{ "Event": { "published": true, "date": "2022-02-06", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-02-06", "timestamp": 1644192182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "75e777f2-5deb-42de-87df-6db0c355ae94", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab601cdf-8722-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1644134351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644134351, "uuid": "412f357b-5fe5-42bc-84c0-2cb4e0105a31", "comment": "Malware payload (DCRat)", "value": "69064616f835436c13e3e077923d3c8a", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644134351, "uuid": "26ffdeec-e59b-442d-9d78-87954831ebef", "comment": "Malware payload (DCRat)", "value": "01fd13fc15526f6ed05b54ab72e95189cbb499e35f6343918aa7a76d92cbc3c5", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644134351, "uuid": "d35c8bc5-914c-4e52-8f44-ffbdcee5f30e", "comment": "Malware payload (DCRat)", "value": "9baea2e0af99996b67c05a31ae4b949213954279", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644134351, "uuid": "d4b7f00b-adf2-4a5a-9e97-939cc5419e83", "comment": "Malware payload (DCRat)", "value": "4b673725c33994d3eca728b3051d5b38e5189e2722003dcd9da12444b9e1f4e1374a539c7dc8e44e0fd20576d8056f85", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644134351, "uuid": "2683eaa4-4f59-4cd5-9ed2-6c561ed7da53", "value": "T1A9335B3473DB4B23C7DC07BC8DAA534582F4C6139612CB8A5EC097FB29667DA42612E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644134351, "uuid": "323b72e9-7d83-41cb-a381-872827f1262a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644134351, "uuid": "46929fb5-96fe-4268-94bd-ed1c9eb86cf9", "value": "1536:ZY7zsLHtBKIsQNcwCjg5C6eJT9XCOiJq+1uJSInT:ZTLDrD1QgkvR9XCOiJq+14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644134351, "uuid": "954d9d12-f6c2-40ee-8daf-94a1205b8490", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644134351, "uuid": "a049925c-c6ed-474c-9a30-3275178838ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644134351, "uuid": "75a7815b-dae7-46fa-8ee5-239455d1b374", "value": "69064616f835436c13e3e077923d3c8a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e500efd6-8729-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644137454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644137454, "uuid": "a79643d2-7e97-4536-b452-2ab0997186a3", "comment": "Malware payload (RedLineStealer)", "value": "19b1319a724d76ed2de90d5fa3c98efd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644137454, "uuid": "9f631378-d2d9-438e-ba2d-187e6b4c0211", "comment": "Malware payload (RedLineStealer)", "value": "027dd9d41ae5364eafb8ad151321a32b1b7d1d20eb02db7bc2c94dcfaceaff95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644137454, "uuid": "df76caaf-d884-4db6-8f5b-fc22d4141be6", "comment": "Malware payload (RedLineStealer)", "value": "04a0101f2e56e6c55a74cfbd0b8de4d390352220", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644137454, "uuid": "e6bee346-8752-43de-a866-f2853870bd7c", "comment": "Malware payload (RedLineStealer)", "value": "601871859ec42da090f4a16e6e3333e97e0daac72466c7ee1626babf35da14823336e706ca8726229ae794c5376f3d22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644137454, "uuid": "7d5ac44b-62e5-4638-b452-4f6aa0a99e4f", "value": "T126648D14BB90C039F1F716F849BA936DA93E7DA15B2460CB62D52BEE16346E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644137454, "uuid": "488548fc-3295-4527-8210-1de29b466744", "value": "2f129e2bd6f90680b3617141b4faf74c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644137454, "uuid": "1e6fc3ac-5506-4cbf-aab0-4a0dfb17e314", "value": "6144:prMqeBFClZDcciGtOWU4fwMRIBENSrAwNfKo:pBECl5ZrAWU4f4BENSX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644137454, "uuid": "57696630-7b1a-4f3b-a490-60fb8e86e941", "value": 314880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644137454, "uuid": "ea662873-c7a8-4d46-aa5d-40ff80938ecd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644137454, "uuid": "1e617fe6-d2a2-4316-89e0-1f376f7301b6", "value": "19b1319a724d76ed2de90d5fa3c98efd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88df0bef-8752-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644154909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644154909, "uuid": "1f7ef11b-284a-4cca-8add-04c722bb79a5", "comment": "Malware payload (Formbook)", "value": "3fb88327aa69c953716dfe9313137618", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644154909, "uuid": "82417fba-9394-4aa6-a909-ac1188a6bff2", "comment": "Malware payload (Formbook)", "value": "02d141e25c56ee8d4f7262a0e75728039982f304c639a9757f4a1b28e4e31628", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644154909, "uuid": "9e09b09b-46ec-44e7-b37a-28839c3d481c", "comment": "Malware payload (Formbook)", "value": "da4e47140a2b2e4a84bfc1d411c0968a4f6d6ab9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644154909, "uuid": "0711787a-4d63-4691-a4a3-e57cd82d5f4b", "comment": "Malware payload (Formbook)", "value": "4d3a6414ca59415d980e5643eb4e3c30b69d37d7e05279ea0956f01571edb8052dd69aa07bbf156fd58e001a887e0337", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644154909, "uuid": "2a3a0cd9-6c63-4f77-a021-871a55f9c739", "value": "T10023F742D2A60363D6AA97F2B49357C307B5600E58E0CE6A9CC971DF09AF3156583FCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644154909, "uuid": "c9894eef-1ee8-41cb-a508-9fc2c6707b68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644154909, "uuid": "5c17d821-58a4-4d21-b523-21cc5c7f6357", "value": "768:WXdm8ufIFDpAgka/8HHUTQQQQQQQBdy3bI91GN6bcE/2ihWSCAtkrjL1FV:EvDpga/eHUTQQQQQQQBdBgN6b5/2kWSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644154909, "uuid": "a67e2ce7-5448-4f70-a8af-f3f191dff9b1", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644154909, "uuid": "bb00037d-5722-4179-98bc-23580c0891d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644154909, "uuid": "14386e6d-6a21-4e86-bffc-c2cc626fe2d4", "value": "BANK SLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bde51a3-8725-11ec-9275-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1644135587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135587, "uuid": "d24f5067-5ef4-4bf7-b80a-0fe65f332c80", "comment": "Malware payload (Vjw0rm)", "value": "c692ea8fe02da8778e48dc68498f34e3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135587, "uuid": "ba74c908-d3f7-4bbe-899a-67fbd7fb7d35", "comment": "Malware payload (Vjw0rm)", "value": "03d52abfd15cbb32ef73e80419d8653e104d11aeab19f3df157ccf532fe8476e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135587, "uuid": "84226c73-bc3f-49dc-878f-b55c42b9563c", "comment": "Malware payload (Vjw0rm)", "value": "6417731002149559480b25d1d79e9709f804a0e3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135587, "uuid": "f9157279-d36d-41b2-ada7-2bfb861c6f07", "comment": "Malware payload (Vjw0rm)", "value": "6a85a7882ba4409c36ea8360babe65de54fcb62c76e511d13beae80728fb0e72206881ea14455eeed7ba3d2cd4ff9c60", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135587, "uuid": "8254cced-3619-4d81-9079-33289a5544b1", "value": "T14E52BEE10B5D2F1511FEA5E48F3F16C72E2C565C93C1FB10288AC620AB5A76B6727838", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135587, "uuid": "2d86ccab-ff48-4670-8e96-b6ff83336c5b", "value": "384:ue1IvBgZbKEgIC44g6mOzU7QqC/sQMEFF/UjbC:54BgZW49WUU1NNFFMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644135587, "uuid": "62b0ef4d-8f5f-4c0a-a2d0-5eafecb0759c", "value": 13423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644135587, "uuid": "5e4d6a5c-7096-4f6f-8f0d-88c86cc1f94f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135587, "uuid": "7ac03b77-0f87-4d61-8590-737ebfd25ac7", "value": "YR6583.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36b44d95-8727-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1644136303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136303, "uuid": "29b6d055-7a24-45db-9f45-042ddff13225", "comment": "Malware payload (RaccoonStealer)", "value": "dc0ad30780b013edc6d44f42873cca6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136303, "uuid": "c4cab17a-9393-47c1-b4cb-b50108ab395b", "comment": "Malware payload (RaccoonStealer)", "value": "06dcc8ec05a3ec53b0066ce702d40993f9862644a37ddce050e03b23ba65a746", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136303, "uuid": "493c4fbd-ac52-400c-be66-cfa93956c819", "comment": "Malware payload (RaccoonStealer)", "value": "7bc36922bb282fb37ae76ca0ab584937a32555b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136303, "uuid": "aea41c61-d1e3-4c30-95ef-f24bb2c386d8", "comment": "Malware payload (RaccoonStealer)", "value": "619982e46731bd5dedb92b5e5466bfd1c7af98ad0f62db8501ac5ce1bde09685092e0e3fcb045d05dda89f92e6df5471", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136303, "uuid": "ce273107-4b03-4230-99c9-6238b04a2c4d", "value": "T11C751256B7D5A26DC66D1033C4A7000043FAAD8DA773EA0B25CC72AD9EF375D64292EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136303, "uuid": "4c37197b-c5e5-40fa-bc78-a447322a7adc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136303, "uuid": "329f1dad-baa8-4f9c-89cd-9752113078f1", "value": "49152:19uNl7LY1SdbexwgacTLvcEVVd0bYxMFc:Kloi+wsH7F0kxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644136303, "uuid": "c5826e5c-baf9-4643-a8ff-88ecaf0c2e6f", "value": 1690112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644136303, "uuid": "b6bcb852-be80-475a-820d-3b76888e7220", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136303, "uuid": "6fa0a54c-52cf-4964-88c0-effb463e4e84", "value": "06DCC8EC05A3EC53B0066CE702D40993F9862644A37DD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7faecf8-8781-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644175228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644175228, "uuid": "a5203228-106c-4fe9-b59b-b3c1a2832aca", "comment": "Malware payload", "value": "2f3445bfcf5c6d68785d96330fe5f83e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644175228, "uuid": "d176a7d9-9c20-4211-8b68-41889d6c1f40", "comment": "Malware payload", "value": "0713ce27fefb110cda3075fae74229170582c19758c2ecb7f85e0c0b8c694e0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644175228, "uuid": "b04980ed-b41a-4e9f-9a54-ec8b8d0ef95f", "comment": "Malware payload", "value": "84f69a58ef33baa90125a805c89fa4547d547f6a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644175228, "uuid": "4638451e-1f78-4541-80da-4bae97f26cda", "comment": "Malware payload", "value": "a6e6c33dd6f326427a1d7a71ae62dc0be40a42d8e71fa6c1b56e95bd3f5e8739d0e459061ff692c86661a3636587f9b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644175228, "uuid": "59a8fda8-a959-4b91-b2da-467a171760c4", "value": "T1CC940123F438E1D9D0E2A83AB9E33CEDD9D35C920F91301B6675271668F45A5DA38F06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644175228, "uuid": "aea2e2f6-0590-4aae-a927-575a9d558ce5", "value": "551b4301f9aeb36004eb1aab5782b909", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644175228, "uuid": "db6f981b-c20f-4cce-917b-1e927e439b61", "value": "12288:UnaVBnsQtxkpK/lGRgOUqmq9kR6lhKXimdkyF2di6/v3pSks5Ll:sCsQtxkpK/cRgOnmq9g6BE2oMvZ6l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644175228, "uuid": "ba5e1de4-74f5-4f24-945b-b3e4073edca5", "value": 446976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644175228, "uuid": "ed631c08-e866-48d4-a209-d08d14e69b9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644175228, "uuid": "46638517-d63c-4eb0-bdc8-935c144d63d2", "value": "2f3445bfcf5c6d68785d96330fe5f83e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27fc2010-8726-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1644135849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135849, "uuid": "aea631a4-2763-4b7c-b763-557d9b8fefeb", "comment": "Malware payload (ArkeiStealer)", "value": "4207793ab16e9c8f3c11f4c9d76f6c28", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135849, "uuid": "55b683e0-2ece-40fc-a299-a7914245dbc5", "comment": "Malware payload (ArkeiStealer)", "value": "087accfe67e00cdeefbdedd44e22db63ce50bfbf3187bc480f450e41f334a26d", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135849, "uuid": "2bae69d2-1500-447a-9b2c-df79127a9649", "comment": "Malware payload (ArkeiStealer)", "value": "3164ec4872a70a671077f177830e9b9a64fa259e", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135849, "uuid": "0f0ce9e5-88d9-4bb7-bd8d-e140368ba7b5", "comment": "Malware payload (ArkeiStealer)", "value": "b90693c4474b51981f3637c6098bf8edb3a9f7d4ac026f5be91d42a5834bb177c28123c9ea398f316acfa8994f572495", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135849, "uuid": "e307877a-a48f-4371-bf40-dd8ba32711f4", "value": "T1E846336328D4C543DD430D713C37976666E2AA6E18B62F9FFBE69B084CA10D1B97E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135849, "uuid": "30340b02-e878-4b44-bbf9-748721385984", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135849, "uuid": "570b2239-e996-4191-b9cd-1df8f52f1999", "value": "98304:JKy0s1ISS6g/c2rmfkFcJf9U84K2uVdGWE7pnU29Vo+oCaP1oHUO:JKXs6SS6gVyplS8H2qenU292ga2Hh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644135849, "uuid": "e2c0d52a-7ad9-4369-9871-e36fd6f40b3e", "value": 5473153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644135849, "uuid": "f5e6726c-18d0-49ca-9ed0-4eb86b3439fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135849, "uuid": "7dd868a0-d3e7-4088-a40f-fef32876f016", "value": "087ACCFE67E00CDEEFBDEDD44E22DB63CE50BFBF3187B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b9fce4-873f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644146797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644146797, "uuid": "170d71bc-71c7-489c-95ad-5c8288c8bbaf", "comment": "Malware payload (Heodo)", "value": "baa52a327e766fb956ef5f3e4795441c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644146797, "uuid": "e48b013e-e478-4a65-8b5e-0e795415e9a3", "comment": "Malware payload (Heodo)", "value": "0a7841824561cc436cbe491933afbf28c4467d382237618b5dfb702210a48e8e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644146797, "uuid": "19ab1d8d-c146-4c4e-9dae-7b11e8ca7c9c", "comment": "Malware payload (Heodo)", "value": "f859194c76a898be0c90eb50e88efab87bb07676", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644146797, "uuid": "b9e50431-f952-4f84-a509-8c4fc7d511c5", "comment": "Malware payload (Heodo)", "value": "b8d732cfae0ccd2fb8b0c97c7235e531a8bccf49a63f2b5965caed3debb27a66c1b1b15ad8287d0ec6c9b634f7f688bf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644146797, "uuid": "b58267ac-16f3-46f8-bb78-d308f63732e4", "value": "T12B943B9EA144DC31EFFE63F151E5CBA3C15B9430275849AFE7FC91761A3CA988238582", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644146797, "uuid": "8b54bcbc-6da1-4f98-8bc2-c29558c16ee5", "value": "7f57698bb210fa88a6b01b1feaf20957", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644146797, "uuid": "f83ca4b1-ab7c-424d-b3ae-50f095631cf7", "value": "6144:cNU5LwA22222GgngDrDRVyYli/ci2tEGW78ODQiEBtvOSk5DKXOW14IkFxZ:x5w7YM/cYVV7EmOpy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644146797, "uuid": "6e1571ed-15a8-47ff-bffc-52a9e38d01e0", "value": 425328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644146797, "uuid": "c3b51bda-c436-459d-80da-4652f8cf03b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644146797, "uuid": "04c796ff-da3e-45e5-947f-05ed9a351ece", "value": "emotet_exe_e5_0a7841824561cc436cbe491933afbf28c4467d382237618b5dfb702210a48e8e_2022-02-06__112632.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21099252-876e-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644166761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644166761, "uuid": "377c416b-8296-45b2-b0b3-377dd6951e1f", "comment": "Malware payload (RedLineStealer)", "value": "2e3c140cb698663bfee8b28bcf5507bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644166761, "uuid": "35f90740-8570-4581-bc95-44f2ae53a10e", "comment": "Malware payload (RedLineStealer)", "value": "0d0f52ef9e0aada7ca77555d606b5f3b710657cea63da4870a6e74ea99083abf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644166761, "uuid": "7b9a23dd-7602-42d4-9f5b-32a513487a3b", "comment": "Malware payload (RedLineStealer)", "value": "33c2f781a3a0b0f15c1df7958e80a84a7df5a7f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644166761, "uuid": "6d362b2f-5eb9-41b4-802d-fe9323579e62", "comment": "Malware payload (RedLineStealer)", "value": "02baa4335f7a664a3882d8b0d4092e58f8b401abf58e6a54b8e43c0fdcec9be2e9da09f68221998f20d720ef5024a3cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644166761, "uuid": "8e9eeb26-e6ad-4461-a9b8-1b3e2bad6d4c", "value": "T1F2952342B719E96FDD594031B40BEB331F64B465EE62299FB00BF21728A0B13586F58F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644166761, "uuid": "13d1e140-be26-4f66-8735-6ffda90decc1", "value": "a837b169dad537723ef2f43a259fe125", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644166761, "uuid": "e46398bd-c695-40f7-a2a4-a92285968850", "value": "49152:TU5qDoWlVYj4VBaIi65Gr/G8jLj2oQ1cZmnh4mD+GsDpkxU4KS9/h1/Kxs:TzDLnHaIi6m/G6LbbZmnGZ2pUxs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644166761, "uuid": "492a0fea-698e-4a48-9e80-0b16fb77619a", "value": 2001208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644166761, "uuid": "2863aff3-c2aa-4816-9691-ac1cbd5deb78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644166761, "uuid": "5ea4735d-7447-4e5a-8f26-728b784fe33a", "value": "2e3c140cb698663bfee8b28bcf5507bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a91bf3b-86e0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644105815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105815, "uuid": "29429f04-a32d-4918-bd04-eea4435c55f5", "comment": "Malware payload (Heodo)", "value": "b6ffdbcbcc4e7daf7f964d3f95a46917", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105815, "uuid": "27607e85-fd44-43a2-bd35-2ce05f0b9f3d", "comment": "Malware payload (Heodo)", "value": "0d472870d1af1876acd62a19ebe8088e7d7bcc7d750f5fb6c55abaaec4760593", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105815, "uuid": "7423a848-f634-451b-8c41-c8759a327a56", "comment": "Malware payload (Heodo)", "value": "4e6dd989e4ba0ed3ac02c585f945f6e0f0ec786a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105815, "uuid": "dde937de-315b-471b-b526-c1cded7595c4", "comment": "Malware payload (Heodo)", "value": "5650ce63a4f83fdfdaf3cf6d448676af4fb17e08c24926b82664aca343b7074a8d1376847441750559a5f7fee9d94ddf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105815, "uuid": "e4057fff-0d06-411a-9850-9d0543e6d7b7", "value": "T1AE25AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105815, "uuid": "d9973890-1d09-445d-8e96-efd4bf88e7bc", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105815, "uuid": "42a45921-ca06-4664-871e-82b1eefbed64", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxAfFIIm2m42:1ZsYB7vLsnZI1Hb9DnFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644105815, "uuid": "69c95355-a5c2-49d7-b06d-ac5a499f0e6c", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644105815, "uuid": "3ded6116-6d32-4ebd-8412-6c30331f64b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105815, "uuid": "5ccd98f5-41db-4415-98a1-f4b5e2407015", "value": "emotet_exe_e4_0d472870d1af1876acd62a19ebe8088e7d7bcc7d750f5fb6c55abaaec4760593_2022-02-06__000330.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4779fb96-86e0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644105837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105837, "uuid": "7e32e2e5-e234-45ab-8b44-38d315382c52", "comment": "Malware payload (Heodo)", "value": "bd63ba94e93dd99c4b69f56029c2bce1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105837, "uuid": "39d09fe2-f87c-48e8-9301-efc7b268dace", "comment": "Malware payload (Heodo)", "value": "0d83fce04f4873f6310a7aba27a07781de647e5286a04b1b436fcf5d691ff5ff", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105837, "uuid": "17152091-9613-4a1e-978f-4a8b60e35f5a", "comment": "Malware payload (Heodo)", "value": "7ce2a14bcbc5dc7b168fd800b5ca8fa4f16abaac", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105837, "uuid": "6db519c6-2c31-45d4-9fbb-baa0f2d791a6", "comment": "Malware payload (Heodo)", "value": "3cd78645a66a96c1850b0eeb0fd6756a5501bdf6aea1db907f2ef0ae8bd7b413e2e5ddd7448ff38e763c156c5728829d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105837, "uuid": "12c149e2-1883-4d5a-8609-5f27c46d8128", "value": "T13A35AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105837, "uuid": "12556ae1-2262-405a-af1e-6708ce35183f", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105837, "uuid": "bc87a856-3640-433c-8ee0-c1a60c6ff0e0", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTfFIIm2m40:wfv1GVFF+765nFvFf6dlzzSrFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644105837, "uuid": "cf94328a-90b9-403c-9494-ad1849a401f4", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644105837, "uuid": "577dc81d-2c93-4ccc-9423-76fcb136033c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105837, "uuid": "66f76f84-389f-4fe5-8053-1e2732c0cc53", "value": "emotet_exe_e5_0d83fce04f4873f6310a7aba27a07781de647e5286a04b1b436fcf5d691ff5ff_2022-02-06__000351.