-6038-4767-a8ed-f0e82cf16553", "comment": "Malware payload (RedLineStealer)", "value": "c43e1701694ce6fa9afc71f17f4d3a6c6214dae9c3374b878d19cec0dfe05176c78bfbe4c0bd910bed7ad146d469cd9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844117, "uuid": "90f47201-72e3-4ad1-b477-bebe5f6678d5", "value": "T1C0C423E767C29F44C10A27F86E692A5F43B937E385E92165433306AF9F98413C7385B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844117, "uuid": "1db95ddd-cdca-4f68-879a-2f373ac225c7", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844117, "uuid": "5c5bea63-d8f8-4085-bcac-cbaa5b9006ba", "value": "12288:y58HPmdzDANZdQj8al5xuJ1vBffQS03ULaHNqrxlKIQNogKrRkNZotXvRUXvh:oMPAzsNZ2YapYFdfkEaHNYK3+kNe+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647844117, "uuid": "c7070d38-8e59-409f-a431-c9f6e2238ece", "value": 570368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647844117, "uuid": "d3fc05cb-35bc-4a15-9d05-0e3ac50ec335", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647844117, "uuid": "56bfed20-986c-4e7f-91d5-157a0fa36f51", "value": "34974679.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "582e622f-a8ee-11ec-9275-42010a9c0029", "comment": "Malware payload (SystemBC)", "timestamp": 1647850217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850217, "uuid": "8d69d3e1-608a-4324-a093-c96279135e6e", "comment": "Malware payload (SystemBC)", "value": "572eb88ef3e508c0556d55b4e7f649bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850217, "uuid": "9772084e-b383-4bcf-a28b-1ea5c96087dd", "comment": "Malware payload (SystemBC)", "value": "bad62abd7ad29c3d1379bd06439b3208549ceff63772420104c1b322a4abc810", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850217, "uuid": "0ba9106c-f46e-4971-b88a-3348995ceb4e", "comment": "Malware payload (SystemBC)", "value": "a2251c07ea52e9886be15835d45eac41c24af78d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850217, "uuid": "91da6d89-744b-4e64-bddf-6972e7ac6483", "comment": "Malware payload (SystemBC)", "value": "0f2a047d662088d273ac76a8d73a04da3ef8ac346807d1de014a669e16c70045a29d881603278508a34d87491fd2fcad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850217, "uuid": "12980cec-a4dd-430a-99b8-96ac93e7f844", "value": "T1FC34BF623E50C832C49664735825C6A1EA3FB832F6B2C5077B554B7D1F313C2AA7A35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850217, "uuid": "ae4eface-0c8e-4c7c-acb4-5fc19deed4c3", "value": "faaf45f51400f48ccc9484bc4fae33cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850217, "uuid": "d05ae0cd-1934-4a66-a28b-74d63b5fcd4a", "value": "1536:4NiudIOU0UrlRcrLjb1hz84dLkxSfXTSoUyFqmnHii3sW5R2IDvpeF2B:4Ni15wH159rSoUDuF5R2UvpeF2B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647850217, "uuid": "645dd59a-9d12-40f7-aee6-86808807a02c", "value": 242688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647850217, "uuid": "850bd979-3314-4a94-848c-15496bc30b31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850217, "uuid": "0984fc06-dc4d-4d77-aafe-9d296cf85875", "value": "572eb88ef3e508c0556d55b4e7f649bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93974236-a8fe-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647857189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857189, "uuid": "185f061f-2a5b-4163-915c-5617e50e6ca5", "comment": "Malware payload", "value": "683c7878b51e43e5c68ca319b13b4847", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857189, "uuid": "9e0835c2-ddfa-413e-904c-c5b55af80149", "comment": "Malware payload", "value": "bae35f29c9c6122892501ce258a4f06cc321d8768d7963138e7126a6680ca808", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857189, "uuid": "89d5dc46-ef0b-4cda-8063-aaea7b43e954", "comment": "Malware payload", "value": "1afc39a36eda884caf1d2fa036986c9149d02920", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647857189, "uuid": "95131e7d-53da-45ef-81df-10cf46cd0abc", "comment": "Malware