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3392bb67-8725-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644135439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135439, "uuid": "4536f3d3-b78c-4237-9e61-67084d5dae39", "comment": "Malware payload (Formbook)", "value": "e72dd71506d7d0fa7e7379df78963da7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135439, "uuid": "21dbfab8-198f-47bc-8cd9-77375866f780", "comment": "Malware payload (Formbook)", "value": "0e60ab02aa9936b071370ea4d7163f77da68cc6eedb562016311e53f67502405", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135439, "uuid": "5ac19845-bd8c-4735-8c23-ba4e7b091efe", "comment": "Malware payload (Formbook)", "value": "1a191a5df531d36bfe0b754763356f5ae1fa3e32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135439, "uuid": "18fa2500-c8b5-4e0f-af38-e111299fb45c", "comment": "Malware payload (Formbook)", "value": "35f8280e8bd9c240547b4e40a971c45d9db95593de2171349e2fe05954138750e96a4f7e7a3b62d7f8c8c95946ff7162", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135439, "uuid": "0b239ccb-732a-454d-9e41-ed235da5b234", "value": "T19444125636CBC4E3E4414B726EB2E3FEE3F7E6049B1901576B30AFAE54250812B514AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135439, "uuid": "2634cdaf-9b85-437f-9403-605497d01d6a", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135439, "uuid": "78200d07-cb84-4947-99a4-7577fbaf612e", "value": "6144:owZr3x2g7oaWFfOudvlhDEo89fetLCQTrZW5mASC0MvXD6S:1cFJhwb9mTZUSK/D6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644135439, "uuid": "75fab358-cafc-414c-bd68-0fff7ff39085", "value": 255386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644135439, "uuid": "6a494875-7164-4c63-b4a3-53f6d59a8273", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135439, "uuid": "760e738b-9093-4d70-960c-aa1df9402b77", "value": "sipari\u015f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4029289a-8726-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1644135889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135889, "uuid": "5795bf1f-58a6-422f-8469-b4b05bbd9cc7", "comment": "Malware payload (njrat)", "value": "a61e77d07da2145a9d706e73d236803a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135889, "uuid": "49ca6595-af09-4f08-889a-191bdfe9baa5", "comment": "Malware payload (njrat)", "value": "105585259cc5bb718f916a97d5eaa9f4b19c249f79c40ed7f53c1d379fa1f41c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135889, "uuid": "626ab6e9-3383-4075-ac84-8a25a117785b", "comment": "Malware payload (njrat)", "value": "9b3d733a20e9e1da5b3766d7dd6cf29b08cde934", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135889, "uuid": "2d87fe79-d63d-49de-8c88-ec2461ff1c6f", "comment": "Malware payload (njrat)", "value": "ae850f3ab5f9799373d3ac21435c9f7ca88e724e6f13c37487e3956a19b01b509f75394fbdcfbdc90baacbfbfff67f27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135889, "uuid": "80a7dd7f-1343-47c9-9ddf-091f196009f6", "value": "T13A4533EE2CD54B05C9652A351C84C266B26F7C91BC5326F2AC9107670EEB7B667033D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135889, "uuid": "79db5820-b942-4257-a54d-2d76ca303a18", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135889, "uuid": "9d303ba1-b438-4d41-b619-b214937bf27d", "value": "24576:NfvPWvvrXkC0z7drjpgQsoJAGySfW5MGXzzYra6gG6:NfvOvvrh0PdrjOSJ8vz4wG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644135889, "uuid": "43ea792e-3723-48ad-8351-dff0c98b0667", "value": 1167872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644135889, "uuid": "d4261db4-0bbd-4545-9f7b-6d3be30f240d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135889, "uuid": "1cdfdd15-851a-4bd9-a02b-123d8c6fb570", "value": "a61e77d07da2145a9d706e73d236803a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f3a9d1-8725-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644135434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135434, "uuid": "a9d29085-a10c-49ff-af89-e64c9e3ba93b", "comment": "Malware payload (AgentTesla)", "value": "e7ff8e79bca534c79db09ca0d4cd5348", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135434, "uuid": "b721507e-f605-4b9c-b2db-e5969cc8b89f", "comment": "Malware payload (AgentTesla)", "value": "11ea6d289066e0253b4c8096b4da52c86fbfabc5354d396fd1e09cdd460648fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135434, "uuid": "b36e1603-329f-4e28-9ffb-b8ff807ba0d6", "comment": "Malware payload (AgentTesla)", "value": "4382d057603d4cbc9a3aec509cb85531b55f5bcf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135434, "uuid": "30869e62-0994-482b-b524-1b4c259ee05e", "comment": "Malware payload (AgentTesla)", "value": "685d25ef88200d3533497360b68d5bd4090f0f27d112908bb71017bb59fed483641db393c2263ad1a29026227c8c5f38", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135434, "uuid": "4499ebc1-177c-4b1e-b9f4-b8c19caeef97", "value": "T194C4D09079B94BA1E47E9BF81539B8A007F1316FD4D6E61E0ED961C66EF0F021A44E0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135434, "uuid": "e6046f1e-51c6-42e5-bec8-d888ef3b122f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135434, "uuid": "7b09e965-c7c1-48f3-8025-cf74fd2224ed", "value": "12288:1Vo/24YO2RoHdxcFQMlEk4ZBEyJ9weMnQXMG:ElYDuUyMCBEyJ3fX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644135434, "uuid": "c3f0f8fd-25e4-4d92-8138-bfd3f93b6da0", "value": 563200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644135434, "uuid": "89fcf59f-a8cf-48e1-a8a5-253f8bd5f657", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135434, "uuid": "57809cfb-5461-49e4-bcbb-1d95e5d2639e", "value": "e-dekont-html_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32288fa7-8726-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644135866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135866, "uuid": "6a806c82-774c-4956-ac7d-c178e74fbcba", "comment": "Malware payload (RedLineStealer)", "value": "89f0d3922b9e79f068ace3ead1b9f926", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135866, "uuid": "a804871e-6bd1-48d6-ada0-862a293d4cf7", "comment": "Malware payload (RedLineStealer)", "value": "12916682d393bf72e10dd771ec88b4be82df8cdd1ca135e5c281287f31cea7e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135866, "uuid": "7fe5d9f3-5adf-4442-a1e6-f159bbef6629", "comment": "Malware payload (RedLineStealer)", "value": "0428c2bfdfbaec8910fea3147231f2f4397ba301", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135866, "uuid": "74f6ffa8-a41c-47d6-afcc-265a6fc22de9", "comment": "Malware payload (RedLineStealer)", "value": "cdc6760eb40d4bbaf97e15625aa1795fff55ef0538045871114d693102acabdca7aaa23da5a0883748890a3bff1fe28a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135866, "uuid": "a351e9fc-d97a-4ca4-866a-5d4359080f8b", "value": "T102F533E25A8DDDFAFB644479C96895204084FFB089F8123DB6B3B90D977575320E32AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135866, "uuid": "ac63f0d1-0d58-4919-a87d-6f80566d58f1", "value": "8a628d8df3c7d5d462802d0b092264fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135866, "uuid": "4f931994-b68b-4a49-ab27-7045a93bd181", "value": "98304:NEOuXXTTeXvRZmo9V0AGLFiT7bzr2LJJ:BIGXvTmoQm7bn2LJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644135866, "uuid": "43b149a4-7b21-46cf-83ef-c5dd6810855b", "value": 3582848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644135866, "uuid": "98b1e94f-6147-4092-ae84-4007f5090d0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135866, "uuid": "0241afbb-1879-446e-95c8-ad464e0baf6f", "value": "12916682D393BF72E10DD771EC88B4BE82DF8CDD1CA13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74dc0b6f-8725-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644135548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135548, "uuid": "4111d3fb-1b2f-4bc5-aecb-5a22673a17a6", "comment": "Malware payload (Loki)", "value": "d4b6067f05156013f8f8ad271e4649ed", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135548, "uuid": "5770b055-7b8c-433a-8395-7e78bfd10e00", "comment": "Malware payload (Loki)", "value": "13947b2724583f8c59baaaf703ab547b83b5781d54b16b991b1cd0841ef6b52b", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135548, "uuid": "87cbe65e-d65f-44d7-8e1c-8a65147846c1", "comment": "Malware payload (Loki)", "value": "770e0730b309e3410967d1a3490de6fc6f0fba94", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135548, "uuid": "a5d75126-37cd-4133-9084-c580638ad37e", "comment": "Malware payload (Loki)", "value": "153e5c8cc7b19d082aa9a5f7ae6d405ec08db13cf0d7b4ca7c8b2c8e2e51e74095d681f6cfcc31cc8c3d8c800388fd3d", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135548, "uuid": "df9647b5-d7fb-426c-accc-7284cf8c016b", "value": "T1D964DFB0B1EB4694F56B9BB57139B8A0077231E389C6C65C0B6866885FF6F446F04A0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135548, "uuid": "612811e5-caeb-43e1-b749-c1ea79b6f019", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135548, "uuid": "30ee4453-0ac9-45e2-ac05-35246b681f2f", "value": "6144:APxZl37yTacLSez3CfX0YnaqPDfZZ9Y0gH7n5M4hkNqUU:AZGSezTADZ00IMRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644135548, "uuid": "8f579d15-fed1-4a41-b193-e99b65af05f2", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644135548, "uuid": "38ec08af-c17b-452a-aac1-1980d7289961", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135548, "uuid": "7f7cc0ff-10cd-4d64-8e0b-a74a850f04d1", "value": "DHL Express Tracking Number_Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bbc10ab-8727-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1644136311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136311, "uuid": "b83dd7d5-3809-4aeb-8675-c3d4e4854806", "comment": "Malware payload (RaccoonStealer)", "value": "a1918aa01eaa662ed1e00e648003b676", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136311, "uuid": "2993a8f6-da17-4cff-a4e2-657855e1cbef", "comment": "Malware payload (RaccoonStealer)", "value": "1481c376145ccab3372b4eb56fef7ed78ea1c09d623908057b7a99babd21d5b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136311, "uuid": "16c92d95-d603-4e54-b64f-e37725bb3de2", "comment": "Malware payload (RaccoonStealer)", "value": "592634ce6263c3deae95f1850891046c5bcdd629", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136311, "uuid": "d71587aa-2e46-441c-bbbb-c9c97b22ad82", "comment": "Malware payload (RaccoonStealer)", "value": "84724c0b82a3d509f51a9cfbf82303af34ea72fec6b15e8895e55f1b6940172540b6744f395837d9df51ce575602fa12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136311, "uuid": "12ce5dd9-9a3d-421a-9478-d7951fbdc928", "value": "T1AAC401D17AD0C4B1E40A39746821CBE0677EFD22D971C64B373907AE6E732D45B2A70A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136311, "uuid": "e392cb50-95ee-483d-aafd-3cc7b8f15ae3", "value": "ca2ff2f9893e70a497811b78b36c598e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136311, "uuid": "8d83f428-b8a6-426d-9f52-20a564b56bdf", "value": "12288:+nvsZ4KfBSaBYfiiY/QuA0LtU7NKFbRVT7:GUGcpkiiT05C0F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644136311, "uuid": "8e0ec7f4-fb07-412a-9f8e-4a763c2f271f", "value": 557056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644136311, "uuid": "282f60db-fe12-42f5-b047-85e19f1de18d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136311, "uuid": "116fa51d-e15a-4a66-951a-4b8d3869f98c", "value": "a1918aa01eaa662ed1e00e648003b676.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996140b1-877d-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644173405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644173405, "uuid": "186d01d1-f248-4f51-8d1a-ddcb820b579f", "comment": "Malware payload (Mirai)", "value": "0bbac482f6bf3a152500d26e29172017", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644173405, "uuid": "da112e22-9635-4e12-b1ed-221a3aca184a", "comment": "Malware payload (Mirai)", "value": "14e2bfc38cab7fbcbb01ac660c5c37f856a9733d5e5053417914f3118c327046", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644173405, "uuid": "3d264b32-9991-4da9-9b73-9320e87caebb", "comment": "Malware payload (Mirai)", "value": "64869aed2a1ffd57a519941ca4e8cebf8f3d3773", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644173405, "uuid": "ee1593d9-e38f-4ee4-84c6-221e4bee4271", "comment": "Malware payload (Mirai)", "value": "12c7c1705476ed2ca6660cd93c9f89289ae4d717920fd21dfc19163fc986402909ccef9aa993b06a98f920d8a43c23cf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644173405, "uuid": "cedb1771-a9fe-4a85-bbad-caf7e66643a7", "value": "T14DA2D025268EB911C6B00936DEAC0CE7B61B13A862ED72A94710B29CBFC5742D5F5283", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644173405, "uuid": "592e3bd1-ab6e-48c5-8de9-3983b248bca1", "value": "384:UMaXxFn2W8cuADu97MNAR5reJerec7hX7PW4mhYfiOXQm7pGmo+lhymdGUop5hq:7aXxMJ4DuRMNAXe1AhXK4mheiWxImxsS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644173405, "uuid": "6d57e061-5803-421a-bab2-b038cf60a6c2", "value": 22480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644173405, "uuid": "792fda8e-ea2f-4c77-934f-ff994adc7a34", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644173405, "uuid": "71831063-0904-4830-a515-7cba57e81ec9", "value": "b3astmode.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83286430-8725-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1644135572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135572, "uuid": "061b00da-b275-4d4f-abdf-1036d4f081ed", "comment": "Malware payload (njrat)", "value": "dee2687f5376d310dc50e16d104892d8", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135572, "uuid": "27afe220-9794-465e-bb96-80d90dd1ca44", "comment": "Malware payload (njrat)", "value": "15ceafed6b39d35570d70ff29e8d0eedfe936c9e72ef60f8c8b0fec9642d7e92", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135572, "uuid": "199d6a4f-d8cf-49ca-83e5-ca9ca7d00f51", "comment": "Malware payload (njrat)", "value": "7c1365477eeeb56af41f92b895553d91126c80e8", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135572, "uuid": "5bde6c12-b36e-425b-8222-4c4ff39a1786", "comment": "Malware payload (njrat)", "value": "c959a966923fb6c7c1668e8a422fc60f0807f9c2262001b8c60a9341bdd51af9223199ea6bd19f1d5d6a3f3328be30de", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135572, "uuid": "88be1353-7352-4c0b-9636-c19be1e500de", "value": "T134F19ED758C295CAC3D1563BC4DD88AFB41A6C78450C99DB96C092187B906C3032B2EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135572, "uuid": "0adbf730-6d15-49f2-9661-ea539c338cad", "value": "96:ZEKr9NP11NZqSCjg2RdjhI6b+62/UQYQtb8g5dPfJIeExE0CqboxWsV0lnQR/Slt:xrXP/Np2m0GHtb8gbPfJCEVqb8MlnJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644135572, "uuid": "a08245c9-c9c0-4cf1-9170-bf87b6cde642", "value": 7744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644135572, "uuid": "ac94c551-bdfc-4614-93a5-be217d710628", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135572, "uuid": "6ff2eb0e-5623-45a6-8840-e0711e98997f", "value": "Comprovante.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49037f04-8773-11ec-9275-42010a9c0029", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1644168975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644168975, "uuid": "2ea26786-274a-45da-83ca-50f2cdb660d8", "comment": "Malware payload (Gh0stRAT)", "value": "93edeefde67bb62a40c21a9ddc2e5cfc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644168975, "uuid": "77bbe2dd-bff9-434c-ab1c-1a0074086255", "comment": "Malware payload (Gh0stRAT)", "value": "16fbf893577545517baae80528f89f3b4ff2985ea7bbb39a25586ad44a5e148b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644168975, "uuid": "f7c2b7d5-8aed-41c9-a038-5ec62739ad24", "comment": "Malware payload (Gh0stRAT)", "value": "1ff2a75a11c8110b5f33e320b0df831a68f9426a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644168975, "uuid": "5b2c681e-4b00-47ab-9b95-5c292b7ffd5b", "comment": "Malware payload (Gh0stRAT)", "value": "67a7ab485c3b5504d678b2b29111b1e1e398e6c314a5f244af9333be03cac351c4f0e7332f785304621788a94b52f106", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644168975, "uuid": "ddb12f41-a4a9-4f73-9d97-ed5f8ceecd79", "value": "T173047D01F7C901E9E176913C99FA6B36DA3374140B288BCB6754CA991A23AD5FF36307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644168975, "uuid": "1b2a40f8-ee09-442e-b467-0c99414e82fb", "value": "b6fe1394ce89e6c21fe5af76775c6e31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644168975, "uuid": "ffc7784c-2956-43c3-bb9b-09da6d5817cc", "value": "3072:v/gWEkncfFsQTvrhPkC7xZkuXaJhNeETNsAq6nUlk6/MPNm:vLPnc2qrJ51ZkMaJhQCNBU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644168975, "uuid": "782f2e93-4a47-4ecb-be98-931b77a65718", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644168975, "uuid": "8d789e06-203e-46ce-952c-d4eba3a64a19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644168975, "uuid": "dfc1f8bb-bed7-4463-b193-6e11ba0e0e00", "value": "16fbf893577545517baae80528f89f3b4ff2985ea7bbb.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aa1fb5e-86e0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644105815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105815, "uuid": "57a25592-ed9e-4ed4-8876-c28932ea1615", "comment": "Malware payload (Heodo)", "value": "997ab8139e343b469e5e400e475f1d31", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105815, "uuid": "4a55f55a-eba4-4609-8f61-724a0637b454", "comment": "Malware payload (Heodo)", "value": "1761b61e6664cedf15ac28c286aa59d11d04ebd7a89272ba179607dfd51bb818", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105815, "uuid": "e63b6fbd-66a0-49a4-b989-13aeb0b437e0", "comment": "Malware payload (Heodo)", "value": "e33a5378b6e32e3617abfdc8307a497d5db4611a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105815, "uuid": "3f08ac83-24c4-4487-8501-ee6da708d949", "comment": "Malware payload (Heodo)", "value": "08d7347f51d1d04ab6406d2532a0ef7a868dc2ab6caac34f701279abdf433cd205bd01066286c144d769989f48ba671e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105815, "uuid": "f31925f2-90b8-4774-8478-c78ca20797e3", "value": "T12025AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105815, "uuid": "0595fdf0-fb19-4518-9fc9-82d5d219c1fd", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105815, "uuid": "44392d62-76d6-46ad-be75-c20ab251782d", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxsfFIIm2m42:1ZsYB7vLsnZI1Hb9DTFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644105815, "uuid": "4fa8f83f-f21f-4af2-a3e4-9fc2e8b0d51e", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644105815, "uuid": "f58731ba-50fc-4afa-ae38-128ede29f498", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105815, "uuid": "bc2e386f-878b-439a-bfe6-f7c3d355c52d", "value": "emotet_exe_e4_1761b61e6664cedf15ac28c286aa59d11d04ebd7a89272ba179607dfd51bb818_2022-02-06__000330.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87e5bad6-8748-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644150612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644150612, "uuid": "69d12f2f-8db5-4c57-aca8-6342429ab989", "comment": "Malware payload (AgentTesla)", "value": "29d302abfd720451a55f83e5b2e26d24", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644150612, "uuid": "a60a17e3-2a3f-4562-80f7-74e152a78f2c", "comment": "Malware payload (AgentTesla)", "value": "17fdcc607fd88eae0d0c1c70bbb2d0142fab586b95fc5952b63e568b5456b01d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644150612, "uuid": "ea17ec92-5c66-4e73-9632-52722e0f7ba5", "comment": "Malware payload (AgentTesla)", "value": "8aaec9683a0fd5709b48f840d527d9517889a259", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644150612, "uuid": "3148cf8d-ed25-4cd9-bc80-dc499c740345", "comment": "Malware payload (AgentTesla)", "value": "90ed0c3354636f411be5cc2d079c845ddfd52811f665ff2f8db104259ca5b21b6680f471c8c00751ca63f800c802e7b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644150612, "uuid": "082667fe-223f-42ef-b374-57956a7709f5", "value": "T142C34FF5E774B919F010C97CF99982703AF8EF609F325542B469763A197E2BC2D120E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644150612, "uuid": "959692ef-93fc-47aa-9fa5-a208b47b441e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644150612, "uuid": "277a4b86-0d70-4c78-a251-b81504ff4fc1", "value": "768:8btoIGcezZ3maHiYMwN8Agw3nZPHbzYKK:8btoIQ2NAVZDzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644150612, "uuid": "2cd42624-c6f4-4b62-a944-267ce0d11844", "value": 124928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644150612, "uuid": "a83b8267-61df-4264-8496-3f18dd9328f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644150612, "uuid": "7b438c5e-23aa-418e-bc76-46725a4d5c21", "value": "comprobante de pago.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13a9e5c8-8727-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644136244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136244, "uuid": "3d7525f8-17cd-4384-ab7e-eaa7db608f64", "comment": "Malware payload (RedLineStealer)", "value": "8152434b9911da71833b8d4309a2ffb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136244, "uuid": "aff64ceb-10f3-473c-9d4b-5db276ba984e", "comment": "Malware payload (RedLineStealer)", "value": "18c8739978fdfd2592fb1441aa82af6cb365bbd85044339b8f178049defd9a29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136244, "uuid": "6e1b153f-7180-4e76-a7a5-255b91aafdf9", "comment": "Malware payload (RedLineStealer)", "value": "ce91be1eeae2fd63573a34927ba06661076d2f1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136244, "uuid": "6de3f15a-7e97-444f-be15-2dd9227c8d80", "comment": "Malware payload (RedLineStealer)", "value": "4036584be5c633af1bd8e1d3a0455643bcc39fb2222ebfb207d0c84d0d41468cadca44a076849b1b8a83f96c0cb05fe4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136244, "uuid": "dbd03ecc-4211-4f95-835c-342c6d0d44b1", "value": "T164B4A53439FB501AF1B3AF76DAD47996DBAEB7633707E85D204003864613B82DE8153A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136244, "uuid": "ca830303-37df-4a6c-a7f6-846fb9d109b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136244, "uuid": "322fa536-582f-40a6-bb7f-ffc8fd0a07f2", "value": "12288:PqaKkFxxq/R6TPnkfi9iHyxLmrA2Wjg4vkCr:PqaKpsC7j4vN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644136244, "uuid": "ec2521a8-5ffa-4fdc-8de3-32d7fdb07d1a", "value": 500736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644136244, "uuid": "76d1a405-9a03-41f7-8620-dc48a74cda5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136244, "uuid": "f81847ba-b07b-4535-8313-a77db3e1453e", "value": "8152434b9911da71833b8d4309a2ffb1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe0da6e7-8782-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644175721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644175721, "uuid": "6b93c540-c337-4e24-984c-f0cea1cde188", "comment": "Malware payload (Mirai)", "value": "8171d181ea3675259b3ac137ddcd89d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644175721, "uuid": "2f4a3763-df94-4d20-a95e-c187cf1aaf6f", "comment": "Malware payload (Mirai)", "value": "19448a100e79a4caf63974e3275e2b05d73218135bea7532b7cc5647b0a97560", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644175721, "uuid": "12318989-38f4-4bd8-beb8-527ecbc808b7", "comment": "Malware payload (Mirai)", "value": "c64c1197a2921e53e52ba40f2464d3119139738c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644175721, "uuid": "8a45780c-1cc6-4c9f-97af-c3494d3f8c3d", "comment": "Malware payload (Mirai)", "value": "b2e12e6bacf4a052f0e3b4c0f075b2465cb8bbbb29eb351a302eb1cdd0256a8c1d3f8d9cd4f9f39f1e6f662307779a5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644175721, "uuid": "ef726a46-0924-41eb-9022-45f659bd99be", "value": "T108238D77C8A91DC4D7958574A12CCA3A1733D418A29B1EFA1A47C57AA00BFECF1093F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644175721, "uuid": "35e3853a-3c38-4d38-bff8-e3d75536c341", "value": "768:ya6Z21e8m0fzVhbdVQLsCWuWo3Zm9zMCYAuoa/:ya6ghDzVhbdV7op30wCYBo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644175721, "uuid": "4993564d-54fc-4af0-827c-74846af5be31", "value": 46116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644175721, "uuid": "7cdb45e4-9555-461b-b01e-3c3e48c6c8ea", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644175721, "uuid": "dd75df73-6d76-42a5-b0ca-185606a6fa2d", "value": "8171d181ea3675259b3ac137ddcd89d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "240daf3b-8726-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1644135842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135842, "uuid": "07693943-8511-4235-9c64-6409e7dac99d", "comment": "Malware payload (njrat)", "value": "506cec610686115789967e7a59c01834", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135842, "uuid": "5e881279-6022-4a24-ab6a-7e37b057bd33", "comment": "Malware payload (njrat)", "value": "1a761d816cb65252e852598e70255c99d3dc54842d71faa7b9bc83f80ce3f952", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135842, "uuid": "accee34f-b93d-4b8f-a393-9f2b0bcfa89a", "comment": "Malware payload (njrat)", "value": "caa642a517e68954a3ac0feb739e0e760ef2c3b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135842, "uuid": "cc3b1f5c-b42c-4cee-8b7b-6b80f5c951b5", "comment": "Malware payload (njrat)", "value": "c2b94cf1bd20ad2708f144ef91cc28c19c7fb4b6412e4c1210e6f3bbad4ff4edcc75929fb2508cf8d180524164d54226", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135842, "uuid": "514139c0-d2ab-422f-a9c2-af244bf341ef", "value": "T10F35D139E3321905F43D377FE495143A63A59BC9AC1271DA2F2CE9C49D386C940ED8BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135842, "uuid": "b933b480-0a2b-433d-8a3f-0486ac6a58d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135842, "uuid": "77d7d252-09df-422c-98eb-383de9a3bade", "value": "12288:rV516TIwrR5x9aNPnwVWUQm8OAOFZ5gLvhiscNfHX7j5fQAmtfuZXGwhGVD4moa9:jgTIYjxcwV4tyY8BHX/54AmtmZxYGmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644135842, "uuid": "fcf8c488-37f0-45da-bfe3-6d734d865552", "value": 1118720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644135842, "uuid": "2c6cd683-8f1c-49cc-929b-1e0f1f495b7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135842, "uuid": "3d5aaac6-e07f-48c5-8216-3b8ac8a90814", "value": "1A761D816CB65252E852598E70255C99D3DC54842D71F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7448cc28-872b-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644138124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644138124, "uuid": "bfc0c9bd-7bb2-4fab-96d7-c84242207c33", "comment": "Malware payload (AgentTesla)", "value": "de7430c093e6b284efbc4621abda0bbf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644138124, "uuid": "0fc4a24f-dd3a-4a3e-a71c-ae104af1df34", "comment": "Malware payload (AgentTesla)", "value": "1beadfcc837948fde4b5cba3101a68ef4cf8b55f360028f01a2d2c8cbb477cc6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644138124, "uuid": "bfeb7e28-57b9-4719-bc59-66ea735e92c0", "comment": "Malware payload (AgentTesla)", "value": "da30242dedc8cb96334d499ab8b6f92e7d18c06a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644138124, "uuid": "ee65d34e-a028-498a-9f06-3acddcce68df", "comment": "Malware payload (AgentTesla)", "value": "c726d59e3afe60116093ff3c647628c343e066fad9614d142c794dc81c7772af3cc21573d1143a47cd76b5f162fbb007", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644138124, "uuid": "04b67077-e837-43a2-b345-e02bf6534909", "value": "T195A4F1F4B0EB8EA1F42B8871657CFDA5127233E3D8EB4A58076C56048BA5F066F0495F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644138124, "uuid": "c32ad7f2-1da3-4e19-81ef-b99e63a863a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644138124, "uuid": "82bb847d-59fe-4fec-ab6e-d3810e353a7f", "value": "6144:o7SYRLeFNPPHLx67MhGnPok32Z8s2lIJWW6As6U1+yru9eHoPUf4GM/37yTa:CSesNHlOnZ32Z8s2lIJWaVXWuLPm4B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644138124, "uuid": "7ca6112b-7f32-493e-923c-591c17004b21", "value": 451072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644138124, "uuid": "db801042-525b-4456-995b-864749420389", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644138124, "uuid": "f67ec65b-35da-4ea4-96e7-d05051092673", "value": "de7430c093e6b284efbc4621abda0bbf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a554be9d-8797-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1644184592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644184592, "uuid": "053ea6bf-5a67-4cb4-ba66-b38c4364c6ea", "comment": "Malware payload (njrat)", "value": "a477f835005b6a83aa062434237d79d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644184592, "uuid": "6e5b08f8-9bbb-4fb1-a4b8-1b7fc47d4a1c", "comment": "Malware payload (njrat)", "value": "1c5952df10f0fdb566f748c18ef3b101825937c75cd26fa716a79298dbb343db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644184592, "uuid": "473c8df2-c40e-43dd-a098-ff5858a6246f", "comment": "Malware payload (njrat)", "value": "56c23babcc9c3d636b5b57f64d6e0fe445023350", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644184592, "uuid": "71b9a10b-cc6b-42c1-b837-0fdd87c7c821", "comment": "Malware payload (njrat)", "value": "832d5f822954f4e6edb00ae1bc55d370d7f455741ced0baee8efebb458a4fcb11dbcbb0705158eca2861ee475a369244", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644184592, "uuid": "851c3059-61b1-44c7-b442-723282630a64", "value": "T1074633205F9D5E6DC76C873C90AB4E1E2BB04AD2942CE9E75BD17CC323AE38095179B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644184592, "uuid": "0c7282a8-8635-47b6-be37-1557f8174a00", "value": "49152:sk8CkO+WJBDTMDLQkR3mZePvCWr9ECqjg/0TjlJMO9hs3dveAIl0RnvY6hWLkFq/:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644184592, "uuid": "b76c9cea-0899-4638-b73c-4a516762a848", "value": 5673984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644184592, "uuid": "42f9429f-2cc7-47b8-8dea-57acb735424e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644184592, "uuid": "52a1ee4f-105d-4b36-bd7b-36c99f6dcc6c", "value": "a477f835005b6a83aa062434237d79d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9ff1222-8774-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1644169594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644169594, "uuid": "43e7b963-56de-4b43-9bad-928292c27acb", "comment": "Malware payload (njrat)", "value": "56f5d3c03e7dae40e6e72bf04b21fb77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644169594, "uuid": "eb2ede18-e6bc-4c47-be43-08d74e959ae7", "comment": "Malware payload (njrat)", "value": "1ec669154e69456fe39c3b54e74cec3695e1ac2ded7770f385062f95be3dbc2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644169594, "uuid": "41ff5dce-0294-4ee7-9b0a-6b3e02436ec5", "comment": "Malware payload (njrat)", "value": "e0008c59c999e6df3d401533771bc1473743603d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644169594, "uuid": "c17eccea-90cb-4bec-80e1-147923266a40", "comment": "Malware payload (njrat)", "value": "8efa6f8f7c1a1b8c3070ac61c137b2a4a22d8a4b277e64fc2ea709738adcdb53820d0fd793fe2057b35a7a2257e07197", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644169594, "uuid": "1347159b-b77a-463a-af44-4975210ec923", "value": "T1EF434A4176E94F09E7A887FD096345006E376A0E472FD73D1A89E08A1F27787F681B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644169594, "uuid": "2f5afbc3-b693-4119-b6c4-420d883f8fe9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644169594, "uuid": "a6ebe482-41c1-4d23-8035-4a874c0d65a2", "value": "768:FSJ7G3o9mOSRsiwAKVZaRI3GgPQbl0l3WOfy+rkVNqBQ1/KSeQW:IT0KVoI3XQ3v1TW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644169594, "uuid": "31bb2c85-eda1-4b9f-8557-d1ae3208261e", "value": 59392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644169594, "uuid": "8c0813e1-0a71-4063-880f-413f2258250d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644169594, "uuid": "9fbb31b0-8d5a-4d64-bc8c-4b4a86cb9929", "value": "1EC669154E69456FE39C3B54E74CEC3695E1AC2DED777.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e049e776-8729-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644137446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644137446, "uuid": "bdf230ce-1ee4-4e25-a6af-2316bb54ce5b", "comment": "Malware payload (Formbook)", "value": "51467470255a8544f799355fe2418251", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644137446, "uuid": "59f767d1-6ce0-4c8c-b8c5-0175ab4cad68", "comment": "Malware payload (Formbook)", "value": "2099d310f5fc3d161fad8db45a1e8d555006869871d52e063c0760284955b75e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644137446, "uuid": "c5ecbfa0-8705-4344-b454-54b6ff3c2d99", "comment": "Malware payload (Formbook)", "value": "3209f7bd27089b0c95c32fbe8846965f714f4fdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644137446, "uuid": "fd2e27da-015f-49f1-a042-1e9722851e58", "comment": "Malware payload (Formbook)", "value": "20eb870cb33a8eb7a7c23c814715855b74ef59213cc9644f03c8746a6484f13d5f30d61412c1ed92f4bc6fe56b00c958", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644137446, "uuid": "ff70af37-dfb5-42ca-85a4-7d04edbe0340", "value": "T19094E0B0B0D789A0F42BD975A2BCFCE5027233E399DB4A14172C66005FE5F59AE5890F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644137446, "uuid": "6e615560-e998-408b-a6b2-06f33cc30c42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644137446, "uuid": "42907b21-c329-4dd4-8b96-1cc5bcc8df75", "value": "6144:RH9QpXAuCk6vvUkCxIxCL7CxeMB9fW3DZ/EaT9jsDDDgPUXV7yTat:h9QpwxDNcWxeKOBfuiU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644137446, "uuid": "65098876-5140-416f-add7-9875ad97a5bd", "value": 415232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644137446, "uuid": "71d7eb89-a514-4695-a53b-445a1eb4e10b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644137446, "uuid": "d531546c-5e19-4ac7-bae1-577cebb2833f", "value": "boleto de pagamento.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d27230-8726-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644136196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136196, "uuid": "cbd18095-7f9c-42f2-87ff-9e431c07b464", "comment": "Malware payload (Loki)", "value": "f228edefd9d43fad7f04191b7bdb75fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136196, "uuid": "5d2553a9-a37d-4d56-aaff-5d84d46af3a6", "comment": "Malware payload (Loki)", "value": "20e7a6550c29fbb3eebd0905011654a9889979f01391fff4710121a79bbb4423", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136196, "uuid": "d683713f-2373-41d3-83c5-ddc7054a8262", "comment": "Malware payload (Loki)", "value": "2acc183d35e6c44829833c3b8ae087bd36d121d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136196, "uuid": "05c1896f-dd59-4c9a-b684-c9ba0061a973", "comment": "Malware payload (Loki)", "value": "6f783e8570c5a24fc6a7c96bd2c7766ffd61143c86127747b114c393c80a45d069b0a27c662533456e3b361083ec3735", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136196, "uuid": "3cdd6ab7-a588-4e8b-a898-d481ad837043", "value": "T1C9C4226C76474A62ECDD82704D130954FF2F0E172AD0E9AE53DBF6CAA33F4AA1C55884", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136196, "uuid": "d82b23f6-0fef-4a4d-8a7d-4fbb7dbad377", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136196, "uuid": "f483781a-7b55-43f5-9809-21d47671f100", "value": "12288:TBfNDZ3NEWHhvr9NLSsdUUgPgVPlUEHyX8tV+n2RvvtJXOTfoLETRoysrLRe:HvcLoAVFsrle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644136196, "uuid": "d625ec5c-6e30-422d-a1a0-63587aef2006", "value": 547328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644136196, "uuid": "ed7e3d4a-f0da-4d58-a052-c44b1d695509", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136196, "uuid": "979d1b3b-3afc-4b11-9463-9af3dda7a76c", "value": "Commercial Invoice Bill of Lading Document.ex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "298efabb-8722-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644134133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644134133, "uuid": "1d0b3d8a-a861-42da-b17d-77c677bd0cae", "comment": "Malware payload (AgentTesla)", "value": "fb311b1bd9ad428b7eda83b0b68cac0e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644134133, "uuid": "3c77038d-cec4-487a-ad28-d22b551bc950", "comment": "Malware payload (AgentTesla)", "value": "213d36f7d37abac0df9187e6ce3ed8e26bc61bd3e02a725b079be90d7cfd5117", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644134133, "uuid": "3f85a6df-61dd-49ea-85a6-59211cb6cc39", "comment": "Malware payload (AgentTesla)", "value": "532cfca603a1846b077561ad5e8d255bb40979b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644134133, "uuid": "49e0bfd4-6b1c-4084-9dc7-6f3fa567d13c", "comment": "Malware payload (AgentTesla)", "value": "6bdb51901f8efffd0147d1ff9eeda06501927559739b8b24a79c1a75cc580d2999463eb29772edbfc77471f8d1d43cbe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644134133, "uuid": "85fe1136-b61f-4cd6-bb17-c64226973ed1", "value": "T1D181D5E524B808D3DD5B55A3D934FC6A02DFF14680CB0F91329DF9A20B3F31A76A2846", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644134133, "uuid": "fcd0a39f-68eb-4be8-9cf2-58df5a3058a4", "value": "96:fUrNIukB/IQ41CFz+RuLzoT/n9w9Lyl7XzYfAmR:fU5IukNH+O6U8T/KByl7X0fAmR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644134133, "uuid": "a87fe543-2521-4c91-a6dc-7cfb25c4b2fc", "value": 3852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644134133, "uuid": "ddadf980-8c21-4290-819c-e87ea5c28de4", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644134133, "uuid": "37509d0e-29d1-4b5c-b696-04f37e476e7c", "value": "orden de cotizaci\u00f3n.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "627aec45-8787-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644177608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644177608, "uuid": "8846aabd-2d3a-4354-93bf-64a9bd3d2ee2", "comment": "Malware payload (Heodo)", "value": "aa2715ee4a6883680ea7be0a3bf6a9cd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644177608, "uuid": "c67a154b-afea-44e1-9c93-3bf6e243a047", "comment": "Malware payload (Heodo)", "value": "21a95babaccb003c23deb6c3f78fc157801418c0038e3aec3c054e15b1985098", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644177608, "uuid": "0e41d61a-211d-4f39-aa51-aa87bb0c4a71", "comment": "Malware payload (Heodo)", "value": "3784c4cae7de4dc214a4abaf71c4ece16570ea43", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644177608, "uuid": "73374317-675a-4bff-bc85-52432d198c89", "comment": "Malware payload (Heodo)", "value": "53bb4b298b5d9fefcd8a30f4e307c24a4067d93c20019d4b2dae8ec1aa591debe86125a7158f9380821e542ccc6e0dd3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644177608, "uuid": "b39660b9-0ebc-408f-a633-3bdcdbe85cf1", "value": "T1B925BF406D8980A5F6072A3D017A72924FEC69015BE0E8CFDF49F4A76F26DD1993C86F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644177608, "uuid": "b3e98c9d-80b4-4def-a206-3681bf804dbc", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644177608, "uuid": "4bb0b2d3-8e21-4310-abb0-615b2708058b", "value": "24576:ktXfiIeQV8iFExIB/powWtCi3+0al+uTHYzikt2gRFIIm2mlg:kBiaa4powXiolDS2gRFIr2mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644177608, "uuid": "b14b1f37-ebe1-4939-b5d6-4c765e32a378", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644177608, "uuid": "ae3674d2-f6cf-46dc-81a9-1067835d62be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644177608, "uuid": "0bd0da7c-8220-46e7-a31d-6c857d151d60", "value": "emotet_exe_e5_21a95babaccb003c23deb6c3f78fc157801418c0038e3aec3c054e15b1985098_2022-02-06__200000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d07e60e6-8792-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644182517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644182517, "uuid": "e553a630-ec45-4714-8415-dd11ed57031f", "comment": "Malware payload", "value": "6483fbadd49ff2dfc52ecf245098b24e", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644182517, "uuid": "53930c84-98d8-4a41-a5a4-d12525b8a4f0", "comment": "Malware payload", "value": "21d71b0812f7fa91be7700c4a194f10442bd8f64f98d4c22f30c06339b367d72", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644182517, "uuid": "f491dba4-79d2-4497-8702-19f19d973561", "comment": "Malware payload", "value": "e487bde02a18401a8f9af90d65f3385f838d78e2", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644182517, "uuid": "32705e71-2f10-4715-a494-36493e0305e8", "comment": "Malware payload", "value": "537e3713ee1a24f893e3b9240b8ac0d36191991ebfe9575b3a10a648eb5952b6f189cb0dae702199c111f9ac2f587b82", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644182517, "uuid": "08fc3192-1db2-47f3-96e3-894df030eda1", "value": "T125C42352DD66EFAA8D4461700586BCAE0F1C80ED37C6ED93B832FB58589D05FE382D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644182517, "uuid": "64ff1802-a65f-4970-b736-2c59c0c7e295", "value": "12288:K9hVrGorZeVWQUnFrPsDF5FSRQjbWdhFIcn1:K9rDZmEiFSRuy7qI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644182517, "uuid": "5bfa918e-d216-43d8-86a6-6eeb1a9892ab", "value": 566888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644182517, "uuid": "199982e8-7a6c-4ea0-bdb2-5320fe43449a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644182517, "uuid": "ef55b58e-5cb4-4f2a-aad7-de9714cccdc2", "value": "Passwords-1234---Setups-Y6.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "634ab16f-8727-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644136378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136378, "uuid": "a406eebd-db26-4a79-86f5-f3d0cf559bec", "comment": "Malware payload (Loki)", "value": "87de01aed83e4df54dabff0be8bd7201", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136378, "uuid": "b58018a3-cd8e-4b77-9b2a-121d094be42d", "comment": "Malware payload (Loki)", "value": "226262818c0fd5e68a389d14363d62c516deb9dce90ec32c8db522071c743940", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136378, "uuid": "a0f6826a-dd66-47e5-b39b-354fc295d5c2", "comment": "Malware payload (Loki)", "value": "5da35b0720f0f65a9e8b9a814963d8fd78bbc21c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136378, "uuid": "40c519f8-f588-48cc-9fc3-0f69b09f74dc", "comment": "Malware payload (Loki)", "value": "acd811fe131f48e21f9da6a06b38106824127f9140bfd846bbb3005e5eb674bab8aff5ed5deb8512cfdcc7f41597f6d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136378, "uuid": "2f5dabd9-4086-4708-9ab5-81e0de8ec833", "value": "T11A15AF63F2C1547EC2661A788C2FE2A8791A7E113D28A94677F59E0C0E35240757AFF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136378, "uuid": "0a6f27ad-d13f-49ce-bc7a-1d8831f6a0ba", "value": "ccda8ad5afa826645d477dc5b285cf99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136378, "uuid": "ee39c6ca-e2fb-40e3-b1ee-7df4747c0f55", "value": "24576:GZPnEysCS5YP0QLtaDY6IKql2aG7+Nlp8S:GZPsCmQzf0aGyfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644136378, "uuid": "969fbb82-6cad-41d1-bbfe-2b2ab9a20e6a", "value": 941056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644136378, "uuid": "6df23e9b-ba15-4bb5-b7a7-9cc26a88cd1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136378, "uuid": "27e3ba77-d3e6-47c2-8c4d-0fe44437bbe0", "value": "Comprobantedepago.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a98028cf-8726-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1644136066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136066, "uuid": "ce2c632f-7afb-4146-a8a3-ebf47c06d8c2", "comment": "Malware payload (NanoCore)", "value": "f31cec99eaf45bd8bc288b2b9cd11f59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136066, "uuid": "3215eaff-1407-4abb-974d-b396425f65c6", "comment": "Malware payload (NanoCore)", "value": "22d5f0dbe39a9c4dcad69a4845286bba9696a3ac375f8ce086752d1b956a45b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136066, "uuid": "03aaf042-4027-4ebd-b94e-2deca17c9ac6", "comment": "Malware payload (NanoCore)", "value": "608b67cd1513518d8feded24dae99785f17545c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136066, "uuid": "8a854439-744d-4b86-ba60-4511a9b4891f", "comment": "Malware payload (NanoCore)", "value": "d989497a1a5cd41d598738372c3062f47e72732b6b8f4cd370955f70c4997a5179fe53e6e0b440022dd187e75f17edf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136066, "uuid": "68c37c55-409e-44de-8746-14b804892538", "value": "T1BFD4BD3126775B51E93FCB381721C2380FE5AF12E313E5A93CD8AC9B7196B450A66B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136066, "uuid": "ddce58d3-12bb-432d-921f-7cb72b01de19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136066, "uuid": "7d241653-5277-47f2-be20-fed2de271bc3", "value": "12288:viEjdfjApJ+t4IXNh9DY7uVKSscsyFYGKDmhaTR445I/A++:68dfjAP+t4IhEnSs3axhaF44qYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644136066, "uuid": "f31a79f7-1a8c-4f1f-a693-6825622cd3ed", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644136066, "uuid": "f4d6440b-5a45-4a93-8bbe-48e4e8eb18d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136066, "uuid": "87f749ea-8886-4bab-b190-1e7c165b543c", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c7fb249-8778-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1644171075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644171075, "uuid": "83541144-c156-4d30-a5a7-66288e287c5d", "comment": "Malware payload (DCRat)", "value": "1a4d05f6aeb5356e5fd8fe1faf0f900c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644171075, "uuid": "efb72bee-ae1e-4062-bc57-5475595bf831", "comment": "Malware payload (DCRat)", "value": "2560cc6fef94164b1e60d22763fc15dfb84314b6b5f7f581b1ea3a09af2e3021", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644171075, "uuid": "6910c310-5dee-4422-9d20-370b19769f1e", "comment": "Malware payload (DCRat)", "value": "22fceee54a7b7d35e5bdd4d088ac5b29d86b9158", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644171075, "uuid": "532f1319-5477-486d-9bb0-a71453af8d90", "comment": "Malware payload (DCRat)", "value": "7b375e82f7f1731e9b5ac1ae33539f456f2778ff04e20a56aea71fef383875fbf5cc64b19de35276a486cae48547fe44", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644171075, "uuid": "79e8a749-3391-4a1d-a696-a6b43ad3b27f", "value": "T1784518027E46ED06C02E1637E9DF886847A8FD417B66DB1A7E5F339D28123A70D0D5CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644171075, "uuid": "b272c569-a35b-4966-8de9-2b37bed4e4c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644171075, "uuid": "b743b573-d158-412f-80da-338dffc1bc65", "value": "12288:xAm+kiU8TjyE65E1bkITx/Ek5HOa8hD+CEkJ+6aSHN5TTCToDBm3vJRX6Wm9GLBs:xAmp8XyX+ht/E4ONNtDBm//VmoBo+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644171075, "uuid": "6c23d905-185c-43f2-9711-8814071e0312", "value": 1173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644171075, "uuid": "a2237775-1832-4678-b89e-ec7ff707ff99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644171075, "uuid": "2a53a993-aecc-438c-9a9d-b2e928a57ac1", "value": "2560CC6FEF94164B1E60D22763FC15DFB84314B6B5F7F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ef8282-8726-11ec-9275-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1644135983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135983, "uuid": "5e898b0d-8246-4ba6-9a0d-14e9d556d2b3", "comment": "Malware payload (AZORult)", "value": "a7370f318ae43c90446d3a0659ec77fc", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135983, "uuid": "1665e354-87dd-4f2e-ac8d-28a10c8dc288", "comment": "Malware payload (AZORult)", "value": "276cec63d7f2abe85a2e9caa2e636831be52ee7828156e1d01a413e5a1cfe9e4", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135983, "uuid": "dd7763f3-d362-4c22-bf51-144f451f718a", "comment": "Malware payload (AZORult)", "value": "363f2238e0b39bf6a6d0124f117b34ce9407edcb", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135983, "uuid": "0cce631b-bdaa-46ee-ac6c-b9fa9709abbb", "comment": "Malware payload (AZORult)", "value": "de6fb98e46f94a5fcd034e07ca79d40401ca87ab50c9c50478913bb0b277c9578c3297ffdcde0520e645a726422e5763", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135983, "uuid": "024045e8-0b60-4a4d-be07-802ebba3ce6a", "value": "T19E94E4F871E1E279C80582312E617C7097F14DA0DDB1A916EDECF9E4D630EF62B22646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135983, "uuid": "d9bc85ef-3b49-40b0-8b86-88f54631aceb", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135983, "uuid": "2142b859-8aac-4e7f-b70c-b63089334762", "value": "6144:BwTa4ogLeSp1faZwMsotn6H+VEqNxp5PMsirJDsaPzUqTh1+:kJTf1faHs3GxpgJvIi1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644135983, "uuid": "7a3889f2-65e4-4c94-9068-ded77e958def", "value": 422271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644135983, "uuid": "ad5b3ba5-f2ff-4374-9b95-23aaceb6abc8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135983, "uuid": "8882606c-e738-4fd1-9e8a-a8057dc6cb02", "value": "3957211085.