payload", "value": "e34f2da35c7d10032ef4335c8e8042e0a1f87e3020fb71a24cbef969727888aeaf9cb1064bb680ef703e3fae431ffb9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857189, "uuid": "009389e7-76ca-4e7c-beb8-123b49ebdf90", "value": "T1D1741292E2C0C4A6D96203316D37597543A7FDA5E37218DF27A43F782EF71930216AE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857189, "uuid": "51e0cd68-7640-4f2e-9912-12799906d1a4", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857189, "uuid": "1c3269c4-18c1-4fe6-9553-eb1f48481174", "value": "6144:HGiuQluXV6lG0wT6tKtamF9wStfto1Z+TS0XI2EEUy496Iql6v8mFu0g:VuXSK2tUaoKSt61l0XI20yWql2sp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647857189, "uuid": "fa308d83-b1fc-4ad5-9d54-7fd3edc1260f", "value": 363122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647857189, "uuid": "7d480d23-e1ff-4206-8a70-a23b83b5cb02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647857189, "uuid": "e5cc1da4-bccd-430a-946f-481445fb6799", "value": "683c7878b51e43e5c68ca319b13b4847", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "082e9aa2-a948-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647888738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888738, "uuid": "00c5cd4b-0515-4583-aeef-4b3e9974bb03", "comment": "Malware payload (RedLineStealer)", "value": "7023a339fa067ac537aff58c3aa33ed4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888738, "uuid": "1cd6f7c1-971d-48ca-bd2b-35adc6989e73", "comment": "Malware payload (RedLineStealer)", "value": "bb26b3cf3a84ed7fe4877f0ae81ac103112571744df6a66c3c97179be7a4a75c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888738, "uuid": "eb05e1e7-0de8-4346-9520-ccbd9f041510", "comment": "Malware payload (RedLineStealer)", "value": "f07a7a15f925900ad410e5e524a3a9649cd9497c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888738, "uuid": "0fc00b70-8617-44c6-aefb-a1d1d708f418", "comment": "Malware payload (RedLineStealer)", "value": "56faf1ad7b9cea9b774dbfaaa4bab8d6fbd27c07caa6fdc50c3cc8819a576f1594d86b6be493201f0dbfc0fb60746981", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888738, "uuid": "c6f1e195-7a40-49cb-85fc-aeb72b32798f", "value": "T18F84C000FB90D035F5B712F8497A97A9B92E79A16B2590CB22D41BEF56347E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888738, "uuid": "10093535-9d59-428a-b5ce-132d735cc15a", "value": "7288d715a9ee18d7dad5b71be8ad934b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888738, "uuid": "3f2cee95-26ff-41e2-854c-abcbad19e13c", "value": "6144:Qfv1z+QsQ1g/BqJKMr7lCmArMGmMoqIjD69qtRtJlcCpNUTqo:QVz+QsQ1YSl7YrMGdNWkqt7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647888738, "uuid": "9d2c5d05-2430-4cb4-acf9-723c248718f4", "value": 380416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647888738, "uuid": "ce637567-9981-4e85-82c0-95e73ef891e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888738, "uuid": "d1f9a523-3c2a-45f4-b0cb-be609be3fc49", "value": "7023a339fa067ac537aff58c3aa33ed4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e25e3918-a8ee-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1647850449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850449, "uuid": "de46369f-e1cf-4ace-8585-780152ce694d", "comment": "Malware payload (Gozi)", "value": "cb48ba54cf73cba6499d7622b50b89da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850449, "uuid": "106ce69c-2560-4d12-8b96-7d99a6079171", "comment": "Malware payload (Gozi)", "value": "bc2bd3c448b2348629da59a454f409ad5b60f2eb21f175e7e49dd04b2703c0ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850449, "uuid": "3cecc89a-84b8-4760-bb29-969f25873a15", "comment": "Malware payload (Gozi)", "value": "9311c9855479396b7c9725c3eb9cedde7e1378ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647850449, "uuid": "3be015fb-2bc2-4110-ba74-9a4174872e32", "comment": "Malware payload (Gozi)", "value": "2bc6d4f452636900bdb0d4a07e313b060663c5762d2bcae1c694746da3f2e959548c55158b52cf1ca40654e39670fe2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850449, "uuid": "8733ee81-afe4-4502-af1e-d6c370450fc4", "value": "T1F554AE323690E831C05629316415CFA15A7EBC3119B1960377EC2FEE6F7A3C1AA6935F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850449, "uuid": "100a0389-d0c1-4d36-ae1a-a661bf089f32", "value": "5fb8a90699385dd79bbcc37048719eae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850449, "uuid": "2008062c-762a-470d-b162-88b3c923ddc4", "value": "3072:iRVxDlLHyROJcdAR/1BGfdAYNjme5NQ5QkM/h3HL20VE:oDlLHy4adg/1BoA7GLkWL2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647850449, "uuid": "28450a14-0ab4-4321-96ac-c8aea53c7e07", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647850449, "uuid": "e5c671ba-ad57-4f11-bcde-6b0b3ad3fbdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647850449, "uuid": "a2a2b203-ec22-41df-893c-9051d356e43a", "value": "bc2bd3c448b2348629da59a454f409ad5b60f2eb21f175e7e49dd04b2703c0ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "623b4ad9-a901-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647858394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647858394, "uuid": "bb98b70b-23af-40eb-a669-52c1c62bd4d2", "comment": "Malware payload (Loki)", "value": "72a78356014d7f32eb5258b746e96a15", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647858394, "uuid": "9d55456e-d963-41d9-8044-0682b4fef688", "comment": "Malware payload (Loki)", "value": "bca219d2c253c4de9c4deb9427507bd3ddf85f3296c285f675d3d8b64d079fbc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647858394, "uuid": "861b70ff-033d-4a96-a0a9-69d1005754d6", "comment": "Malware payload (Loki)", "value": "e1c6763fb2c53732bf1bdf28aa9d864d6a11c8ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647858394, "uuid": "a3da481e-0de3-4b89-8ccd-baa0c0e15ab0", "comment": "Malware payload (Loki)", "value": "0f09a3a41dcf66016f3a88b0a31ff5c6841009526c2c482d7452cc4eb08b9809803850fdaf77e755aed9b6245f1b87cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647858394, "uuid": "89cc6d40-e78a-4354-b2ed-b143da704059", "value": "T12334120069D0896BC1D587710EB7B3F9E7BB83A9539012479B7CCFBF3932156180AAB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647858394, "uuid": "00095624-286a-4b2f-a66f-48157770ebc9", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647858394, "uuid": "b4ec9d9b-5c51-4b1f-a8ed-3f94ee5540f0", "value": "6144:rGiRFu2im8fyNIIHYtr7ziVpTTOSMgs90LnIbt/:l5gOIuq6zTTO0skk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647858394, "uuid": "b5f2482f-39f6-4b85-9d04-fc3b96b29566", "value": 242360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647858394, "uuid": "0391d672-2dc3-4d7f-a613-d8384e13e05f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647858394, "uuid": "e2041f0b-5d16-40fa-84c1-6fa4e6e644f4", "value": "72a78356014d7f32eb5258b746e96a15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb1dafe8-a924-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647873683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647873683, "uuid": "7f28458a-c5e7-4e08-ba9e-2cb297939a05", "comment": "Malware payload (Heodo)", "value": "7d3ec50c99fef9827fbde26bde57a11c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647873683, "uuid": "74f66214-2e07-4822-988d-d19a59caa332", "comment": "Malware payload (Heodo)", "value": "bcb77b0f2e5a537ec885172abdddb25c576a46cb10688740767bda46dd40a472", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647873683, "uuid": "d39ee4b6-8c37-4380-9774-ed497043eddf", "comment": "Malware payload (Heodo)", "value": "6aca15c2563e85adb775ae3ccbc9b8a9fa26ce7e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647873683, "uuid": "493ae4a3-3c34-4f7c-a00b-86ffde4ffd20", "comment": "Malware payload (Heodo)", "value": "1f0f95a3646abcf4284586026ce75056358f248cfe96f75532bd4df0aa94d2bc6c8bf1c5e9444d38a45df828718775d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647873683, "uuid": "be9c367a-f7cb-49b9-b4ce-06198f02b22a", "value": "T12D056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647873683, "uuid": "2e3c7a6f-ee9e-4890-a71e-8935f3b43326", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647873683, "uuid": "2e91ed12-80de-42f2-acb6-1ea151e4b54e", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rX5CGNHrH2tZ+d+:gMV/rX5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647873683, "uuid": "f99b1bc0-4543-4c7f-a4fa-2f8a5711377e", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647873683, "uuid": "39816e39-2d00-47c4-90e2-23d3d0f93b82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647873683, "uuid": "e91d21ae-c87d-4994-a932-dc25b3f15a0b", "value": "7d3ec50c99fef9827fbde26bde57a11c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51976b6c-a914-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647866527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866527, "uuid": "55b9cda2-739a-4203-8f2f-0702687675a0", "comment": "Malware payload (Loki)", "value": "6d343fcaf5359df3a3eec56c0bf8c723", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866527, "uuid": "75024664-df99-47f4-a91f-db8a9207b385", "comment": "Malware payload (Loki)", "value": "bd171b26e713bcb0bf0a0692a3796316dfaf6a8627e2ce260c1c9000d363c627", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866527, "uuid": "3adac93a-007a-42a9-8323-8617a71e51ca", "comment": "Malware payload (Loki)", "value": "de761e99ac14cf8d24936719563bdd491f879688", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647866527, "uuid": "e43123f1-7969-42c0-9b86-718276128a87", "comment": "Malware payload (Loki)", "value": "c65b10c765388c4f8b5001bf6761ec006d661d4cf01f27802fc0f31a3d995080041798fb67d915c2fe0b91da3d5962f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866527, "uuid": "ddbcb8bd-713a-4ebd-9fa4-a3514b0836eb", "value": "T11034135A98C89E7FF9675CB809F623F8F7F1914013D2A7D34F546C560E612C38A2D2A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866527, "uuid": "3071b0f7-7344-4d4f-a913-a8070ddb02d3", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866527, "uuid": "d08f35d5-e053-4062-a77e-63d61485f988", "value": "6144:rGipo8Ot26S9YDhvL3Ot44JDDAmljZvBH:28Ot4w3uDDlVvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647866527, "uuid": "82add578-0962-4b28-a829-b743936d4c48", "value": 240914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647866527, "uuid": "db5bde5e-4736-4a96-9f5f-4377761ceb1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647866527, "uuid": "3b307768-2e34-40e7-a89e-e761341431cb", "value": "6d343fcaf5359df3a3eec56c0bf8c723.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee774cf-a94f-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647891836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647891836, "uuid": "361989d1-8084-4151-a10d-516961fa9bb9", "comment": "Malware payload (RedLineStealer)", "value": "c0e6a8bc3158d5518c8eb1f5673bb0aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647891836, "uuid": "607fcb01-6e47-4c7a-982c-bf430fc6d4c8", "comment": "Malware payload (RedLineStealer)", "value": "bd40dbedac3d318a0eb4529c4bbc0a8d4fac5a4184adebedfad9d5046ce46c62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647891836, "uuid": "af2437e9-250b-4454-b52e-16fb8467c4e3", "comment": "Malware payload (RedLineStealer)", "value": "54951792af59cedc5dd24b9c56945aa763475e90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647891836, "uuid": "827f7a45-6c75-45b2-a8ef-875112bc39c2", "comment": "Malware payload (RedLineStealer)", "value": "dc170ec382eee62fe4e714195f538d1c40cca1d70c85d9a5cfa2aa2f35a7fb01b1752d6e34b3d96dfbf9d576b8074a5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647891836, "uuid": "ad81b62e-c4fc-4da7-a6f8-2fe06a57302b", "value": "T152553322CB8564E4EEAC833744E313A117A7F7941E3CA70D5162BD49D43E732BE9532A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647891836, "uuid": "a9815c77-96a7-4f80-8a20-a200c7bd0a11", "value": "c507eff7416a056fcaea697345f91b4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647891836, "uuid": "f36f261a-324f-4433-8343-6b244201a49e", "value": "24576:f2V6dGN07TZpmDdIuLddNxl5+sdgZkhUMx1ONk0BazbCgVxQY/DhStaV:f2V9mnoddL1xb+s6ZzmONz4bdV2Y/wIV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647891836, "uuid": "09542ad0-1592-43c9-8530-1218630dd911", "value": 1287056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647891836, "uuid": "beb0ca93-499f-47c4-b6ed-577fa889a912", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647891836, "uuid": "00e9fd47-35a3-41ec-b79c-36c0662d5d42", "value": "bd40dbedac3d318a0eb4529c4bbc0a8d4fac5a4184ade.