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a8f6e46-8766-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1644163475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644163475, "uuid": "6f638267-de42-46fa-b2e1-115ce6393611", "comment": "Malware payload (Smoke Loader)", "value": "fae6f87026d6dc764885f20946a5c0ae", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644163475, "uuid": "44623459-3059-42e5-977e-4436fa80cf08", "comment": "Malware payload (Smoke Loader)", "value": "279e2098736a7f119003cfdfdbd90907782f63a3071f21cd1785f970d59acbda", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644163475, "uuid": "d9abc16c-7803-4183-a4a8-457cfc13ccdf", "comment": "Malware payload (Smoke Loader)", "value": "1e9fb14cee376f5ad0694c34ac0141665a9b7bcd", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644163475, "uuid": "77fdab74-a97c-46db-93a1-b3556564cb31", "comment": "Malware payload (Smoke Loader)", "value": "4d315ac444dc7d9cd789fc83ad770d57e0dd6ac585b42adc39aca50f394765cd8c0feec7eee163d61ce91d0de2b3d682", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644163475, "uuid": "9d5a6e19-0917-4630-9374-1bafa04de5b2", "value": "T1A144AD117A90CC72C4961D309425DBE01A7FF9B16A619687F7A8BB2F6E713E053F2306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644163475, "uuid": "6351def3-5a0f-4ddc-862d-9bcdab54d07f", "value": "2dab777ba50f96ecb32b37fbf7066d6e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644163475, "uuid": "966113db-8093-4d60-aabc-0c49976016ff", "value": "3072:IhB+N+LOsW/DI5KOpazskdGpBOsxkgaBChRDEsow7T:IE+LjWvOpae5igaYfp7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644163475, "uuid": "3cb04233-e243-4011-a665-6b2da24dd4ea", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644163475, "uuid": "d9e8092c-076d-4f61-9873-14763d80c49b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644163475, "uuid": "68883205-09d0-46f1-96a9-34d4c91f0b18", "value": "fae6f87026d6dc764885f20946a5c0ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c385d67-878f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644181033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644181033, "uuid": "d210ce93-566b-4cb2-9bef-c42547ec0bf4", "comment": "Malware payload", "value": "ac725f502edac67bb988c082f1a9f4f7", "object_relation": "md5", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644181033, "uuid": "6ba63d87-3483-4831-8e87-595f3ab5cca1", "comment": "Malware payload", "value": "27f43c38cba5e710491a80be648eaacadc5877539a3cdf26597dfd4cf8970748", "object_relation": "sha256", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644181033, "uuid": "bc9ced5c-ac90-4e20-a8ed-da8900887b0e", "comment": "Malware payload", "value": "d3903195b86d173c945f969d56617996b240b5cc", "object_relation": "sha1", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644181033, "uuid": "b3c69309-f42d-41d1-90df-92834de7c874", "comment": "Malware payload", "value": "b7530c761e0e588603be29986d8e4348afce07167990d268498660492c515d588102d7a6ca41db20b1e3cb73da69290d", "object_relation": "sha3-384", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644181033, "uuid": "36c3e4db-a202-43cc-80ff-9583b8ed0660", "value": "T1298423EB323840F1120219A31ABBD99426A866CFD9515C97CD1906FB573E730EBF89CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644181033, "uuid": "40014987-9092-4b8b-ab11-b8bd531460cb", "value": "6144:aQhx7dgM+GTuEvAw52Slt7rHKXraCyZaPO7FIjc/Iw3mb5kW6LFkGIHmlJBRWUbp:hfyHY9j52Slt/HQbyMPVjwIK7l1RXhGE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644181033, "uuid": "7d4829af-d3a9-4adb-af59-8fde40fa36ab", "value": 374580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644181033, "uuid": "416dc9ba-86d0-41f6-a707-20bf973b9bff", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644181033, "uuid": "cfb66fc2-2d7d-4707-a4c9-1e4dc3bc9820", "value": "1643812604.Vfc11Iba1d84M765008.dynamene_invoice.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "104ca840-8783-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644175752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644175752, "uuid": "88d7260d-13e7-4472-aa81-88cd9d589071", "comment": "Malware payload (Mirai)", "value": "0795e234aa896601401be59614d24b84", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644175752, "uuid": "b0e094b5-394a-461b-bd75-ec794cd39167", "comment": "Malware payload (Mirai)", "value": "2983fa810d94a9d74c2aea37fa4f1d4b6056d277ad94b175ef7acc9687b7b8a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644175752, "uuid": "dbae0638-6e7b-4f53-8bed-4df30e71b8a8", "comment": "Malware payload (Mirai)", "value": "45c73fc57699fe3876601698097c8ac04a934a0a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644175752, "uuid": "ffd15b11-6ce5-475b-bf18-fd2d9dc604dc", "comment": "Malware payload (Mirai)", "value": "4535ef9d4cff787bdcf3ccd0a579f11728dde5bac6d90fe83c9b7822bf378340bb5aaebbe4391e7b50e09a068e2b3be2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644175752, "uuid": "1b9935df-fcac-4e55-95d2-da4dc1397f91", "value": "T10EB2C06CDE9C764BCF9C7DB504CA1B7685E43180734E4E496364CC887929A8FBA891E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644175752, "uuid": "e6316efd-2e0f-48b2-add3-a2a2cabefcf5", "value": "384:BuV2Kf5T+KeG2EZQOwyjxUQnNOLjzAntAAEArjG1UFrHgVJ3aPpAMfRWGVCz0Nvc:sV2K1zeOwyVk4tAD1UFzg7QpAaW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644175752, "uuid": "f760ac9c-5735-4624-abd2-f3d787079893", "value": 24556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644175752, "uuid": "f56a5a19-1ab3-408c-aee4-55dd34d42f0e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644175752, "uuid": "f1d0cf17-4c65-4a0b-9966-68b8152f2720", "value": "0795e234aa896601401be59614d24b84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e863f54d-8766-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644163659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644163659, "uuid": "72f4d948-3f52-44fe-8ff6-c26ca930d2da", "comment": "Malware payload (Formbook)", "value": "c754e46f97def1e03a574662d827d0d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644163659, "uuid": "772af3fd-5440-498f-83df-e21397aead0b", "comment": "Malware payload (Formbook)", "value": "2c13447326df9da1edb4700336d4cf841f7575b7505df68ef2ae7bdb6f2d9f5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644163659, "uuid": "e46b9e2c-bf0f-4285-af59-c7626d684f28", "comment": "Malware payload (Formbook)", "value": "bbb6bd54867a9e3ee53521c8bc538aca3c65588d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644163659, "uuid": "6a8e370b-f79d-4d2e-bdc9-38b535af4b0d", "comment": "Malware payload (Formbook)", "value": "25405ff2ff49899f8edb09ef483e5dde72ba7191bca5c914da8c5f527f23f2b38f11c22be14968231f77b7e96703691c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644163659, "uuid": "61a09809-5b64-413a-a2cc-7417622f3073", "value": "T13C94AD8F23603282E0124F358505BB094B6D5FE62D76CA0EF75D3F97A73AB811E96391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644163659, "uuid": "7f5eb08d-9e7a-457f-9d13-3cdc87f83675", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644163659, "uuid": "2393969a-01cc-4dc5-82ca-0eaf2f33b29c", "value": "6144:bw1xx8mRGb+5rlBGoRG4Nz474GYDH++06kF/P0iJnbm3XZW:amsj5rlt5Nzs4A+yFXfi3XM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644163659, "uuid": "7cacb47c-5457-47b8-b5d2-6cd3b49ff0f2", "value": 433987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644163659, "uuid": "452a6069-b277-498f-8c24-ef6c049babd4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644163659, "uuid": "7439f778-2792-4121-8d71-027a2c902d7a", "value": "c754e46f97def1e03a574662d827d0d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "984d3735-8722-11ec-9275-42010a9c0029", "comment": "Malware payload (OrcusRAT)", "timestamp": 1644134319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644134319, "uuid": "b1c63524-6a55-45cf-afef-71efd75d66a8", "comment": "Malware payload (OrcusRAT)", "value": "1d522a6c8ca3e00918799b61fd7c7b3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644134319, "uuid": "c5a1d449-ae93-4a4c-bec4-237fae765b03", "comment": "Malware payload (OrcusRAT)", "value": "2c4259c9471eb714276f38b8c2fe892b327e8de4151d22a8712370030522bb8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644134319, "uuid": "7a579c9b-1d0e-47eb-850e-5e5add917686", "comment": "Malware payload (OrcusRAT)", "value": "7cca0a8eabe4841e415783b9639abedb7745183f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644134319, "uuid": "638eda4f-354b-4668-8e80-159bf7a45259", "comment": "Malware payload (OrcusRAT)", "value": "0ff960708429f67e388ce6e7ca7769e069deb2d9e78eb4b9b67e0d53c2f44734783dacdc2ad4fcccfcf728134b2aa865", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644134319, "uuid": "f62a0ceb-f082-4089-84fc-e1d84b5a0b52", "value": "T1D715BF013FECBD06C1BE3679B7731AC90BB8E90A6052FB4E086851AD1D9B741BD16367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644134319, "uuid": "f01c25a3-6608-40dd-a14f-5d867c681b3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644134319, "uuid": "30cb48d8-06db-4739-997f-f14bdfdfdc2a", "value": "24576:EVWC4MROxnFzYurWrrcI0AilFEvxHPeoo9:EqMi7WrrcI0AilFEvxHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644134319, "uuid": "30d89819-68b1-49f8-a06a-a6cc8e3e01a0", "value": 933888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644134319, "uuid": "33a886d1-1050-4254-84f8-d0ecc69a44e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644134319, "uuid": "5a29970c-d6b3-4189-b27a-f9150cbe2ade", "value": "1d522a6c8ca3e00918799b61fd7c7b3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f501484c-8766-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644163680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644163680, "uuid": "0ebe43fb-d709-4ad0-924c-1046df7fdab2", "comment": "Malware payload (RedLineStealer)", "value": "c45d3d99f92ac16ee4366abbcd460209", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644163680, "uuid": "45f2ab62-3379-42cc-be1c-d5942eae5200", "comment": "Malware payload (RedLineStealer)", "value": "2d662a7bbfbb3d9b67a41773734433e658af3cca90ca6d77709428395578d491", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644163680, "uuid": "597690e3-8bad-4669-b46f-ae7265835fc4", "comment": "Malware payload (RedLineStealer)", "value": "92ca46aea85ae6befcc67c70eb5190dcaa332335", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644163680, "uuid": "7eca9c79-f5ea-4a3c-8f50-0f7e466eb3a7", "comment": "Malware payload (RedLineStealer)", "value": "3c07345325de4e9332b223e5dbc70c6299d641a05ddb35997ba28712af363247e918385cdad7e3e0fb345903e97c5d1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644163680, "uuid": "701ef5ea-5d9c-4725-afd5-7ce30190040b", "value": "T130E412123B90F4B5D4920D318528CBA496FBB8355A45D04BEFA4BBAF2F703E09729357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644163680, "uuid": "e9bc7e02-283f-44ca-966e-e6a4e930472b", "value": "38cced0707418d4cda11c09b2be34018", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644163680, "uuid": "7113b40f-f5d9-4d31-9122-a6b1733f3f6d", "value": "12288:kH9wLklBwsRmIV5WcKdqJsNObpOeT2nJBNpCRJIRylcfDv:A9k63kIvUqJ3OeTS3qRJIkufDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644163680, "uuid": "2c762bcc-3f4e-4375-a3cf-8b092bb4fd38", "value": 677888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644163680, "uuid": "73baca2c-166e-47ee-ae9a-ee03a0fcc47e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644163680, "uuid": "5687ed81-08f9-41b2-853c-a73fac131240", "value": "c45d3d99f92ac16ee4366abbcd460209.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77cc3752-8725-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644135553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135553, "uuid": "d43077d4-a980-4b7b-9e78-7a7d1f8d3c15", "comment": "Malware payload", "value": "cb10cf6c4191ab0a1e1c788ada78220a", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135553, "uuid": "51ffb1cf-7253-4102-b4cd-648f9b47cadb", "comment": "Malware payload", "value": "2d7dcd9454cef8854a31a145a7f6657594e0d93c94ff0ce64c1891ae5504e0d6", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135553, "uuid": "4e91d266-be8c-49ab-98cf-0264a92a2ca5", "comment": "Malware payload", "value": "0d3cb22ad480de1b90b4173d357e20b57a90a92e", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135553, "uuid": "0df99ef0-152e-4376-b444-df7421daf99c", "comment": "Malware payload", "value": "d066fb810d5f3ec379db547255d9594c94195fc4e93caaa2a3809bf6e1e6fffedb11e9b11c126f4be19134a66c2ec25e", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135553, "uuid": "fac96cbe-5221-4242-9f01-c7e09dc7f581", "value": "T122A41213318481F5EC7A81326027154A9BF2F47F93E42D9F26DDEF6618A50A2C11FE6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135553, "uuid": "5566bce3-d75f-4115-a08f-fcf3de2ed636", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135553, "uuid": "ec0158ff-816a-40b8-a086-525ceef6fdc7", "value": "12288:eCoTZ9H+yUvyVk+hvz78FRuVpxYEbVvEdf5ohAQX9fLz:eJK3ya6z78FRuVpmEp8dBRu9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644135553, "uuid": "938f80ae-9d7f-4e91-9d6d-d0ca85fa4215", "value": 478632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644135553, "uuid": "6f28db93-3ca8-4b37-a39a-d3089133262d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135553, "uuid": "35ec3d16-833b-4c72-95d2-cbd53d3c7034", "value": "INV-DHL202038658530.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2861b1f-871b-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644131464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644131464, "uuid": "f9d7cf5c-1222-47a6-8235-d008b85812d7", "comment": "Malware payload (RedLineStealer)", "value": "5f5ee869d83b6945bf95f4757def5718", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644131464, "uuid": "d0dd7d76-6666-4689-8f99-905e6b62195a", "comment": "Malware payload (RedLineStealer)", "value": "2da24494535db516936e3fdf11f46423c3be7abd33afab194bd93388ab89b0cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644131464, "uuid": "dd0876bd-d024-4665-bd62-927f0a719a9a", "comment": "Malware payload (RedLineStealer)", "value": "25e2b5a9d8036634735677c5135d47d3f8987a49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644131464, "uuid": "01fdddb1-89f8-4ca6-9b6c-fc45715bb040", "comment": "Malware payload (RedLineStealer)", "value": "261392934ee2baf0e86138b0a2ea6fa165a0471c9e3c7e6fa47471288f72c66a2474f9f7c46a3712326858af4bd98beb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644131464, "uuid": "f3f89cc7-79be-4bea-819b-888800cba41a", "value": "T1BF063328B7447906E3C3277820D5B7205FF69690E9797362EBBA74B240D4738717AE1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644131464, "uuid": "5130986b-ff19-4a97-b652-5229ce1961dd", "value": "41304e4befbbd8a63ad6ec59f252160b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644131464, "uuid": "ef544d2c-fcd4-49c5-bd62-97e70dc0ae7d", "value": "49152:mUhWI677Xp6IXp8eJof6TclNhFaiMGIednE1wf6odDL9sr6iwTXwh/tg9kz6HAh1:mD56ayeWf+oMReBVp5srETgRO+X1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644131464, "uuid": "7fe4191f-3d7a-4288-9c86-5b2207cddf76", "value": 3722544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644131464, "uuid": "1d2ddd4c-cb92-4109-a30c-92c172ac6fb2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644131464, "uuid": "4558a585-dcee-4429-b76e-173ecdc92112", "value": "unicore.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ad9769-86ff-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644119408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644119408, "uuid": "a7741f65-993a-4e1d-8ee2-7f04fcedde40", "comment": "Malware payload", "value": "2d31ae5ed9c5523a1925f95fc1897561", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644119408, "uuid": "6bd398a9-dd75-415d-8016-e91ce36c6f55", "comment": "Malware payload", "value": "2f19807de743219506c5c26353fe221e91e78c8da2f032288394df55da510be5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644119408, "uuid": "53083ea0-fdab-486d-b43e-12ee658022cd", "comment": "Malware payload", "value": "a25501991cbeeb56e57cccf595eebb308df6e80c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644119408, "uuid": "7a346428-107b-4222-b713-75a2aa380f4a", "comment": "Malware payload", "value": "34dc9e68035f6ed322a14c4a44d763a66e4f8965df0d5ccda0e21ced2f505e04ad9ce3245ba8566a3ea38e833c7c6164", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644119408, "uuid": "7219a032-b532-491a-95b2-664e025e99e7", "value": "T1C103E19394213083E8F04973CC9F57BA331D0FA5DC8315666FE48E56F66A806A8FA45F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644119408, "uuid": "67150d75-ccf2-4a30-b9dc-138d41cd2c0b", "value": "768:Lanrv/8vr4tVhXQsp07F+2yUnCMb2m7Q4g5nyicBaSTz33UehM:mnr46XHp05+2Fnjb7v7Bx/TM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644119408, "uuid": "27e36775-7fe5-4a2c-8518-37eb3395e77e", "value": 38528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644119408, "uuid": "655cd224-3ac8-4fa3-bd1c-3a1b1d45ca4c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644119408, "uuid": "c499eb5d-ddd4-4541-ada5-96b892f56a92", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f82474c3-877a-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644172276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644172276, "uuid": "bf146d05-1466-4a99-a47e-d4a27fc3ba6b", "comment": "Malware payload (RedLineStealer)", "value": "3f77f23a8babf7876f8a21d9c3c5b18f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644172276, "uuid": "25558f9d-e2cb-4b28-bfcf-a4a528be052e", "comment": "Malware payload (RedLineStealer)", "value": "2f3cf6f156ce19666bd422299ae5a2055bc1f93dc1ed7330b7305668ef7b3cd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644172276, "uuid": "aca31e79-1eb0-412d-90e3-d527cca020f0", "comment": "Malware payload (RedLineStealer)", "value": "aff4910dc3f7e8369026a0fa1ed8c26ade19c51f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644172276, "uuid": "3c0ffcf3-0ed6-40d2-88f0-c9df239a1c50", "comment": "Malware payload (RedLineStealer)", "value": "b01c7425ddaf3c0edbc2598ff9f50dc6f609d9e2082b8f17fd21947780b8cb4c2ef2a8b30d518bea303d77114809d387", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644172276, "uuid": "17f4e484-810b-4ede-922d-f91499445af2", "value": "T1371633E420A4C0A7CAF30AF92670F79AD25E7267D66442F54BBDED9F74C8711630211B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644172276, "uuid": "25a50c29-3752-42b5-993f-cb6d22dd735b", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644172276, "uuid": "034543b4-c06d-403d-9d82-cc8bc0d8b0ce", "value": "98304:yFnBC5eRfpmTKBuAlFKdotj0Ip7znGPDXbl+owpifewDlFXXh7:yFnY2BVoij0IdDGbXTlRhXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644172276, "uuid": "1180e59c-e432-4b25-b158-90877e087466", "value": 4071436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644172276, "uuid": "7d3d2185-9e7b-48a3-8416-6f66448e9d88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644172276, "uuid": "7f6fea9e-1559-49e2-be6a-dc8e657cd2a1", "value": "2F3CF6F156CE19666BD422299AE5A2055BC1F93DC1ED7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a8abd82-8725-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644135423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135423, "uuid": "57be4ea7-c428-4f9f-9495-6f9b3626f7c0", "comment": "Malware payload (Formbook)", "value": "b60815d71371b4b53f36e0369e76b713", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135423, "uuid": "5dbae32e-e3e7-4f3c-83ca-f744139e11d0", "comment": "Malware payload (Formbook)", "value": "303567375a32e4f80c22e7f63f077a57b120f1e537ef9ba6d4976b78ee3b70f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135423, "uuid": "641c32ec-3d12-4792-89c9-3518bd93937b", "comment": "Malware payload (Formbook)", "value": "f12bcb72e04fe95923f85afac05646790e30c0c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135423, "uuid": "35a6886e-97f7-4945-8ae2-adbfe94808a7", "comment": "Malware payload (Formbook)", "value": "6905aefbb333162d9ebb700de789cd6e39a3af8a3eea2a40fd979e1fa896cb1b0472c21434813fd28a2034a43dcfc108", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135423, "uuid": "36572343-e8b1-40f5-a1c2-214828fddee6", "value": "T13444121BE8D01CAACC1E06745BBBDBB2CB7AF6084BE45B5F77155F5E440A642DB022C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135423, "uuid": "265a15af-159a-40cd-9ecb-844e738f0937", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135423, "uuid": "c40411d3-bc00-4457-b59b-927f615be3b3", "value": "6144:owPJHBMXnpcLV24FyPrMfFYf6NBitd1k+MmQohT+jawJ5:rxBMZIDFHFYkBi7CnSqjau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644135423, "uuid": "0113342b-465d-4aba-b2d1-e7dd7ad8c46d", "value": 256319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644135423, "uuid": "92cd785c-5071-4b25-a5aa-2fb3b22ea077", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135423, "uuid": "c2a225a4-647c-439e-90d4-d37d783af5aa", "value": "E-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4510345-8726-11ec-9275-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1644136057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136057, "uuid": "448ad355-94c0-4307-9f6c-64e6b94cff5c", "comment": "Malware payload (AZORult)", "value": "51cf94dadbaf78769db8692ceb4a95e0", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136057, "uuid": "574fc848-2ead-44b0-a2ae-a207065559a5", "comment": "Malware payload (AZORult)", "value": "3078dc84b2887fc1c911b071b41e90e905a5c0e7b024df6e0bf1dc9642e20292", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136057, "uuid": "ac7b5230-d47b-4eab-a7d6-1d981bdeeb03", "comment": "Malware payload (AZORult)", "value": "ed9068f55ed73e9bab881f695e6fd094f043fd50", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136057, "uuid": "bc8e44fa-3826-4e78-afa7-4a5dcd9c7f7c", "comment": "Malware payload (AZORult)", "value": "b4261c502b8e5d0d26d112ce846d272bcce0a98151e95abe93f7296a62425f4d8dc118b96eaf41c776f07cd1ae52142a", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136057, "uuid": "16e5f61f-55ee-4612-bab7-396872dd1126", "value": "T138E45ABC317075EEC9ABC031DB681D68AEA06C7B930B5567901731AD996CA87CF241F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136057, "uuid": "17bd22e9-6db6-4a96-9081-35f1ce9d4355", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136057, "uuid": "82a1e415-874d-4884-9cc3-8873a0e1a85a", "value": "12288:y+lfTQoOyocDQkjdh0BhiVop/dosBFPydzjj4pJ83bDYzzWJ96Q8FJRiCZMJ9YLr:y2r8bSQGgFp/X1ydj44HQ1jA47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644136057, "uuid": "55dbf634-8a5c-49b9-b665-e22d23f4ecca", "value": 713216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644136057, "uuid": "2eaae85f-5f05-4f97-a23a-8a44e822050e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136057, "uuid": "7c1e1db1-ad45-4475-ba49-e58e583d74ff", "value": "Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b0306b6-8727-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644136337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136337, "uuid": "ab2769b0-0ce0-4cca-8d36-cf6ab669e5c6", "comment": "Malware payload (RedLineStealer)", "value": "0e31000ffd91929faf7ee82955f217a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136337, "uuid": "f8e05355-ee28-46ed-926d-455b68b5cc5b", "comment": "Malware payload (RedLineStealer)", "value": "324a89be242f69318c7aebe527f99698e39124572567ab3978c5278be373eeb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136337, "uuid": "8acc14ad-a112-4b3c-a448-501b723789a9", "comment": "Malware payload (RedLineStealer)", "value": "35807c0cb1c60c63210277091f83ca16e631d02c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136337, "uuid": "49db0e1a-1ba1-4cf0-885f-fb0f8423da49", "comment": "Malware payload (RedLineStealer)", "value": "9700b6b28a915b1aab97d3f004ebb1be5e816054c7471b726a3affc5bb276f584b4549a9dddbb312fcb2a78db00266b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136337, "uuid": "c9e51039-981e-4385-912e-ec2033d68253", "value": "T1B48523072908E451CBEDB5790F36EA3953C56C9D6C80D5AB74FABF8B36FC017A205229", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136337, "uuid": "93f0e396-bdc5-402b-8afb-89d3cb3029a8", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136337, "uuid": "aa642e3d-fd31-400a-9412-12cad981253b", "value": "49152:X6CrmaLAM9H4lo34b7uyVtQKbR8yO6Naiy6g:XRaa8MaloauyVrR8bmQr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644136337, "uuid": "63616179-3b5a-4f20-aa67-5a84c3bb1deb", "value": 1852928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644136337, "uuid": "7207f0b8-50c4-47de-b014-2a933cf5e25b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136337, "uuid": "45559ed8-6e2d-47be-9b73-e60753afb6a8", "value": "0e31000ffd91929faf7ee82955f217a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b94283ba-8750-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644154131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644154131, "uuid": "fa159bb5-24df-4b21-8c57-5173edc06f56", "comment": "Malware payload (AgentTesla)", "value": "c852f8ee126329da4e5f72ef79004218", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644154131, "uuid": "68b9777c-ce9d-47c8-91ba-c46a19dc8b9e", "comment": "Malware payload (AgentTesla)", "value": "333d5845bf72807c07f45b6626aee04fdd92b8eb9e8cf17dd4c1af2ec74f01f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644154131, "uuid": "88e59141-7f68-4c9c-8142-0e84eb7df9fb", "comment": "Malware payload (AgentTesla)", "value": "6909fe64865c8a84ad6058b2f0fa7bce981ef14c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644154131, "uuid": "87a94ffe-b207-4f09-b7b8-da2ae047e6f1", "comment": "Malware payload (AgentTesla)", "value": "04b6733cba2c6e9438023c3b36fa38e0dd480978417c14cd92751591824dccb5c6ec305de7384e6e5a6a50b78b4496ae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644154131, "uuid": "49c5f3d1-d4a2-406c-ae8d-53308fe74ae8", "value": "T11B54D67125797635C0887F3F8691187A5DFF6C402A6E87D96F32B269103CBDA9F8240B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644154131, "uuid": "f16d3893-44d6-47ff-ade4-644ab219e370", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644154131, "uuid": "8f146ba2-02a1-42fe-a088-db3322d13511", "value": "3072:ri1buITznvUPh0kudnd9caTFt9GqlciuCTKNYLVbOCrAKU1R7iNy/V5/Qs9KTSpD:WbRTznyoIi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644154131, "uuid": "87580d9b-5349-420f-a456-a5553c0af852", "value": 296448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644154131, "uuid": "066a0cfa-e6a3-4276-bda3-02c7eb505f3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644154131, "uuid": "e8ecfbed-cabf-447e-b619-a497384a545d", "value": "New Order_____pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bc7506f-8783-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644175744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644175744, "uuid": "63c00e31-7fe4-4e78-a986-dca73d10e8f2", "comment": "Malware payload (Mirai)", "value": "b03f459955cc18319763c09b3b080334", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644175744, "uuid": "2d80683d-cef4-4b80-8e69-e4504caa9501", "comment": "Malware payload (Mirai)", "value": "39dd19fd937bf2e9dd88409e6e88c402f4674b68d3d438faadf272d38432e3dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644175744, "uuid": "5ea09f9c-fedc-465f-a33b-9eec5f7a0597", "comment": "Malware payload (Mirai)", "value": "7656ff82894c7fc76831a671cd6da93bed8441e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644175744, "uuid": "77e74492-988c-4938-b6d5-57aba336da9d", "comment": "Malware payload (Mirai)", "value": "936083c5e83220d968f4757db78985a605cab34c354c109872df0510d2b15068063827c9a8b5e57c179e14b15ab260ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644175744, "uuid": "d81556fb-a55c-4419-8084-496907de67e1", "value": "T129A2D024B145FD34D970897DEA789ECBB5350EB0F2F737912A140A647BC980672B90E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644175744, "uuid": "95590bc2-e941-464f-ba99-1738e6e2ebef", "value": "384:6XdEbHhQQabhnDjHQB836q7TCiC3SVqlofjgUqRWN78NJLFbg1hymdGUop5hR:Y2aQabRbQB83h7TCiWSVxfjDNN7281sp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644175744, "uuid": "38ba25bc-c848-41d5-8307-cbfdc32b5870", "value": 22468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644175744, "uuid": "fa769354-a51a-4d48-bcdf-ec2c4ae13f66", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644175744, "uuid": "5874d893-c2e2-4cd0-85e9-b37500dfb8b2", "value": "b03f459955cc18319763c09b3b080334", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0097a1-86e0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644105817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105817, "uuid": "f2207954-5ed4-4b08-b778-c56afac6cc8a", "comment": "Malware payload (Heodo)", "value": "d9b34c5185692664a434b827160666a6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105817, "uuid": "954ccc26-4a36-4fdd-af6e-a86e24d9ad59", "comment": "Malware payload (Heodo)", "value": "3a491ff0296934f80b085932588668ebcab7a1b48feee8f6ab8664a448b60e57", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105817, "uuid": "eca561a7-1bcf-4a64-abd7-8db0ae03a2dd", "comment": "Malware payload (Heodo)", "value": "b65c44f8a876e0cf5645e51a08214b4cc5b53813", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105817, "uuid": "9c55253b-f9e8-494d-99e5-152e077a092b", "comment": "Malware payload (Heodo)", "value": "e0309c017c31e105ea7329a8133327a09c5ebe86f972182c3713988c5c23ab9869872076a8c24a624d6b2dd2cb70dbd4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105817, "uuid": "7463eb8d-9e5d-44aa-9821-df6158553029", "value": "T1E225AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105817, "uuid": "3b8b2996-3327-4090-94a3-89f9c8873bd9", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105817, "uuid": "9920f79f-81b5-4f6b-971f-b8d3cdb21b96", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxufFIIm2m42:1ZsYB7vLsnZI1Hb9DxFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644105817, "uuid": "5e42dcf7-0b21-4614-8394-2c4889c46589", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644105817, "uuid": "a8e6d481-6ada-45a8-891e-701682b82994", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105817, "uuid": "a7e87476-19ba-419d-b24c-103cf89a6327", "value": "emotet_exe_e4_3a491ff0296934f80b085932588668ebcab7a1b48feee8f6ab8664a448b60e57_2022-02-06__000332.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8598025-8726-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644136091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136091, "uuid": "54d405d6-e34a-4f97-8e91-44476a058cd6", "comment": "Malware payload (RedLineStealer)", "value": "a437c0d42074bffb47fbcef0b4ec7315", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136091, "uuid": "344974fc-ef7c-4f7a-a9a0-730718f733f5", "comment": "Malware payload (RedLineStealer)", "value": "3cadccad5b4271e3ecb40af4835ca8d94ee9f8c96396c35812fa85375d9043be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136091, "uuid": "f00124c8-1e92-4b9b-b91b-d9b2130ca2e9", "comment": "Malware payload (RedLineStealer)", "value": "e6a0bb34d2a5a064262254480e1deef7b1da4322", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136091, "uuid": "d83e4126-ba09-4d99-9c09-4f056dfdd841", "comment": "Malware payload (RedLineStealer)", "value": "4be3b8adbb8dde789a36a805628902b05513e1ad03e331a63c16270653e1af1cc9c35863009feeb6d21be4bb83fcd0c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136091, "uuid": "707c750c-5eed-4ddd-9666-495e8d1b9906", "value": "T18E0633E72A00BD40C789B8B80F59861AD3F8D5A45CC5E9CE950FDD8366A0735DF908EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136091, "uuid": "162a2363-19d7-4c95-8cb8-ff5a966628aa", "value": "41304e4befbbd8a63ad6ec59f252160b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136091, "uuid": "c41ca109-29a9-40ca-8e86-24086cb8d089", "value": "98304:gSEqtvGNdNduGtobtZy8tFOf3jVYFjwg3uQ1u:1EqtvGe+obtZy83Ov2Ug3N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644136091, "uuid": "7595431f-dd61-4249-9951-80aa928617b5", "value": 3710768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644136091, "uuid": "a4ca04a6-7717-4480-b68e-e32a4a17e9a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136091, "uuid": "5174d1b4-eb26-4e36-8741-5cb41924fca7", "value": "a437c0d42074bffb47fbcef0b4ec7315.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3928ea98-8707-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644122563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644122563, "uuid": "ef59dc8a-19fa-4b04-9705-45474afa4fd1", "comment": "Malware payload", "value": "8b25f90241dfd63a2c2b3d802c302f59", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644122563, "uuid": "9747735a-02da-42c7-b538-a0ff7179f2c7", "comment": "Malware payload", "value": "3d86386afe4974f160cc1abc842e957e805bed5c09233821e4066d297d29ab7e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644122563, "uuid": "f2eb8552-8a5f-42f8-a42b-ca7e0c7871da", "comment": "Malware payload", "value": "d7c6282087d6b68dc8de1e577043c1ac7a98e9b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644122563, "uuid": "e115428c-7f4d-4cfc-8ca7-63dfd554724e", "comment": "Malware payload", "value": "105784db1f35cbba3d9af8a668fa542e6c2f79740185a66d10871dbb65fd263885a4935912358699c12504c8d93481f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644122563, "uuid": "09a1d95a-4d46-4392-83a6-caceb6e08965", "value": "T15903D172B78E5B90E5FAA6F5BD697FC1934492E960A585B153ECCB744210203417CFC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644122563, "uuid": "8b983dc9-ab1d-4286-b181-3acf68e44a3d", "value": "768:TGVT5sV14kEkI5UACdbEp9uMByS0eO4mPkstcoNHD3NOwuRbGbJT4uVcqgw02NWI:ids4CIapdAlSBPBcoR7NOlRIT4u+qgwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644122563, "uuid": "5991fd33-9a0a-4d19-9eea-8dec72d424c2", "value": 37828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644122563, "uuid": "c736594f-f2d3-4619-ab03-97b1d95da963", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644122563, "uuid": "208f568a-7b2e-454e-b89b-a683aaf6ae78", "value": "8b25f90241dfd63a2c2b3d802c302f59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15d99b40-8727-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644136248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136248, "uuid": "04bf9d33-d70c-47df-97df-315a14ef9850", "comment": "Malware payload (RedLineStealer)", "value": "a116bf2df52636e2244047549a3ba0bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136248, "uuid": "7c9afdf6-98ba-4b3f-974f-192170254dc7", "comment": "Malware payload (RedLineStealer)", "value": "3df5ec1135412e64d5b3641c36fb2b34c741ee6286ba9786001a006deb889c85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136248, "uuid": "37f06297-781a-4388-b56b-ead029902068", "comment": "Malware payload (RedLineStealer)", "value": "ed9ed7652161fbe162f0e1fbc45e1a359a2bdd3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136248, "uuid": "e008c3a7-054a-4b05-9350-e644f60bcdb7", "comment": "Malware payload (RedLineStealer)", "value": "95ad164b554d236ac6d51235048324ba1acbd56a86171cf02ae568f659a0a7682cbe5241791a548da50054c869f6ec3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136248, "uuid": "b0f3eb9b-764a-452c-8487-d5a944c613c1", "value": "T1E1763363AB019352E7415C3906896D60863F63A37E58C7713AAD1B38D07BBA72FD1BD0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136248, "uuid": "b0bb8f77-4a9f-410c-bb63-b3f225f92256", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136248, "uuid": "fb29cae3-2820-4726-a61e-8a156f3acf0f", "value": "196608:JAzBsMlAlxGro5xPR19vLqQnsvzXdWNzz:JAlDQxq8H9vL2zdgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644136248, "uuid": "877b58e0-f977-49ea-b942-b51a57e6e122", "value": 7684244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644136248, "uuid": "ecae9d6b-12e7-4cc8-b6d5-0fc70f131f5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136248, "uuid": "26a95cb1-713e-444b-b1c5-b81e8bce53c4", "value": "a116bf2df52636e2244047549a3ba0bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "402db422-8722-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644134171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644134171, "uuid": "73e9089a-6e5a-488a-8a73-ce9e15cf5a01", "comment": "Malware payload (Formbook)", "value": "ba8f2981ff8c6669f70f10f382026430", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644134171, "uuid": "b7507584-e68f-41a8-b4bc-7f08a6fe5632", "comment": "Malware payload (Formbook)", "value": "407bcfc4b54e3e776a36fd36954105d824279a724990218f8f52388c42e65acb", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644134171, "uuid": "5f033f78-d0ae-4703-ac96-0a38fc137aea", "comment": "Malware payload (Formbook)", "value": "8eceeaa024f54836c6bee662543391bcbe304289", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644134171, "uuid": "967877a9-7303-4ac8-b483-11de124e8564", "comment": "Malware payload (Formbook)", "value": "a384c4b61ec33a099626935f57f80adb8225f30d3204e8cb6e36f3b9cd2089ca65d41e95efc06b3ff780b09798b18aad", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644134171, "uuid": "006b02ef-025a-4d50-94e9-9b3f1310d3da", "value": "T132F302ED22D79759CE3597F8002AE2FA5E9ADED069D8EE4112D93E8D707E200D1391B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644134171, "uuid": "1a4b0e63-d407-4f30-aa9d-0c0c846ae180", "value": "3072:grcPNJktz929+6qa6duBMUig9v4/dXSIicplpwRXj+3p7an4/M83+IQhwz3Q:xPLktxU+6z6kKdg9vC1pST+An4Ebhwzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644134171, "uuid": "2d6f047e-1ef0-4091-ad47-668c2dc86ba8", "value": 169320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644134171, "uuid": "e93c37f1-6d6b-4794-8a2c-899c3ebc33eb", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644134171, "uuid": "0fd9361b-bf60-4028-896e-dfa800756d69", "value": "Quotation.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb56171-8722-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644134164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644134164, "uuid": "f574fee1-0092-4fa7-91fe-65af78e8e9ea", "comment": "Malware payload", "value": "68dbc12fa29075e9dd6ff02c9f2611ea", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644134164, "uuid": "10f013f9-3a7d-4c2a-8b93-65ac9bc3f873", "comment": "Malware payload", "value": "410563fad46fc0d5918e183ad7c2b08be0df86c05c32501125a183d6e25dec52", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644134164, "uuid": "a9863e70-7219-4536-ab9d-38e8d22bd799", "comment": "Malware payload", "value": "4508ee7fafb59c51b3f32c844c0674b2ca4c5482", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644134164, "uuid": "fe276d3a-1e6d-42f5-9426-3650bbaa313c", "comment": "Malware payload", "value": "1af9bb3740eeadc468b48ba5d0ea6b0d5124d049656c752b805176326863f5eff3dd9b6b0bda97da9897512ee270b722", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644134164, "uuid": "256019e5-2524-4291-8b6f-c99c19d57b38", "value": "T191E57D2FB284653EC4AB19364537B358993BBB716A168C9B17F6088CCF355802B3F647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644134164, "uuid": "8e0511da-e088-448f-809e-8ef237eaa785", "value": "49152:T8ugbstQzlBmtIp4SOXu7zK6y8GvlTjuXdsRAYS3A:UbmQ5QqKSWRhAYOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644134164, "uuid": "667e436b-0594-4312-a64c-f501af3638a8", "value": 3054080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644134164, "uuid": "50b26ff8-887b-4244-bdb2-2e6667139a58", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644134164, "uuid": "b30260a9-f7e8-4f3b-bc58-a98a611b30bc", "value": "Arch-Endes.Fact0502.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "956c983e-8726-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644136032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136032, "uuid": "9830b21a-66e1-49c8-8cae-971544acba51", "comment": "Malware payload (Loki)", "value": "0f190d098d7282f58fa5749b3dfd1612", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136032, "uuid": "a5213026-df0b-4cb0-948a-a170103ec526", "comment": "Malware payload (Loki)", "value": "433bbd895d20c467d50a6d9909eab21c1698ba1ff876a95abb912dbd7a10a253", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136032, "uuid": "2bf99ecd-b0f0-471a-ad7d-dda7674335ac", "comment": "Malware payload (Loki)", "value": "50d282b3da43b851883ccef9ae76884e5b8eada2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136032, "uuid": "014b15b3-ca77-4806-9654-8612adff3e34", "comment": "Malware payload (Loki)", "value": "412bf58bd2ca8a9b57a197f1d5b6daa5dd08f5e34ae3332313c8218146308da9cf2f152ea2e18f76f2a5417a5682df47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136032, "uuid": "e31e2c69-b3e5-44e8-aa0d-533dedfb7562", "value": "T165847CB4A5A78581F10B8A74267CF9B502B231E3E9C60D3427797645CFEDF983E8460E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136032, "uuid": "f147885c-3434-4047-8576-f466966c3767", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136032, "uuid": "2a9b7f5b-74ab-4a36-bb05-a341ae2ec247", "value": "6144:KEKVO7JpyTaFtPvvtaw6YuDzb1y3AE5RW5IB5lf18dPHokJ7tGG:K5VO7JvtPXJ6YuPCRW6lfi5HJtGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644136032, "uuid": "a4935519-22d6-412b-8d01-1963ef6f652b", "value": 390144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644136032, "uuid": "afc3b841-d84c-4669-b0bb-f22f08fc261d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136032, "uuid": "1e7b171c-8803-4139-8ebd-98bcbba27193", "value": "0f190d098d7282f58fa5749b3dfd1612.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "959f8188-873f-11ec-9275-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1644146770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644146770, "uuid": "51a18f77-95d5-473e-b633-7999ad2d4b01", "comment": "Malware payload (Amadey)", "value": "e4c32d55ef305b863caf948c74252d81", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644146770, "uuid": "beb52ec4-e6a1-4acf-b06c-67f9928a0265", "comment": "Malware payload (Amadey)", "value": "45035bf547b0aa25f7df53e6b904422c870c2f002c05680548737dc76c0dd191", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644146770, "uuid": "4e43af3a-a2f4-4b56-a94a-caf005367ea9", "comment": "Malware payload (Amadey)", "value": "b6256872a613ca6d5a071ca4f3e13971f484c655", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644146770, "uuid": "ac9764eb-74dc-496d-bb9c-328b4e6d62af", "comment": "Malware payload (Amadey)", "value": "04b394ca0b9ca1f83e40e20c736a77dfbb5e7921513e5ff71204bf224ac24ee5492eb3659ac8cd685cdcc9bf35b37300", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644146770, "uuid": "d35cd009-c65b-404f-afdc-312fc199dea8", "value": "T13544AD1036A0F632C5861D705424DBF166FBB8729960964BF759BB2F2F303E112B6357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644146770, "uuid": "cf9bfeaa-a323-4367-9590-b33b0842d04a", "value": "5d5ea99353835429c4a88fcee781ef0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644146770, "uuid": "e593cf7b-3284-4b1d-b1d3-c3affc103a3a", "value": "3072:ag4nDDLLEDLvYRYT+BDSkDyxfX9ZfJsxkgaBChxDBJlKd:ag4vLLMLwfWftZfOigaslKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644146770, "uuid": "297aa7fe-61a1-410e-8b16-2ecc805815a3", "value": 267776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644146770, "uuid": "82cca0d7-26bd-46f5-b297-88a523288458", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644146770, "uuid": "99347ab7-e4fa-4437-b11a-fb5afded5b57", "value": "e4c32d55ef305b863caf948c74252d81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b797ae3-871f-11ec-9275-42010a9c0029", "comment": "Malware payload (SystemBC)", "timestamp": 1644133009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644133009, "uuid": "d846e24d-4345-49cf-9198-a469d57d260c", "comment": "Malware payload (SystemBC)", "value": "bc6c722eaa639859b898de9e2ed17832", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644133009, "uuid": "84c95464-d882-4a2b-a0f7-0fe154465435", "comment": "Malware payload (SystemBC)", "value": "4aec64f64812b8ed41eebe2d561d166b6dc9c16f2a856f7d10408ec83f493c06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644133009, "uuid": "af9804a2-8773-4fdd-8a51-c1ba052cc40b", "comment": "Malware payload (SystemBC)", "value": "bff54c4071ffecf0e822faea1712cdf7c3770dd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644133009, "uuid": "ef72b81e-7e69-44af-be7c-d1eb884d7ea5", "comment": "Malware payload (SystemBC)", "value": "1f1fb75cd6a1a425010bd799e7a2350f170266da174adbb68dfc3f0ebada7e16856085638fb2ba739c1e23dff56b41e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644133009, "uuid": "0c9dc8cc-2811-4f09-8fd8-77c641026a8b", "value": "T1D6448D00BB90D035F1B711F849BA93A9B93E7AB15B2051CB63D52BED1A356E1EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644133009, "uuid": "d91f79ce-b980-4596-948e-d35bac262c4a", "value": "8c36d2c5b43a5a31e6eadec7848f46d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644133009, "uuid": "24df1271-0c69-4752-9c11-f32ce598ae46", "value": "6144:UN16onmBGawpu86pYM41UqoMmDZ06BL/kRg0L3fX:UjmBGLf6pYcqoMjML63/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644133009, "uuid": "f75661a4-4fea-4fed-9938-c950834d0f56", "value": 271872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644133009, "uuid": "7b04015e-ac78-48b9-909c-695d4cc53484", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644133009, "uuid": "9f8cdf1c-107e-4776-bb3f-05bc96d1089b", "value": "bc6c722eaa639859b898de9e2ed17832.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ba9724-874b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644152003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644152003, "uuid": "2bda0277-c0c1-4102-b822-8760e449c7e2", "comment": "Malware payload (Formbook)", "value": "47d39a5c7855836010a58327d5a3c815", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644152003, "uuid": "ff173265-f987-4c99-9c89-929942ad731d", "comment": "Malware payload (Formbook)", "value": "4c5d57b063eeb8b59a0d22007e4698b75e7f16d2144636fd0610661a733b5b1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644152003, "uuid": "5206f626-91bd-40e1-bda3-6b7685989cff", "comment": "Malware payload (Formbook)", "value": "43706a6bf5300d67d80464aaeda18914e01d5059", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644152003, "uuid": "c78d25ac-ca86-4990-8768-3d7af3eccd5e", "comment": "Malware payload (Formbook)", "value": "7032b34c310106eadc7b4341d08a31fe0ef28b7119634121df8f0deb35449d7fd48ed22d9596d49f91bdfc92f757fb6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644152003, "uuid": "e6215f0a-4c07-4426-8bc1-1145c96e5bc6", "value": "T166B4D09039B88FE1E57E8BF8212A7CA007F0356FA4D6E55F0FD861C56AA4F451A44E0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644152003, "uuid": "8d5e3487-1532-4f9f-8ef6-0172d74f0d2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644152003, "uuid": "93235f31-07b4-4e3b-bc4f-7de7811a044a", "value": "6144:oD4iIVoIb1YYhjNJINo505YY3UE1xIYo4Y+2FCjH+gwD1vhMxda257yTa:VVoHWB+1h3IqsCjH+RPmda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644152003, "uuid": "091fe1f6-8182-4e67-9e11-50a7e07012b1", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644152003, "uuid": "bcb601d4-745b-451a-85f8-d90475f73f17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644152003, "uuid": "524ec0ff-82f0-4b01-84b5-4bb711fb2091", "value": "new FOB order.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e6c9932-8766-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644163428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644163428, "uuid": "9fdee8ac-f81e-4d47-bed7-a64c382a0a39", "comment": "Malware payload", "value": "92e6d1acf256d3f269493a7737073277", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644163428, "uuid": "f7d4e147-8f3d-47e4-895a-b582e356fa9e", "comment": "Malware payload", "value": "51636185f050c3bd7831ae68d4ebe8c46192cd64112a0762cd8ea92cc4d35894", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644163428, "uuid": "891a768f-c2e2-42d7-b04f-bbbc33139d74", "comment": "Malware payload", "value": "05c58732ca084aedc71dc39e9d3cb3cb45c1172c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644163428, "uuid": "797f0f7e-dc83-4f8a-b567-ca8ca07b8295", "comment": "Malware payload", "value": "30c47e5b0f586e4fc9b5b76f106f692b33bdb80db8a6d7a000b6efc20ea6c7fae4016af468ee69b0fc295da50a9c9d7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644163428, "uuid": "c339623e-b9f0-4606-95c2-936a56e7595f", "value": "T1E1F53346FAEA7175D1C023F3093726AF60D2B291D876845CC8BC0F125DA839E6EF956C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644163428, "uuid": "16647623-9324-496e-898f-31118e24b759", "value": "c284fa365c4442728ac859c0f9ed4dc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644163428, "uuid": "54c8c875-e9d3-4640-b1a1-7e66bcd1dded", "value": "98304:tvPiArMLya69oZ6qkIDVY+qTvbqzTfhP4ZqLESVTK:xPiANH9hIDVYNDWg2ztK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644163428, "uuid": "85e780f3-9e2f-4063-a04a-04fbecff09fd", "value": 3426647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644163428, "uuid": "24742925-1d25-4844-aa7f-36ffe2f784c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644163428, "uuid": "b9fefde8-462b-4afb-8894-675759ffdf98", "value": "92e6d1acf256d3f269493a7737073277.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c6fd2fb-8751-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644154378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644154378, "uuid": "c585034d-7488-4d39-9d1e-1599697d7025", "comment": "Malware payload (Formbook)", "value": "7ce82f4578caae20d981571ce3d55472", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644154378, "uuid": "4457834c-f1b8-4de9-b182-4bd02ce6e0ef", "comment": "Malware payload (Formbook)", "value": "52645e1f6ff0a0deb62dbdd724908484f11bbc53a81b82180ea0b234bedc502c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644154378, "uuid": "b20d9c0d-c01a-44b2-87b0-a67bc4df5d71", "comment": "Malware payload (Formbook)", "value": "d0d3d7e4cdf5496538c62a2f42dffcf215f951cf", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644154378, "uuid": "5377a13e-01b9-411e-8ec0-b6258f6cbcb5", "comment": "Malware payload (Formbook)", "value": "1ef650aee28ef2c6aa9df8472cf23e1136f680df1a30806efc9c0e7f1e40d946120c114685f2613bbfe7398c1ac33ad4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644154378, "uuid": "de1162f4-efa3-462a-aec4-806e661ce46b", "value": "T1733423536632FF6EB395813EB5EEA0A098D86A7E10D6D81DF07762E500561F308DD8EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644154378, "uuid": "6a3a32cd-06db-425c-8692-62efd68cdbf7", "value": "6144:/spBx645YwRcDgpBUNIOm37jF/tuOdNv7icun1g:Exl5YwRc6i0/tlNur1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644154378, "uuid": "0bcfb68f-8242-4a1f-b572-1167cf2ca006", "value": 244536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644154378, "uuid": "fd99596e-501d-43b8-b36e-c39479c55c60", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644154378, "uuid": "47eb58e9-e077-4ef2-af25-66538d3da95d", "value": "1643979222.Vfc11Ibb0f2fM634797.dynamene_liste.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39c93ccb-8727-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1644136308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136308, "uuid": "7266907b-cdbc-4777-91e0-38f8a3436eff", "comment": "Malware payload (RaccoonStealer)", "value": "fbcb99ddc4afcada98adc00ab5f524ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136308, "uuid": "7893d6c6-c5cb-4ba9-9c71-e0c0e4c23aac", "comment": "Malware payload (RaccoonStealer)", "value": "55fd4a33bb717aa90075268ba947dfb7352c867b52319fe853b972fdca78eb5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136308, "uuid": "c4c11fba-d238-4b60-aab0-573f569526ad", "comment": "Malware payload (RaccoonStealer)", "value": "40e23baa4d18a6cee3dba09f21b55dcda07e2161", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136308, "uuid": "bb40fe9b-938b-42bb-a8a3-18f5b265a39a", "comment": "Malware payload (RaccoonStealer)", "value": "3ffed0528038e28226aea8721dc8b1090b246917928b59f4629294d191d47e61df10dcd0eb7dda3a94948f0737b4c824", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136308, "uuid": "0b44a7bb-f8dd-4c51-98d9-6e4a0170b8a7", "value": "T19E25D043A25480D0EAF922711976BF38B03E27A9DFF4A8C669D57CF709B4BD06C30596", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136308, "uuid": "2efacf63-eae3-43d9-9dc1-bf3fafe8aa10", "value": "55ae6049290b1a231db6697392c2b841", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136308, "uuid": "71120416-7add-4c1d-9fe7-7a5f2a32a68f", "value": "24576:zmYnrTZW0cUL2m7uD4HJgWHV2KHELmObIOAPgs:yy15cULuDNQ2KHEaOEjg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644136308, "uuid": "1a0fa9ae-e23e-4f04-aa6d-32e1d5546854", "value": 1009152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644136308, "uuid": "31818934-52b4-4c10-be3a-a7958c7d6664", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136308, "uuid": "3e4efe26-0568-48ec-ae7a-b571d2cf5170", "value": "55FD4A33BB717AA90075268BA947DFB7352C867B52319.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77351f68-8785-11ec-9275-42010a9c0029", "comment": "Malware payload (ParallaxRAT)", "timestamp": 1644176784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644176784, "uuid": "07c08571-772f-4e09-baf7-d3ba8298524b", "comment": "Malware payload (ParallaxRAT)", "value": "70927be7aff7707a3b59611b7f4508e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644176784, "uuid": "0671ddc0-3983-483a-b532-d990234548fc", "comment": "Malware payload (ParallaxRAT)", "value": "58a6a07940b4e3f69415097f67f8062938290677d0c9632f29a8facddd2de46f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644176784, "uuid": "c4fccbb6-fe8a-4758-a8a1-5b3a7a72fb25", "comment": "Malware payload (ParallaxRAT)", "value": "56d9298b30c6ec93495be3072f9ac3c97bf29e45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644176784, "uuid": "02f8ea8d-e4b7-4fdc-807a-abdccd8e946e", "comment": "Malware payload (ParallaxRAT)", "value": "bebd2b50c4d773b2fbdaaf5a8134490dffad41fdbc8db4423d9a0ddef68db22eb45dd44389a2bb537a13d9baa3bf421b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644176784, "uuid": "d5280893-d877-48d4-8b23-b0aa9b95cb7b", "value": "T19336B0217D436036D1A7023049C8F7FEB5ACEE6067354AC7E394BB586B326C15E1E26B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644176784, "uuid": "87ea4ed4-7f68-427f-a261-18e0fd489684", "value": "285bc9c3b304c5a1d9ed2ea40012a9be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644176784, "uuid": "e571a9e0-acb2-48c0-ae63-3d9351e74f3a", "value": "98304:NW209M+aGzbPno/i7jc30QhXAO9nnfPFOj5XQ3QfM+bzReRRr7HBGIkFKkwwPkJr:NcXXP2wHQ8+QfM+buXvge8kJnr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644176784, "uuid": "def08535-b935-465c-b869-39099b884db1", "value": 5008384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644176784, "uuid": "63c32a3d-892d-4319-9d9d-b275019fcd8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644176784, "uuid": "96f967ac-a2eb-4371-916b-be01f0679369", "value": "58A6A07940B4E3F69415097F67F8062938290677D0C96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a59f58e7-8766-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644163547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644163547, "uuid": "605fabe7-d510-47d3-b23f-ac1ad8ff08a3", "comment": "Malware payload", "value": "ee83c4a68b2af8dcee077e7d5b70d214", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644163547, "uuid": "040bedef-242c-4dc0-879e-be632376414c", "comment": "Malware payload", "value": "59f9227db42a55af90159da69de83048cf1c93024889721f27a045c99c7c7eb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644163547, "uuid": "53c4ee00-f55e-4dbc-849a-c0f948af3f05", "comment": "Malware payload", "value": "7a1d9979ebfdc4772358a0308cb7d89986f4bd87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644163547, "uuid": "2da3ed46-9d28-46ef-b69f-d6a288cb8716", "comment": "Malware payload", "value": "82ba2030d7b63ae76defe050e0c2510bfac9bdc5a290ab339e654634c21f6df3d287c3c22654f6d99f53a421a6f64e14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644163547, "uuid": "f03d24bd-0856-4fc7-80c5-67fe22c8fab4", "value": "T1274612EA31546B18D01AC8F85533E8CBB1FE533EDAE8A59D75CF7A803B9E410D641B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644163547, "uuid": "198fafbc-50b2-4808-a57e-16cfd55efa76", "value": "c746d534ad9ccd55c1e8619db5329a06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644163547, "uuid": "759235c7-dfcc-4e0c-8e36-96f583f91aef", "value": "98304:Pxzs88lP68o1x0NtIVDPzevkKbB9LyZuXJ52b0f0MG:hsplPKx0NtQDPzufdkZzof0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644163547, "uuid": "6e9e81a7-e690-4329-b924-3e9fda067a30", "value": 5644115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644163547, "uuid": "6ecc9342-088f-4d8f-b632-b47b74d09022", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644163547, "uuid": "cefcc050-0d51-4c18-997d-2875a678a9ad", "value": "ee83c4a68b2af8dcee077e7d5b70d214.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da94411-8727-11ec-9275-42010a9c0029", "comment": "Malware payload (Arechclient2)", "timestamp": 1644136314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136314, "uuid": "32a8565c-0d66-4271-9f3e-0a8380c51331", "comment": "Malware payload (Arechclient2)", "value": "a12e8c339ebf168f2267e105685b23b4", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136314, "uuid": "4cc716c3-339d-4264-a870-305c0a64c735", "comment": "Malware payload (Arechclient2)", "value": "5b3e38e3439893821d51faf438c0d475a8ab5899fccff0dff2a855e3bf2dd407", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136314, "uuid": "09d66904-f7e7-465f-a773-a544a5e4c0b7", "comment": "Malware payload (Arechclient2)", "value": "9047ca5f62ddd50ecd7561bd25d457e0a3d283ae", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136314, "uuid": "28516cea-9167-4df2-948b-142859b3be61", "comment": "Malware payload (Arechclient2)", "value": "8911af8d96d750a2c0e02c462eb6cd6610bab551b228d08626ea2b629b8bbf63ee3493b26549fa87ee94a269eea5ed35", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136314, "uuid": "4538a0f8-f10d-4170-85a9-3f681541047a", "value": "T141C4E110BA90C035F1B726F4497693A9653E3EF1A72060CFA3D46AFA56356D1EC3231B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136314, "uuid": "c34cc536-fb54-408b-bd4f-2f13cabaf682", "value": "d3e95b450bf99e0e3abca06689e7f7d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136314, "uuid": "867c8da5-731d-45c6-ab7d-534c65989515", "value": "12288:6gyzuYZgIhYWdAG2dfbI/oFbqWGIKJHVJFHJBwd3jEB:2thnd1SbI/o3eFHJBwZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644136314, "uuid": "0f0e6f02-8bff-4933-91b1-0f5c63b141a2", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644136314, "uuid": "8cb4b492-275e-4805-a9fe-15a2d55b8fab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136314, "uuid": "9c4022db-406e-4511-82df-e65667d2fbf4", "value": "a12e8c339ebf168f2267e105685b23b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30dae4f4-877f-11ec-9275-42010a9c0029", "comment": "Malware payload (BitRAT)", "timestamp": 1644174089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644174089, "uuid": "fef1d300-4a02-491d-bbfe-12bd905cb7a2", "comment": "Malware payload (BitRAT)", "value": "3f1295a04fbd27dced31e72cd9c825fa", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644174089, "uuid": "07f7fc10-ed90-4b49-8a1d-b4e7f737e598", "comment": "Malware payload (BitRAT)", "value": "5bef6639461cd7089101a8f6601f5be40a2fcc52651150dcf1647ff70040a1c5", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644174089, "uuid": "566ae173-66a0-4b5a-84bf-9d7e0e340c7f", "comment": "Malware payload (BitRAT)", "value": "c07e55f1571fc9d58037b2d58bba73f35467126c", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644174089, "uuid": "1ac0b60f-2857-43aa-92a1-e614263a0b4c", "comment": "Malware payload (BitRAT)", "value": "11743225dab1b2ecd0dc6306f2f980597f60b2ab0e0cf4d6e4a12dbeeab3517c6a3439babf7d9f15d73e2251ee89dd93", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644174089, "uuid": "aabf92b6-98a0-4929-a055-db2020b837b7", "value": "T1866533E05B0EE73AFA5ACC3CB8A61D13CC68D56065B749023E6CD5FE60FEA521C44C52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644174089, "uuid": "99f7e8d6-8062-4e7b-86d3-8545c35f4b5f", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644174089, "uuid": "51b63b17-6130-4a39-88dc-ac40d26bbc8c", "value": "24576:WndRKZCy2BrhCeU2i2cJijFbCBTPmiY05tJMSQp5ysA7Yg1nLkzUd4cSYf:AXDFBU2iIBb0xY/6sUYY5Wd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644174089, "uuid": "86929f5c-fb24-4e82-8c00-9795c0d8fd5c", "value": 1511424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644174089, "uuid": "5f82d3ce-183f-4995-ad11-788846926a20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644174089, "uuid": "ce7ec5eb-9741-46e3-b1b6-e6a07840ae4b", "value": "5BEF6639461CD7089101A8F6601F5BE40A2FCC5265115.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b671ce0b-8705-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1644121914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644121914, "uuid": "937bf803-b4b1-41fd-bf93-74e152b9c9d0", "comment": "Malware payload (ArkeiStealer)", "value": "e4d93cb904a7ad199aab5b483981e0bb", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644121914, "uuid": "5a43199f-296e-4a22-98a2-f0bc05065551", "comment": "Malware payload (ArkeiStealer)", "value": "5c5d9711ea8ddb520646c0ac33e540c3860b795914749ee377040d8626ecc93b", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644121914, "uuid": "615b7f0c-a2ac-4d52-b782-90d3c6b23469", "comment": "Malware payload (ArkeiStealer)", "value": "8011242749a8a3df1e3bb144f08d603c03fb09e6", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644121914, "uuid": "33639f59-855c-4f5d-b486-2d84f7dafdce", "comment": "Malware payload (ArkeiStealer)", "value": "ba86688be2aeac6459abbf41d091728faa3bfb38c5fdd5a281cce3711623c3a20246d7920b77cb75085d9e3a31fdedca", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644121914, "uuid": "33347cf3-a105-4ecc-a512-5b409f7e7fa7", "value": "T182549E10BBA0D035F1B752F8597993ACBA2E79B15B3090CB63D51AEE1A356E1DC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644121914, "uuid": "6f8e6fe0-a87f-4353-859d-3eb70ae1b62d", "value": "f582438c21380e695ebb7c6afe726d96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644121914, "uuid": "5df32da6-f3e5-4c14-b083-06ce3240a3a0", "value": "6144:cPV2i1yMoaTjwp1Nn+3Hnz+jvsC3ChErQZlBFq03U37/B9dZ:ctyMoCg1NeijvsCoE+Z2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644121914, "uuid": "87fff918-c435-475e-a208-3e3c9b7dd598", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644121914, "uuid": "572c606c-0170-4def-907e-245ed96ab88a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644121914, "uuid": "f520fa4b-cee4-4c7e-bdb6-0fa8538e8923", "value": "SecuriteInfo.com.W32.AIDetect.malware2.9883.16872", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5a28c9d-874e-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644153347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644153347, "uuid": "8bb6df06-b179-47ae-a2db-71e086fb47e0", "comment": "Malware payload (Formbook)", "value": "836f75c0c18c26ee91d7f5d0fc913567", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644153347, "uuid": "1896307e-b752-46dc-8166-0eeddb256aa0", "comment": "Malware payload (Formbook)", "value": "5c9dbae0453d3766df5234b197a8ea07d84470bd34568703f47a7f885643e5eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644153347, "uuid": "542a8c38-590f-4c23-9d62-9ec3d4b00c4f", "comment": "Malware payload (Formbook)", "value": "613ab970ac8a23bd032f064e8df236f745b2e326", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644153347, "uuid": "4e5d5858-7118-483a-855a-7111245b57bc", "comment": "Malware payload (Formbook)", "value": "57e3b78a8bc5c965885cd57d3002702efc7625e9cf81819d17bf80f7be31c164f67fb666bd692064e0d274d269bdfd04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644153347, "uuid": "f9053cf0-1b6e-4334-834d-bda544e423f9", "value": "T1A644120272C0CAEBF392063A62BFE671D6F8A61911D1855FE7712FF911021E30D8E6D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644153347, "uuid": "45644f9a-99f1-4dc6-8494-e9b295d7eb69", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644153347, "uuid": "261b55d3-f892-4974-b574-fc104445096c", "value": "6144:owlxBV645YwRcZgpBUNuam37XF/tuOnNv7icunYh:Zxvl5YwRcgiq/t/NurYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644153347, "uuid": "b34bbd7a-e949-4ab8-97ab-1619456cfca3", "value": 255988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644153347, "uuid": "b35df554-0d71-4a0f-8025-0795e5c54a48", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644153347, "uuid": "62daa0ff-b137-4aac-8ce0-f27a8c56ca9f", "value": "liste.