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc3a878-a931-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647879244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647879244, "uuid": "c60f32b4-e5ff-4b9a-841a-43ac612e9e3e", "comment": "Malware payload (Heodo)", "value": "1c740eaa078a3d216d73fcff7b001104", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647879244, "uuid": "c6cad4a7-048a-4e3c-a4a1-5c8b50db862d", "comment": "Malware payload (Heodo)", "value": "bd799ca9379c2cff1a7a6412adaa791336509cce9d933ae0786268f72ec72bc2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647879244, "uuid": "3a72016c-8c69-445f-bf6f-4a255dec8917", "comment": "Malware payload (Heodo)", "value": "86941c0d5720d76d960433378f0ff3252639de6d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647879244, "uuid": "937098bb-b9bb-401f-952a-bc9adfcaea16", "comment": "Malware payload (Heodo)", "value": "223360309c61a0d02cc7b6f46bfd6a402f9daa41a336b89df43ee26fd1cf584b500d877214ea840e02a22205c97db5a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647879244, "uuid": "ed9c33c0-f963-497c-a7d9-6e7acdbbd958", "value": "T13D056C123DE280B3DA9B033448437AEA725BF612D738857F16D8C7EEC6727715A2D126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647879244, "uuid": "b9af9228-d51f-4294-93ca-79d00a6cf72a", "value": "973d97b59b04de30192c4429f01c1ab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647879244, "uuid": "b78422f4-8fb9-4321-be97-142fa585694f", "value": "12288:gC888pkASCkOhkOS222EWLGGtozjBynAP9/rO5CGNHrH2tZ+d+:gMV/rO5tqb+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647879244, "uuid": "8bfe996b-836d-4c3f-9fbb-697efb2a0f6f", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647879244, "uuid": "48697bdd-a705-4f14-954f-fafb163cedf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647879244, "uuid": "a1337d9d-c358-47e2-8803-0e3b0c6f0bec", "value": "1c740eaa078a3d216d73fcff7b001104", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c38a216-a930-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1647878598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878598, "uuid": "0ce55653-be17-4e8d-963c-cdf551735995", "comment": "Malware payload (DCRat)", "value": "95d28a26ea388b7c29f6760bad5835bd", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878598, "uuid": "b52ca816-9261-4396-8d67-54f14aa759cb", "comment": "Malware payload (DCRat)", "value": "bdda6364d1ee783defaa82554c73dd628d1e616ed69da563afbae1c2cea2d6b7", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878598, "uuid": "2b479a24-bfd4-4a6b-8c0a-5e93bf900fbe", "comment": "Malware payload (DCRat)", "value": "fb8cb6ba22f7fdd65eae3ac397a38b13e80ea6cb", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647878598, "uuid": "fee8c784-858d-4ab3-83cd-619be3dc3789", "comment": "Malware payload (DCRat)", "value": "fed22963ad705f5ac59de9bde8a5029fa7a8674f42645f255a72145f3aa8e51556129ab58c678c5b8e7026f360f26e84", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878598, "uuid": "dd374f50-1d23-4566-88a5-edd4873798c0", "value": "T10F558C027E44CA12D0668A33D9EF901847ACBD432A2BDB1F7A9A379D16113E75D0E5CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878598, "uuid": "cd62372f-c244-4017-ab0b-429a7cdbd3e3", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878598, "uuid": "f4068f28-1bf7-4dab-8a22-0ec528346dd9", "value": "24576:U2G/nvxW3Ww0tkk3E9hxllahmh9SP5U83mNlUgpGYf4PRi45/:UbA30O9SP593CltEI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647878598, "uuid": "bde92c89-03bd-4bf0-aa79-3c53a6fded9b", "value": 