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "518b785a-878a-11ec-9275-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1644178868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644178868, "uuid": "8e147745-2e94-4ad6-a316-5a7a0450324b", "comment": "Malware payload (Amadey)", "value": "898babeb45d943c06ee0357bde134904", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644178868, "uuid": "7bc64ef4-d731-4982-a60b-94c830ae7306", "comment": "Malware payload (Amadey)", "value": "5e97029c1df108d9c5af46aef43fe6d0b3e477b1a2b1b39023bc00573ae9dcb4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644178868, "uuid": "976098c9-88d1-4023-ad64-df355c04cec1", "comment": "Malware payload (Amadey)", "value": "c525a3feb3c3d8c0d03ff9dd6272eca083522dfb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644178868, "uuid": "f67767f9-b725-4dd6-97b9-a9befa09d1e3", "comment": "Malware payload (Amadey)", "value": "04292a7dfb6c6716f841de6fa91db23bba2afc47b52164fe2391c34307eee2590bbf1cd5c6a3ba8a0eb4cec44f21ff95", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644178868, "uuid": "4e584327-8def-4ceb-a534-24dd658de12e", "value": "T1022418613812C071D56065B619F5BFF6C19DAD15ABB049DF2B800F77DA222F37920E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644178868, "uuid": "76398095-8bc4-4f0f-9766-bcfe08af0773", "value": "6b56eb425bb7dbd4f686b84bebc7ef49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644178868, "uuid": "cb304c91-8e54-41af-86c5-514d53aa85a1", "value": "6144:GDL1CH5dH26gv8DeAqrMs6y8GWWjutMxBp6+x:GkAbv8yFoVyrWWjutMxTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644178868, "uuid": "bea018e3-376a-4aa7-aff4-d1923a156d83", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644178868, "uuid": "da6d7250-aeba-4d4e-bb37-8ea17152078a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644178868, "uuid": "6e90f432-5e6c-47ce-bbf8-58d9ac13d694", "value": "5E97029C1DF108D9C5AF46AEF43FE6D0B3E477B1A2B1B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45683b68-86e0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644105833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105833, "uuid": "64b7fbaa-2a96-41e3-b4c2-c8a2da9a6c6b", "comment": "Malware payload (Heodo)", "value": "3ea7b766f43c26009217b09c39ae740f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105833, "uuid": "0432e0a0-aae5-4f55-b845-8e1fa3299ade", "comment": "Malware payload (Heodo)", "value": "5fd4ee7ad60305c05433af4b60bde2b078b709fedbfd99c0cbcda635a593c1d9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105833, "uuid": "2bf769d7-af90-4e4e-b29d-a58dffd27c02", "comment": "Malware payload (Heodo)", "value": "81be2088440b8f463db976c02a6e694594ae61da", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105833, "uuid": "5712257c-5bd9-4c18-8986-dd8f3b3e91f4", "comment": "Malware payload (Heodo)", "value": "f584d3cf9b257f9592e4bae1c678bd938c9d8e35ed65c46cb6c1bb14f3cd481f074017d25e9dbe5f26f30d6d8a2bbe70", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105833, "uuid": "7c262cce-0021-4411-9da8-740fade7aa87", "value": "T18C35AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105833, "uuid": "bbb8c2a8-bd4c-43dc-9324-4c29ba4a8c4c", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105833, "uuid": "1841b43c-d098-447b-a5f6-4bfb77025b75", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTKFIIm2m40:wfv1GVFF+765nFvFf6dlzzS2FIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644105833, "uuid": "57a1f464-8d0c-4033-9dec-af429b02b9c3", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644105833, "uuid": "69994d07-a0ac-450d-8f3e-d0307bf49d1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105833, "uuid": "83bb3cf2-dd9f-4b4a-8528-28006d577afa", "value": "emotet_exe_e5_5fd4ee7ad60305c05433af4b60bde2b078b709fedbfd99c0cbcda635a593c1d9_2022-02-06__000348.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2941aa1-874a-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644151516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644151516, "uuid": "74d01d71-6a0c-4dd5-b8ed-6595e07b8837", "comment": "Malware payload (RedLineStealer)", "value": "a8a9cbce2045a197c0b4019e31152365", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644151516, "uuid": "00a119ad-41e4-4cc5-8009-767e914cfb55", "comment": "Malware payload (RedLineStealer)", "value": "6059bdd4738c812b60b43a1e0ade3099cfad2dfd306e8fa41c30484a9830d38b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644151516, "uuid": "f7c844fe-7f4b-4b1a-8ba5-e07c04c7c615", "comment": "Malware payload (RedLineStealer)", "value": "3ba39d19ffa57f83769dbb43233c2ba7d8ddd95d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644151516, "uuid": "b6842607-3eaa-4b94-ad0a-5faa5dfa2f64", "comment": "Malware payload (RedLineStealer)", "value": "fe112e06f5c9870cefc627c047a7ebd9ae0b67eb3f0e85e95191d25616d6903821b3a39f7e5645a5eff5cc3324b513cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644151516, "uuid": "c6663bb3-0b2a-41b1-a219-bd619f2c3733", "value": "T12C7633B2585109FFC0EE1D7181B3A98B36B6411ADEDF4EAA265CDF231C7B141931A3B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644151516, "uuid": "c0b55e24-2a40-4c17-aa52-7f4756a81b99", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644151516, "uuid": "d591fef9-5052-480e-925c-f892563ad94e", "value": "196608:JezZDigKRqkLachmliVkKtRworkSIu4BRyko1qWegj:Jezpj7kLach8AEoCzWegj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644151516, "uuid": "70d66bd1-3738-4e13-8a74-0fabf2631016", "value": 7726241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644151516, "uuid": "e72de50a-1d97-4737-8835-5f14adce8431", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644151516, "uuid": "31237c67-70db-4caf-bb67-a4ea239532b8", "value": "a8a9cbce2045a197c0b4019e31152365.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46a0f015-86e0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644105835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105835, "uuid": "99cfe4f5-d60d-4dd7-bc9d-7cea2718d6a4", "comment": "Malware payload (Heodo)", "value": "c60558f3005bd6d7083ccceee7a0b23e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105835, "uuid": "e0bd62ae-4e92-43ce-af4b-61dcc178502d", "comment": "Malware payload (Heodo)", "value": "64a19d252b82c7867d06b643a2488135b9b148c09466d7cdc82d94e5d6fb26c2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105835, "uuid": "25315e61-b242-434b-a58f-5b7437220bbe", "comment": "Malware payload (Heodo)", "value": "39a118f0cc0a3b8685b78e7c60e3d30f34b59c73", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105835, "uuid": "07ebfeac-b2d0-4775-8c78-4b1bc5a70b16", "comment": "Malware payload (Heodo)", "value": "07ef0f79006f1cc1f5bb1b7d08ed46771d7fd6aecc21beffea81a0cf656f7d1cfce63f795d59218129c85b47d3b444a5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105835, "uuid": "56d619b6-b88b-431e-b0f7-7e3cc73762bb", "value": "T1B135AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105835, "uuid": "68300ca2-1a4d-4bb0-a04e-af7a6ced4e81", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105835, "uuid": "9fec802c-1dfc-48b5-9d71-2ad0db99a530", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTUFIIm2m40:wfv1GVFF+765nFvFf6dlzzSoFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644105835, "uuid": "df92ff81-38df-48ed-99d6-a8f09d4690ac", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644105835, "uuid": "0f9dd644-a24a-4fd0-b7c0-c2e242a04728", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105835, "uuid": "4b4d719c-8eac-4ae2-9b80-b788c7d1267c", "value": "emotet_exe_e5_64a19d252b82c7867d06b643a2488135b9b148c09466d7cdc82d94e5d6fb26c2_2022-02-06__000351.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f7b2554-8727-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1644136318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136318, "uuid": "8121021c-9467-4c83-bd2d-eed946c3ce90", "comment": "Malware payload (RaccoonStealer)", "value": "238c36f0c3f70062467576a10704194e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136318, "uuid": "a6bbfeb5-9716-4282-af4b-1c1e0115ac78", "comment": "Malware payload (RaccoonStealer)", "value": "666d848a4ecb284b4b6f70f0e6c8126fff9facb5427dabd0fe7b45502d70f0b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136318, "uuid": "c7c7bf17-401f-47a9-9fd7-1a8e2a46abbf", "comment": "Malware payload (RaccoonStealer)", "value": "142eb691d18afd3c4faa738bf52ee0b79fe992ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136318, "uuid": "c9fec0a0-d9ca-4955-a935-7826361b3815", "comment": "Malware payload (RaccoonStealer)", "value": "b6146f7e60f6e91a37b415f320565bcdb724b5f62dd8e0f5989d81dce250dbe942ec438ae7032ec36e4e7f7b49260a58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136318, "uuid": "38ecde59-422b-4dfb-99c4-5b9d258bb888", "value": "T129B35B4263E089ABF0BAA775C8F302535770BC859B7557DF13448A9ECE236D0AA36707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136318, "uuid": "0b286677-948c-4af0-8af2-5dff729210f3", "value": "013c74198fc6e42dcf33737d6c40c012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136318, "uuid": "05dd1642-09d3-418d-887d-e104077e2c5e", "value": "1536:u9xnNkpABBBwbT90FpNXI4GPWKfx3Nxb4s5giD+BC3KH7NeYRN3X6y4fx2E28Zj:+yqBXv8dNxV5b+BC3K5eq3KFxjj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644136318, "uuid": "705cb8fc-2c04-4984-b469-7c9a7c671db9", "value": 107520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644136318, "uuid": "faf9f39f-b7b7-48ba-860e-891d90049474", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136318, "uuid": "ebfec2b6-1e11-4498-8510-d326f21ab114", "value": "666d848a4ecb284b4b6f70f0e6c8126fff9facb5427da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98330406-877d-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644173403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644173403, "uuid": "53b5a1da-d792-41da-8b68-7f64f8140266", "comment": "Malware payload (Mirai)", "value": "1f90898de4a468c0f3aed91ff1f6ac33", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644173403, "uuid": "4f781dbb-dbbe-4483-a05b-2926ed229c83", "comment": "Malware payload (Mirai)", "value": "67bd4c8e8a3181c33144c334f7ed416081d99a7907a8dd1b1438f0ae790b01fb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644173403, "uuid": "5ae0deaa-e506-44c8-8509-e2b53bfcd6e6", "comment": "Malware payload (Mirai)", "value": "e8cd35914c492ead84654b1a3c7bf96f00683165", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644173403, "uuid": "25a73bc7-9282-41d4-b625-9ae5df30e7a3", "comment": "Malware payload (Mirai)", "value": "a78f5813e7e9c741a2b22cc4084e083a31731746f270bae7c61652a6564c78c84e627f94e5f2de2e8611789fc1637c98", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644173403, "uuid": "d3fd29ff-e779-4240-9626-0f949d3acb40", "value": "T1B423F11A8B75A572A73299F2684605033F4F5F3BC2FD3066D0A541DAAB05E0354FA2AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644173403, "uuid": "326705e7-eeac-4f19-b743-0ef2ef3c24eb", "value": "768:CHq8Y45S0GcObDSaq77NKv17d8hJ9q3UEL7yBZUXBxSf+P:CHq8hS0lObDLI7NM/8WL7zxM+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644173403, "uuid": "658a7148-31fd-4b33-9db3-c46137584783", "value": 46848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644173403, "uuid": "d4aee3c0-19a3-48d7-bba8-ed4012acb450", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644173403, "uuid": "78c96e95-711f-47b5-9d23-6c910d2372d2", "value": "b3astmode.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ad58ab7-875c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644159046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644159046, "uuid": "5bb29aaa-8bc9-49a5-8e10-50628a6c8c1c", "comment": "Malware payload (Heodo)", "value": "3fd55e7330d8d216b1d619249c431c27", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644159046, "uuid": "b8c0910e-7d58-4353-8427-2b8e1e3b3502", "comment": "Malware payload (Heodo)", "value": "6963dd79aa16d012852bf32ca91f7eff536b68af95814d28d207b9db6a2bbd96", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644159046, "uuid": "de7dd116-6896-4c87-9907-8687add8002e", "comment": "Malware payload (Heodo)", "value": "6d6c51af00d3a074d757d9ae746a01b059f1a519", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644159046, "uuid": "a9c6f101-84f3-4224-bd06-9d3448941ca9", "comment": "Malware payload (Heodo)", "value": "0e0804b68958a99e3f696de1f897a599e1c41a40a33938dc3340b743df564d7565e4f8c2feb52e8e33e29665820cedda", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644159046, "uuid": "30f72f66-a95d-4e04-8ef4-3ddca08f01e1", "value": "T14A24ADA43B56A425F214672A1EC796005FE8D23248F3D09EDFC2F3A4A5FB442EB5D12D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644159046, "uuid": "b724d8ab-b74e-42c0-af73-c470401d4a06", "value": "6144:2D/Tuk02QyxDxkXOQTnjuwibXGmkEovJKt4kI0lkI9sJD8Mm0czMm8QTymiVNWzy:2D/Tukcyj1Giqjxq4s2IuJIMm0WKQTyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644159046, "uuid": "6cfe9493-fa82-4e38-9ded-b8fc8ba57767", "value": 213420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644159046, "uuid": "64761bfd-1382-4b1a-a331-da042e869990", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644159046, "uuid": "adb82196-2722-48ea-8c63-59c8b1a37332", "value": "emotet_exe_e5_6963dd79aa16d012852bf32ca91f7eff536b68af95814d28d207b9db6a2bbd96_2022-02-06__145042.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482e49b0-8727-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644136332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136332, "uuid": "a1c9e9fe-c3e1-405f-924b-56b545d9a6f6", "comment": "Malware payload (RedLineStealer)", "value": "5999a3f15fb4127a8e0c5f1b787482e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136332, "uuid": "8d2009ec-412e-4017-b454-9a39f1f56034", "comment": "Malware payload (RedLineStealer)", "value": "69bf2937bb27a92245b10fddafe7a4d46b8d53be94f930a5b3cf76b9cb51853c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136332, "uuid": "3f6eafb4-0ac2-4f2d-ae6f-169e81c3c081", "comment": "Malware payload (RedLineStealer)", "value": "0ede994354d9bd1d384781fde96b02ea8285a7f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136332, "uuid": "b51bed02-c9c8-441a-8eb5-e565e8cf861d", "comment": "Malware payload (RedLineStealer)", "value": "59ed553f85c797b0e330eea3063e4210f456c2b0cfec156d6cc54653caf64895122c77b104f239385b70df019b679012", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136332, "uuid": "0b7e3d23-1697-4dac-8667-702d9c9b7edd", "value": "T13B5512A3B8C2C4B3E297467752E5DF64D92BF9121B148EE723901C374E701C26E36D6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136332, "uuid": "1a305c28-78af-4253-8342-2cebb6ec1d94", "value": "148d482ece6903c9871bc6044bd1df9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136332, "uuid": "f90b6722-02c8-4b29-8fbb-4a6074764e1e", "value": "12288:i0Djqk+hA0uMmj4a0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAf:dDj/v0gXe4i7ojhsP5Lgrk1TWb4AN5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644136332, "uuid": "78b9f8ab-0b26-43fb-a776-de5dce59279a", "value": 1366016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644136332, "uuid": "a25345b2-688b-41c9-976e-655947b62d51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136332, "uuid": "d921e36c-c5b2-41f8-b980-366610bc109b", "value": "69BF2937BB27A92245B10FDDAFE7A4D46B8D53BE94F93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cfff782-86e0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644105819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105819, "uuid": "3ec094aa-d532-446a-a17a-3cc3f57d3d9f", "comment": "Malware payload (Heodo)", "value": "20f503fde65de8a57626025ec9782c51", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105819, "uuid": "b9704c52-9489-449f-b198-441ec59d8982", "comment": "Malware payload (Heodo)", "value": "71f4f3fc57673a8d1211d6653d78250107568ad17cda29eb410e81dab56faa0b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105819, "uuid": "d81373d8-9b96-4f99-b82c-56a521ef14d3", "comment": "Malware payload (Heodo)", "value": "da475ce84f8f0a2af7b600588b456706b9fc885b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105819, "uuid": "8c6b4ca6-df01-443d-987f-3ee65b91adae", "comment": "Malware payload (Heodo)", "value": "47cee3d5dbb8927e059df5e76d809b2935b3841bb7c8ff50386918e07bd9875e190ca42b85bfdb668c7c0fb83e62f325", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105819, "uuid": "b2408248-d509-4234-a23b-e4648e1df863", "value": "T10125AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105819, "uuid": "e51848c6-c982-41f0-879e-27b864daed8b", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105819, "uuid": "02dc829e-11e4-451e-b0cf-3dac66b1cf83", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxOfFIIm2m42:1ZsYB7vLsnZI1Hb9DdFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644105819, "uuid": "b5de3ec4-4f25-4fd9-af19-ae867fb814ab", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644105819, "uuid": "7274373d-0521-4c6c-ad70-1ee03f7b1ede", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105819, "uuid": "91c5f5d4-8380-4cfb-95f4-c7ffc0a4a6b9", "value": "emotet_exe_e4_71f4f3fc57673a8d1211d6653d78250107568ad17cda29eb410e81dab56faa0b_2022-02-06__000334.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afabc294-874d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644152827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644152827, "uuid": "97b8b10d-5a89-4bfe-bda9-cb656efbdcba", "comment": "Malware payload (AgentTesla)", "value": "8a6f1c034da8b6b1934e32c3b2746bf6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644152827, "uuid": "4c0d16f7-370a-4e03-885a-e18c67ef6318", "comment": "Malware payload (AgentTesla)", "value": "7383128a0ed933a53d39e6d3a3931470872985183a66ba5aec184a7f40a7dec2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644152827, "uuid": "83b4d730-fac6-4df0-b6f5-df1d9bdaeeed", "comment": "Malware payload (AgentTesla)", "value": "3350084940ca440a0ddbee354e6071805251eeb6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644152827, "uuid": "4999094e-e97f-4df9-8339-49e922f2bebc", "comment": "Malware payload (AgentTesla)", "value": "44514d28e2090f58d2940591644a887ca73bf32a2be3097dce7ccb7d50dec5db726fc9455ee267a5698197066cef29bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644152827, "uuid": "54527823-5262-4d98-a540-15e885c725f5", "value": "T1B2C4D09072B94F91E57A8BF0153A7DB10BF0326F99D8F61A0FE860C55AA5F006E45E0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644152827, "uuid": "2a534911-502e-4872-8557-a39590697f54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644152827, "uuid": "27a0a357-8e8c-4663-a3d6-dd8ff6fadabc", "value": "6144:GXyeo97VoIXY/tD3sN+c3LKqVI7YbodyN85n6aYiPNglZ1UmnOVDw28GvIAO1p1G:RFVo3lgN7RVH5y56sGTmwevxOP1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644152827, "uuid": "9bae260d-e27a-477c-9fb0-eec68db1d14a", "value": 572416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644152827, "uuid": "9662a1f8-5cd3-45ba-b853-c2fa58d1d6e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644152827, "uuid": "06a9e0ce-7f27-48a7-adcc-85feb9ff2ed0", "value": "RFQ 020556-21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f40f8e-8786-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644177162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644177162, "uuid": "0a52f543-8c38-4e26-8dc4-c49b4c4de012", "comment": "Malware payload", "value": "698d16129e1e9fb8b21206a6468d8415", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trickortreat", "colour": "#ABDA83", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644177162, "uuid": "aca28fbd-b8d9-4773-872b-d18f60d76915", "comment": "Malware payload", "value": "766b3cc2128e5dca541275655e7bd347188ceee404aa61e2915472be48c007b9", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trickortreat", "colour": "#ABDA83", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644177162, "uuid": "c697df2b-7456-4b12-a378-0cc55bedc6e2", "comment": "Malware payload", "value": "0cae13e852e3f22e6137bbba477cbbffab9202a2", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trickortreat", "colour": "#ABDA83", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644177162, "uuid": "7453b332-b44a-4408-928f-818801ff1fc4", "comment": "Malware payload", "value": "d3921857f97c801c2ea2b08725147f00f6192bcc1994bfba67bdda2fd32a5c91d510a4df4e875c4e0e73e425f37e5463", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trickortreat", "colour": "#ABDA83", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644177162, "uuid": "d8513a3d-6f5f-49ee-841d-84f9c3b6a418", "value": "T1B956235229A26F81D95D51B8C1DB1B537B6EAB1A2616930F53B0E32F7EF33F08D64840", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644177162, "uuid": "48e5cb6d-29d0-449f-99bb-9f6bb2fdd0b6", "value": "98304:KPi1TlkEJswz/xSV5hba81OuslizfwsG6k2RkLZiypryTxJnZDstHtIEcEw:Nlk8sypKTa8y0o564LEyprExFZDstHtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644177162, "uuid": "1769b186-59c2-42d2-9921-e9902f360d93", "value": 6140515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644177162, "uuid": "b1dc48ec-275a-4b0b-aabc-a32f7c94be6b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644177162, "uuid": "3959a898-d396-4a53-8a02-e334f563ec25", "value": "frontdeskzip.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b0498af-8726-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644135854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135854, "uuid": "8a4926e9-e666-413c-8e2f-17d4dd524c52", "comment": "Malware payload (Formbook)", "value": "2330aab5aa560a77125cd587678eea81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135854, "uuid": "d350bd03-2f5a-4a40-8893-09e619adaf4a", "comment": "Malware payload (Formbook)", "value": "76c2944d78f0dac034e5a7cc6a916c30e66a88aaaaf3481b9af71db7bcdf9ca6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135854, "uuid": "2a530d13-7315-42ef-bb0d-f0f52025c64e", "comment": "Malware payload (Formbook)", "value": "58a4e9c4a46a62848de45f637721748ef0867b59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135854, "uuid": "3ec3cef0-ba3e-4854-9a7c-d79285f2c2f1", "comment": "Malware payload (Formbook)", "value": "aaa936c27867ca72ff0c1ade0d8894918999b93185770962a232063ed7e87436561c10a020c886bc1c01a5ffc3c4d670", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135854, "uuid": "b62eff2c-4a66-475c-8cef-6cab3c420e4b", "value": "T1ECC4DF6032F64B58F57F87F52138B8A01B7235EB69D4C65C0F9822C85AB9F415F90E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135854, "uuid": "225cd244-ab72-44ad-bf2f-ad0ce3ccff56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135854, "uuid": "43c599c1-7a80-4a1f-93d9-cf35313554ad", "value": "12288:mgMX93VjqTuXTKw+R0X0qUZ6Xs/421CK2RK2M3IMD:tMX93VjOuXpRUQk421IRZM3IM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644135854, "uuid": "10f488d4-361c-471d-9d09-6bd512094bdf", "value": 587776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644135854, "uuid": "0cd2b770-ab1c-472d-a1a6-581d074a083c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135854, "uuid": "10dada92-0428-4dfa-b21a-417605e17d11", "value": "ORDER.