1370338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647878598, "uuid": "69b10015-ee51-4fce-b075-ec870ea74d50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647878598, "uuid": "04053c95-5ce2-4286-9ecf-38b22399b83b", "value": "95d28a26ea388b7c29f6760bad5835bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa2570b5-a8fb-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647856072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647856072, "uuid": "a6c80881-ad2a-46d5-8027-c8300f7d2e4c", "comment": "Malware payload (SnakeKeylogger)", "value": "1f970b3aefc19bdc7ca821be795a7c45", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647856072, "uuid": "9a884c1e-89ac-432b-883b-8ba48e95f0bf", "comment": "Malware payload (SnakeKeylogger)", "value": "be93f1181fd377c66d3178b695dbb69dfbda5ef9e03edbee7696d257cb970832", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647856072, "uuid": "d0f628a8-9e86-4c1a-bf9f-86b177cd421c", "comment": "Malware payload (SnakeKeylogger)", "value": "3e2997d67574f289c83b28d217dcbd757697f549", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647856072, "uuid": "f17f185f-0e76-4b05-808f-c1df6ee2bec3", "comment": "Malware payload (SnakeKeylogger)", "value": "8208f00b9cfafbbca61f17fd85152368c2c47bab29b2c6f415bfd1e4e5a361995211d643abe948b15c94da7fd4f3134b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647856072, "uuid": "16313a6f-392d-41ab-825f-d275b7171fb5", "value": "T1B0653373288DD813E71A96F653F5228B47343774FF621AAEE5808384DF4D29486B8772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647856072, "uuid": "3a1c660b-2359-4a2e-a515-09ebee8bb96d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647856072, "uuid": "e1fa23ce-1781-45c1-8f3d-41158707f83f", "value": "24576:DYjPA3fTZa4QNmR6GUSB18BiVbwiesQhIxElHJ1hqYf5h8Y5Vwy0SP9P:QP6a3mR6YHsieKxElHLRiOVwj2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647856072, "uuid": "a15fad16-9244-444c-88a9-3eb414d96cf3", "value": 1532928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647856072, "uuid": "7c6529f9-7632-449a-862a-4ad2830f7a20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647856072, "uuid": "2c7e1f9c-1699-46fa-8b5c-4e97d26bd4ae", "value": "1f970b3aefc19bdc7ca821be795a7c45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0983d7dd-a8cd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647835912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647835912, "uuid": "92184aff-66f9-4b5a-8725-530960b215d4", "comment": "Malware payload", "value": "c15ef7531e3b7f702e31a4a8c6a3533d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647835912, "uuid": "e44b366f-f1a9-4da6-a415-efa46fe46bec", "comment": "Malware payload", "value": "bee5f76f3cc9bf2ae2a71a4136d7b3d110e43cef60bb253a3a7301b3f58e5d9f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647835912, "uuid": "f3b9ea32-d1d6-449a-98b5-3f5adebc6fc1", "comment": "Malware payload", "value": "c9e5cd30b2e18dc42b70a5f6f1276dd883c7abae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647835912, "uuid": "5139df4c-b416-44ba-bea0-6f2335d7c77c", "comment": "Malware payload", "value": "588a9c9a066938962fc4e71ab79712b13a901aceaed9e10e5fe575c05821aa5102f88c6c8cc026af4566296115404a1b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647835912, "uuid": "85e603a6-44c1-4d04-898c-6744ee528e78", "value": "T10C549E40B7A0D03DE1B311F8757AD7ACA53E7DA15B2194CB22D62AEE16346E0ECB5307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647835912, "uuid": "b98a6c3a-7a8b-4a3e-8581-abb656cd2842", "value": "cbe2a3d9f5bb4fa7c1fbeb2b00df447c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647835912, "uuid": "352eeed3-685e-4dde-8d8d-208c2cea4d3e", "value": "6144:XVKNM7BXB925vU51GOlkkF4tVrBDqZQ2kdPw2hPok:Xo4BXB9SUbVhatnF2kWM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647835912, "uuid": "455026b1-ab83-45b3-8a50-83c91d7e312d", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647835912, "uuid": "76ef9e54-146d-4c3e-94fa-8fbaa989da39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647835912, "uuid": "333ef0c9-aad8-4e45-b7ec-55511e7a6b6b", "value": "c15ef7531e3b7f702e31a4a8c6a3533d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e1c17dd-a8e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647848160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848160, "uuid": "5fd7192c-7a41-4c55-b540-6b019d2adae9", "comment": "Malware payload (Mirai)", "value": "586cac7f7abb2dc0cd18e68a8d8e8caf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848160, "uuid": "d79ef1ef-098e-4a5a-8252-d9fab1142633", "comment": "Malware payload (Mirai)", "value": "bf077cf4d60272e8bf2d08c7040c1c07077f5d18afc4533af9ef84fa8155d43d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848160, "uuid": "d8d4c9fc-e429-4266-97c6-71b9cbe1b139", "comment": "Malware payload (Mirai)", "value": "ec001309d6bbd9406da9f10e7271b20b46b2182b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647848160, "uuid": "579b4dc3-37dc-4e28-90b7-f1a9f3df526d", "comment": "Malware payload (Mirai)", "value": "81cad5d520fa671b296c9a83684a70462fe2ece78fc2b3e1935d08498f7bcdb3c6e518fbca21881af64e305c87b24e00", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647848160, "uuid": "6f89c2e0-55c9-4236-8bed-e7d31669d15d", "value": "T129933B86E602C6B3C4431BF502AFAA5A0732FD2A4A3B8EB6F71C7DF45B119C53215791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647848160, "uuid": "5eaa90fa-1563-4265-9400-64c8c927be01", "value": "1536:WJ8423LJOxYRQzdmbWzKWQC8jIOlfPUEikuIK5hN9aEGTWshe0QzUzJYQ2Wk:o2QxYRQRuq98jIOFPUEuN5hN9atWUe0e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647848160, "uuid": "241bcf95-6cc7-4a47-82c2-4d788f4dcb88", "value": 91540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647848160, "uuid": "7dd8a2c3-7000-478c-9e84-99ecf7a44b2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647848160, "uuid": "a74882b3-7957-45d8-80c6-e9c437877e7e", "value": "586cac7f7abb2dc0cd18e68a8d8e8caf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5419f448-a8f3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647852358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852358, "uuid": "3652e92f-2156-4069-a549-bfb584408240", "comment": "Malware payload", "value": "91d625e0455fbd983c1d6ae917dadbaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852358, "uuid": "9c76c4ed-a133-461a-8641-52a455464a99", "comment": "Malware payload", "value": "bf14a837708964f6079828d4a86b1a0d7037ca3f6342f56d2efe20cb13df1113", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852358, "uuid": "4e4713cb-4328-4946-9f4c-87ab9cbbc519", "comment": "Malware payload", "value": "1cff839348a009f2783f8b19a8c6a77072309031", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647852358, "uuid": "a3fe7ef8-496b-4e57-9054-4fb3ce67389c", "comment": "Malware payload", "value": "577eef3fc829e090740acf80c0fd47ee125e924313f767998f3a360a7e12b6b078e3a6f7c71dfd8b0ee9b051e24fa831", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852358, "uuid": "4a54fc4e-fbc5-4692-9249-861214f6ff38", "value": "T1D313E1BAF6AEC675D8CE66BC96CA0C252332E2C5CA45E08F01D86C781453C27625B75F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852358, "uuid": "420aca43-39e8-49af-b273-713eeb12f1a3", "value": "768:jdkdT2UY0B97yegwDrs+Dy6HqhzwvvVMMlpU4qxV/5wR4YCPFqfR4BKN45k5hs9q:C2Un7gwDI+ORZwvzU4qxV/5wRFvZsKKI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647852358, "uuid": "ee87a4e3-0ba4-43ec-bc5c-cee09af235b0", "value": 44929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647852358, "uuid": "313bdd43-c2ff-4df7-8a2b-35a58e2f2ee0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647852358, "uuid": "645b7baf-6964-48b7-bf94-51ff1a9e83b7", "value": "91d625e0455fbd983c1d6ae917dadbaa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ae7a3f-a947-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647888655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888655, "uuid": "7c833add-2633-4301-a489-90c7e095b38b", "comment": "Malware payload (Heodo)", "value": "c7e07f9b69cf2e03653a0d425cb1e702", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888655, "uuid": "8e3d5efe-a305-4b6a-a4a7-f3cb2a91a054", "comment": "Malware payload (Heodo)", "value": "bf46ca1f8e1075d537aef50f227859a149cc1aca281bc481ccef13d00a1e8c10", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888655, "uuid": "f705d7d5-be0c-4385-b1f1-69ae718556ef", "comment": "Malware payload (Heodo)", "value": "dfe1e2dd3890f482dd37814e7178d637962fb1c4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647888655, "uuid": "27df9829-b5c9-42b6-a4b2-6762a18e3ef2", "comment": "Malware payload (Heodo)", "value": "a518f7869e2b447dedc35d16f4f561b61254771c83cc28cea3039a53ed8c4e4663ccead6846df17848bc46ec7469148e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888655, "uuid": "46742ad7-6811-418c-8159-f1b0b52ae31b", "value": "T1D4B43A11BC916832C36FAC7456073262588EE7F0DBD1F26FA3E0495C9A7C5E36624BC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888655, "uuid": "15e2f7de-a918-444e-a955-a9ed085aed63", "value": "14e6ae8d1400b6271725b3f01025b85e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888655, "uuid": "57505cd0-ee85-4c63-9c63-b0d516f5d68d", "value": "6144:VikzyaB9eoCyx/mEhHB5RYSJ/x/+qiCjzQNPj79GkqbscgCG5qH6scI:VNnCGmyHB5SSJpy0zQN39GkUGQSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647888655, "uuid": "5de7ac64-bde7-4fda-842a-e371c654049b", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647888655, "uuid": "3532f11b-53e7-4171-8ca2-03d35fe11de2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647888655, "uuid": "69dffad6-c0f7-4f6c-9cc8-479377312e7a", "value": "emotet_exe_e5_bf46ca1f8e1075d537aef50f227859a149cc1aca281bc481ccef13d00a1e8c10_2022-03-21__185046.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "608e50fb-a8e5-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647846366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846366, "uuid": "22cb8f54-203f-4865-8f81-af084ec9dae1", "comment": "Malware payload (AgentTesla)", "value": "034fa582e0bb2881e2e743bec6c1c8e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846366, "uuid": "1e398065-6182-40ec-8443-d8d03d2477de", "comment": "Malware payload (AgentTesla)", "value": "bf4d80e2514ae5284dcb0db44946adc67640f8a005049951ee46a03f80c1d3b5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846366, "uuid": "489e4aa3-8851-4a6a-9adc-e4342ec343a5", "comment": "Malware payload (AgentTesla)", "value": "d69c6b3b68ab49a6f30f67ffc02917cb6a0b404e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647846366, "uuid": "3e6a5bb0-81c3-477f-b815-f14afd662a1b", "comment": "Malware payload (AgentTesla)", "value": "df9f2f2de4443bce6b652c88ac4c080dfba8cd46fe9aa5552e343471cbf5d82f29c57b2857263a669b7d0b7132599208", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846366, "uuid": "6b0c4ca8-972d-4a9d-9288-deade412ace6", "value": "T161522AA86FA8C5F0DC661ABA6CB757101638B612E859DF1F71C9720B6D1320145B2B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846366, "uuid": "33d46123-fe73-4442-a22e-c8cc8bc1f04a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846366, "uuid": "fded15a1-9da9-4342-9413-12b5b52c6f26", "value": "192:Fbd47z9ugRunU/MbAsKPVPwO92fiiLX2HS9yxSyrsRt8G3mSF6zgtMG3:FefunyMhfkYiiay9ycyrsR2vZstMG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647846366, "uuid": "4c856549-1dfa-4e99-8da5-77068d1eb918", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647846366, "uuid": "086ce5f5-494c-498b-b209-af5ce06b9d4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647846366, "uuid": "9ec8b066-9be2-4366-9909-b0093cf4e45b", "value": "Vlwfp8765456789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a0f989-a8c0-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647830728, "Attribute": [ { "type": "md5", "category": "Payload delivery",