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "522ebcf0-872d-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644138926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644138926, "uuid": "4815ecdd-6e32-4c31-b193-3911ccdecf97", "comment": "Malware payload (RedLineStealer)", "value": "3de488667a0667efd5923626f0f6493c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644138926, "uuid": "df277208-3dc7-4e53-b3af-fcbfce01a6ed", "comment": "Malware payload (RedLineStealer)", "value": "7c2744fc926928de15df923b58294b6c1318fb7b01a96399e661f328220d005b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644138926, "uuid": "34be2b11-11b4-4eac-80ea-12c6e8787ea2", "comment": "Malware payload (RedLineStealer)", "value": "668ee08a88382ebd23691af14e98d074f21970b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644138926, "uuid": "949826ec-1002-44a0-ba46-df8dc53dc80d", "comment": "Malware payload (RedLineStealer)", "value": "55067596ec27617eb7dcc5c57d0fe75cbc8ea144994c6b4d8dc280257e110368b6d9b783c18170d116530ba33b4da497", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644138926, "uuid": "1881b181-5735-454c-a465-d098fd0f11ad", "value": "T1A284CF00FA90D035F1B752F8497A93ACBA3E7EB2672450CB63D566EA46346E0DC7131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644138926, "uuid": "07571ec1-cba1-4d3e-aa8e-e62867bde639", "value": "1a3cf179d845c62d49a765b8e54e41fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644138926, "uuid": "de6bb86e-4062-4ef1-af1c-2865a9e1af5c", "value": "6144:gYJp6taans8yC8kRP0n33pfDHY+cSQr6Yg8stoEscg4JDALneNuTipp:gxta5HC8k6n33pbH668sns74JALnUp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644138926, "uuid": "9b9cd8ca-a490-4fcf-b1d3-f0254aecfbe5", "value": 387072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644138926, "uuid": "18d1c023-3721-46e5-95f4-77ac60dadebc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644138926, "uuid": "cbe4eda2-dabd-41ca-a3b7-558efccafd41", "value": "3de488667a0667efd5923626f0f6493c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a9b4133-8725-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644135558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135558, "uuid": "a48ff5ab-2976-4d50-8161-dce117f97d04", "comment": "Malware payload (Loki)", "value": "05f448235f7dce3be5bd130b13aecef4", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135558, "uuid": "2a8fe0f4-c6d7-4636-bb31-21393de6e40a", "comment": "Malware payload (Loki)", "value": "8148fc9d17a2422127b7d14596a5cfa5c87a6ee6c2da4d9f4c92b9c2962b6ed7", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135558, "uuid": "51f3c79a-0fb5-4049-9b2e-7e2b02ee35c4", "comment": "Malware payload (Loki)", "value": "afe2d6e2238c679e312cf4b672fdfea94bcb4a91", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135558, "uuid": "3bde1334-5604-41c6-ab76-bfaeeccf99f8", "comment": "Malware payload (Loki)", "value": "808db99a3288eeaf37f8905b3e578e92326d0b76acc6e2c56ea8a290359b567f6d56975dd23cc9edd55c8d26889608d4", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135558, "uuid": "9158e8bb-797a-4a4a-a174-89d93252a3e0", "value": "T1C294BF9075B95BA1E03E9BF921297CA007F1316F98DAE55F0EDD21C52EA4F422E44E0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135558, "uuid": "f64f683e-2d21-4fdc-9be2-427defb34bda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135558, "uuid": "68ca5c0d-f21c-401c-aef3-3b157516664d", "value": "6144:1BmieJVoI5NxI72EKB4B7LEj6HPkD5cqzJMipG7yTa:mVo6IrLvvKckJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644135558, "uuid": "4c536e64-081d-4f81-a5f7-c90900e85266", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644135558, "uuid": "416af36f-57f9-494a-95af-da4ddc1d744c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135558, "uuid": "8ef1b79c-d328-479a-ac53-8a1e3088f17b", "value": "DHL Courier.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa5cc2a1-8771-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644168280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644168280, "uuid": "958781db-2a90-4065-87fd-6a6c4c2dcee9", "comment": "Malware payload", "value": "3e583e462fe0386c6320399b5e7591f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644168280, "uuid": "05ff8eeb-21ec-408e-9cf8-47669e83b355", "comment": "Malware payload", "value": "82ad9cc131eed3074341a8b1bda30207c6b0505dd165c69cb536d6efdbabb86d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644168280, "uuid": "9d90fda2-d4f5-48da-936d-e16f38de7e84", "comment": "Malware payload", "value": "8f6dd62a72aa7526122a23c34b6274abb2f2371b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644168280, "uuid": "45b845dd-2003-4cec-a926-80f9850004e7", "comment": "Malware payload", "value": "7a64a6bdc10ea6ef9449e50b06de08d3b4a96b4833d81bafa775028a1b8d1d9e89937d4e0433bb0074fa46bf25ca1b0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644168280, "uuid": "23974a4b-325e-46e4-bcdb-c2d46592d206", "value": "T126778B0773A50195E8B7D1388AA64103D7B2B8638731CBDF329D17552FBBAE09A7E710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644168280, "uuid": "9e7656c7-440d-4ed9-95f5-f0b58c1257a7", "value": "97846b5d5f18c15702c8b8de46aba183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644168280, "uuid": "01aa96d5-32d4-4312-930b-0b33ad0fb893", "value": "393216:buH1ZmrXl82gr/hk+u82hQ0Gl5eEnE1mrIvk6h19nF3E8VFGmDRXpbUMvbbYMUQb:b9d9ZVT3E6/t5b7JDrYoDdCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644168280, "uuid": "31e91296-6019-4f02-ad12-4ed19f500b49", "value": 35980890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644168280, "uuid": "c016ebc5-6f42-4d48-9fd0-78fe8b9872ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644168280, "uuid": "f746d332-2129-4e66-8141-40863e19c301", "value": "3e583e462fe0386c6320399b5e7591f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e242a8-8707-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644122549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644122549, "uuid": "5879e7d5-4e16-4ad2-975d-52c07be4cd50", "comment": "Malware payload", "value": "f4bc9216c883591e18f46ad8d15e8cbb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644122549, "uuid": "61c15b38-1fae-4827-ba85-a3ba00448d15", "comment": "Malware payload", "value": "82f07932a530d1eab0f9c78c5a69133bd69488b41ed42d567877f8f57b7a9e2b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644122549, "uuid": "ac7c9d6e-a120-44ee-aa29-97d3f32bb90b", "comment": "Malware payload", "value": "d6c823e41859fc1aefd66267e2d54eee069b8c62", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644122549, "uuid": "c657a4f5-2c1a-447a-b2e9-d35a639950e3", "comment": "Malware payload", "value": "ff454e5d9e815eb1ba5cae9ddd93002124ea5e44b3e534bf968da4c663c9bede1e18b09d610bd64a8421055f7378385e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644122549, "uuid": "8edcf48c-aa09-4b8d-9047-fc7060a087c5", "value": "T1F803E02E53260861ED1D42B9CB1607E227328379B457FE272696B18D4E12C6E2C77FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644122549, "uuid": "a5cd8533-353d-4791-9fc4-5b4867c4ebd9", "value": "768:4Lm/OH8WloUYHS3yZ3mELRHK7g1u7sREe1oJgGlzDpxYsjO:52H8cZsTLNMg1V1oVrYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644122549, "uuid": "85c67359-e465-4da8-8c61-273d4900180e", "value": 40564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644122549, "uuid": "ac3b66a3-c949-4c23-ba73-d58e4a423491", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644122549, "uuid": "f9bf3981-3b83-453d-b16b-e74d13a18682", "value": "f4bc9216c883591e18f46ad8d15e8cbb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "484f14f8-8722-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644134185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644134185, "uuid": "c7fde1e9-c2e8-4a3c-bee0-bdc660f999f1", "comment": "Malware payload", "value": "18c9579efa1dd081285dfcc69a23df1a", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644134185, "uuid": "0041fb7d-82fb-4b71-938b-7f40f235279d", "comment": "Malware payload", "value": "84272aa4583ece887787bf98fce91bf579c09aec4e63d7bbe10bd4ac1718ac5a", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644134185, "uuid": "2c68b2b3-21ea-45b4-8cf7-0f5f24bca00b", "comment": "Malware payload", "value": "b1d1d38f045c4ea98ff2621bcdfa0a9ac3875ac2", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644134185, "uuid": "1d75a2d7-2f74-4b26-80cc-3c416e61a965", "comment": "Malware payload", "value": "2ec8f688aca26ca355556946faff3f0c18a86750acf1ad7db5088a2cd45e78146b5776bb24b35cc0113557e9ab0a2dab", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644134185, "uuid": "07c6bcdc-7c4b-49ec-9960-f550b83378ce", "value": "T15EE56C33B245A53EC0AB197A963BB75C993B7A612622CD1B57F0098CCF355803B3E647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644134185, "uuid": "cd5a109a-7fb8-451c-b86f-6e119b79c907", "value": "49152:7Dm1BMUy7zcotBJyJnhpSwCaDlgB0qMTjTOKzhGYC3A:G1BMjRyDm0TTvhGY+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644134185, "uuid": "ef96c27d-84d3-48e4-a929-ec240508d83b", "value": 3230720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644134185, "uuid": "c6aada3f-d233-48ac-a8c6-13a6ae592bb4", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644134185, "uuid": "d6cac10a-8a8e-4a3b-942f-8cbf0d2e480b", "value": "Arc-hEndesFact.0402.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da551a2-8726-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644135885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135885, "uuid": "975d032c-36d8-48ac-8359-de2e10214275", "comment": "Malware payload (RedLineStealer)", "value": "a46a7b4c46ccfaaf28c78f274949449f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135885, "uuid": "89f60701-6aab-418e-bd1e-03b7cf7860b3", "comment": "Malware payload (RedLineStealer)", "value": "84a260095b8838895d9a065d1977ccf3784b89c1234b38b1df70d31d1256e235", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135885, "uuid": "2c2514eb-1fce-4960-911c-39be99556808", "comment": "Malware payload (RedLineStealer)", "value": "4034a31d216929b5cb8914ec84a4f51158112de4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135885, "uuid": "71dcbf7d-857b-490e-a1bc-7be8d4a01350", "comment": "Malware payload (RedLineStealer)", "value": "71440b3ce910b3b20ac9432dfb416650dcf7e10e740665a1881190dfc5a7f3aeeb5d471f07d6f5721aabc2866402e0c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135885, "uuid": "66d39817-1aca-4f96-9757-6a21f8425382", "value": "T14FD478435F55AF42E62CCD7B70F6EA312220B964D2818656FF4720393962F520AEE5CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135885, "uuid": "37c71f2a-e10a-4114-89d3-f24aa13082d0", "value": "e769fe33ddfc748b8cb2866882e4273a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135885, "uuid": "8f4bd2bd-9807-4cd1-b567-b9395d7e8d79", "value": "12288:ss+N3enugPfFyxqPXkB5qmmRV6qEJ4tS:ssYununqMn8RV9E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644135885, "uuid": "fe932e04-4807-49ba-9745-6479b887c07a", "value": 612624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644135885, "uuid": "c2318399-ab53-4c44-b551-cc64630449a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135885, "uuid": "68dbfd18-a9e3-437e-a825-896e9eef93f1", "value": "a46a7b4c46ccfaaf28c78f274949449f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bee2a2e-86e1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644106247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644106247, "uuid": "9e8c62ff-b168-4ce4-85cb-ff9855ca6ec0", "comment": "Malware payload (Heodo)", "value": "02617234bac74261a05fdb0b91d606e0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644106247, "uuid": "841671c6-7676-4e65-8ed1-b8dcbffcb8fe", "comment": "Malware payload (Heodo)", "value": "88ee71c73807464a2994d91c3f24afb0cf2dbf6708c833586c1e4e1692e6a62e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644106247, "uuid": "20d6e999-16a5-42b4-823e-fcffcf9c579e", "comment": "Malware payload (Heodo)", "value": "58b0314bfcc3c0ff0beed6c39ee4e25e905fc86b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644106247, "uuid": "65784aff-5762-4fd5-8b18-055878a68f8b", "comment": "Malware payload (Heodo)", "value": "a04f56eff96915ecb183af47d3f0a7b428618ac5b1749113adacd4c6cf1730b446544f367da410c8fded358b12e2a423", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644106247, "uuid": "e4899734-8dbe-4f99-b732-65e6231dc932", "value": "T13AC4AE906D4644F1F683292600A7A2160FEDAA1503E0DDDFCF89F9725F65CC2A77A0ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644106247, "uuid": "505a6cc9-5790-4fac-9e49-0ddcbb7a3f4a", "value": "12288:2D/Tukcyj1Giqjxq4s2IuJIMm0WKQTyPNwWe7c1QWImzvxmxsff7TFSuXAOFf6Nr:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644106247, "uuid": "8b4f1f8c-38f2-4ac5-b4c6-e38331526ced", "value": 590252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644106247, "uuid": "8eb02e46-d344-4edb-8060-8c8c9108d590", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644106247, "uuid": "48c06a03-5db4-437f-b033-385e191d6285", "value": "emotet_exe_e5_88ee71c73807464a2994d91c3f24afb0cf2dbf6708c833586c1e4e1692e6a62e_2022-02-06__001033.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "287c74c9-8722-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644134131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644134131, "uuid": "11af59f3-84c6-4ef3-86e5-5aa81e609e4f", "comment": "Malware payload (AgentTesla)", "value": "d5b905bcc5ddef6a47156ad302f26e5f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644134131, "uuid": "e99774d5-2c6b-4d6b-bf85-4315b29bb0e8", "comment": "Malware payload (AgentTesla)", "value": "8a9866eb09734b7810ed0d2970ed4be3ddbba324e6845b7ce1a43be5a3795912", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644134131, "uuid": "e50f2a07-253f-4e2f-bde2-e85f9cfe4fda", "comment": "Malware payload (AgentTesla)", "value": "f2aec9d7a1f40368aa01191c0d20d64829c367b5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644134131, "uuid": "574314ee-a154-4df2-9364-2cd16e5da0d0", "comment": "Malware payload (AgentTesla)", "value": "4040702ec2c0cd7cfca592214fcf4a85f2292e1097a3555a429e7713b7a3c48b90e2afb0a2b5cc77b24365c3561d211b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644134131, "uuid": "c3d949ab-8b5e-461d-8e80-f6b42304c7fe", "value": "T158126D3C67888AECCB89A1F19B1A790D509F7EB993DCE4A336FCB3105F062BD5605480", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644134131, "uuid": "9f11f468-9112-4e5b-8a47-296201fab865", "value": "192:0kmVVhNUqhq59FQHoYNk+CJp+jpJH2mS+23+hcvddbgoIqEeIXok5fqXc:5gqX54pk+CJ4DHfcv/bjELok5is", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644134131, "uuid": "f78f394d-b0e9-4964-baba-9d298272be92", "value": 9042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644134131, "uuid": "40d28870-26a4-46bc-9f75-d1618d7b7649", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644134131, "uuid": "b87ee267-b7e5-4132-bb09-6c046097f2c3", "value": "Order Sheet for 01052022.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e6f047b-872b-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644138114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644138114, "uuid": "69244fb3-41b5-4a45-bd0b-71eb7d15ff66", "comment": "Malware payload (AgentTesla)", "value": "83ce3c1bb7b8afab3a7f1476a51bd1cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644138114, "uuid": "f8ef89b6-6be3-4202-a646-2b3bb8f4bb4e", "comment": "Malware payload (AgentTesla)", "value": "8b119a390dd981e50f026ba145e61cf94d0b04366947410c22a97ce11e8c862d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644138114, "uuid": "a09f4f33-718f-40c7-a390-f11a7dcd4dce", "comment": "Malware payload (AgentTesla)", "value": "b494ec81792f5fff886ebc5ecadcb41f7812b20e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644138114, "uuid": "b23330b8-a499-444a-9ced-c3a261b8ec9f", "comment": "Malware payload (AgentTesla)", "value": "22ab256c89d0875f0800f0ee7b65e03d09f3ff0096b454f746224c1a1fdbe4f27ad63b729d7e6711dce60be8a9ab7428", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644138114, "uuid": "631f0ce7-3a50-4c0e-a8f6-0a1da6585b54", "value": "T110539D3A5BA8C5EAD715E475E043F311232B6EA6DB41451F33A03ECF2CBA6818DED491", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644138114, "uuid": "2e5efb27-f65c-4a0c-8c4c-79cb8c547d90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644138114, "uuid": "88915b7c-4f3b-4b34-a90c-f0b099aa9e72", "value": "768:tLGbhqKRnQ5H2YycYeFePyJrkcvPhOS4/Vi3xnehErtX+GsMG:tLGbhqKAHJycYeeQzPhOvVihneW9+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644138114, "uuid": "027c29f7-a8a1-4af0-8cb9-782e1b832c53", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644138114, "uuid": "47221e89-0586-4273-89a7-e2be4b38bb1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644138114, "uuid": "090f3047-4163-46f9-8e4b-3bfea2c5bcc2", "value": "83ce3c1bb7b8afab3a7f1476a51bd1cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b53a25-8766-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1644163470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644163470, "uuid": "ecd494e9-3d0e-4ac6-93f4-999bc9a48220", "comment": "Malware payload (ArkeiStealer)", "value": "faa0b854416ddc2926550bbbe37d13f0", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644163470, "uuid": "9249d95a-75ed-4b56-a360-bd5eafc11390", "comment": "Malware payload (ArkeiStealer)", "value": "8bb345912903d2f964cf381e57b5aa02e86a9236f0c365b41920069f80fa8bac", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644163470, "uuid": "8d1f87d6-8c7b-42fb-92dc-78b621b36ade", "comment": "Malware payload (ArkeiStealer)", "value": "f5d40598e0b5d0df96c0f579af2a71afd505d61b", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644163470, "uuid": "49266485-d5b0-4018-a900-a62e022f458c", "comment": "Malware payload (ArkeiStealer)", "value": "0840759be0265a75a1b7913218d57b7cc496162ad132e1235e664ca08b4476672d4aa81cbc64fbef534d45767518b8f4", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644163470, "uuid": "fabb1eaf-5155-4f3f-9faf-d36e1c8e740c", "value": "T1C7449E10BBA0C035F5B752F8497583ADB62E79B15B3490CB63D51AEE5A386E1EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644163470, "uuid": "d609a4b0-5531-4273-97d6-f1046d2c94b2", "value": "f582438c21380e695ebb7c6afe726d96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644163470, "uuid": "4794aecc-9c33-41d4-a16f-46f76b4f6360", "value": "6144:e5ertQvvkaxzbAsFgn8qhnluJz8qq4+TXUCqWqABc9PFPJ5:eLvvkQ0sFg/hnluuHjgVWzkPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644163470, "uuid": "1e63f2c4-dddc-46b4-8a96-fe0c4a92de44", "value": 277504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644163470, "uuid": "e20ba9cd-73d4-4238-8914-e30be8b8f11f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644163470, "uuid": "fff42676-2aa4-4525-aaab-13c419965c33", "value": "faa0b854416ddc2926550bbbe37d13f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab738d5-877d-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1644173193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644173193, "uuid": "cb1e022b-88f1-466a-93a5-97b1e262285a", "comment": "Malware payload (DCRat)", "value": "1ab3992b821baf682195a78d9eb31f78", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644173193, "uuid": "f43c5ae0-a55f-4562-b863-57a79013d617", "comment": "Malware payload (DCRat)", "value": "8ccaed7c504359bba64e038edf5284fc059e34c7f57793b223b92704efe4d028", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644173193, "uuid": "2034813a-0efa-40f3-ac2c-0d975f626221", "comment": "Malware payload (DCRat)", "value": "8626418def54d7501304d8abf0913ff0758ff7f5", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644173193, "uuid": "1dfb0570-7c62-42b2-9bd4-31575e696572", "comment": "Malware payload (DCRat)", "value": "81012bb285194816851014c849a2cde3eb936c1cf696eb42e362779d0554e1f3ac53cf72250d4f61bcb83e39c6bf0759", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644173193, "uuid": "54108343-43be-4603-946a-dc7dd9c75f86", "value": "T1B1A5BE42BA08DE01D029177BC9EF991447ACEA417A63DB1A7E8F336D65523A70D0F1CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644173193, "uuid": "559f499e-283a-47b7-814d-845f91dda428", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644173193, "uuid": "2cc804f8-3b1f-49e0-981f-fa0c750326bd", "value": "24576:zJWOfYHcx6brtRwBUKHgZKoZrrFEtPPP49QyOgYuDrEnt4rPbdgkYUomWLZb0bDd:zgOcgWLpG49M4rTDYhLJc6wIZkJ6TFX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644173193, "uuid": "9e7ded25-fa7d-4111-af57-b492c2235264", "value": 2262528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644173193, "uuid": "4b1c7835-0f92-483b-9de1-bd49435cddb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644173193, "uuid": "ab7db757-3c95-4a44-90f7-ae1c632bc792", "value": "8CCAED7C504359BBA64E038EDF5284FC059E34C7F5779.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c1c472-877d-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644173404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644173404, "uuid": "e37603c4-26fd-4115-aae5-0b56cd05782a", "comment": "Malware payload (Mirai)", "value": "1f42826fe9eeb6ef823b53632d43c290", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644173404, "uuid": "d28187f7-c253-47b7-af67-b85bdb4d80e0", "comment": "Malware payload (Mirai)", "value": "8e7b2ca0a1ec6fdeb90f21cb50bdd727c28ad64f22d46f054342f41c6cefad90", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644173404, "uuid": "66c97cbf-c2e7-46c4-bb73-727a0fb0c40c", "comment": "Malware payload (Mirai)", "value": "818c0caf41f64dd88e2bf24c16cb832b7b474457", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644173404, "uuid": "433c1acd-1dae-41e2-b84f-515d710905b8", "comment": "Malware payload (Mirai)", "value": "d14474f72b22f6d604be3d5fad94ec651a263ec18ab9e1df2a6ec17128327887620415ebd6bc234d18b6570a2ee6f150", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644173404, "uuid": "574ae31b-abb9-42fd-8f9d-5c0184cfb925", "value": "T104A2E1C4ED505D8AFD7AE1354379ED06A941D9A1360C935AC26AA13332FF102F101CF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644173404, "uuid": "00d6ffa8-60a1-451a-88ec-46817818f464", "value": "384:MMX206yHsN1KGeJKQNhhbbVfNQPdQzr448k1OG53nk+rzNyro:V2/nmKMbRl4QXUkCro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644173404, "uuid": "16210e74-d013-4cb2-8efd-cd08316c20df", "value": 21992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644173404, "uuid": "4e7a641e-8819-425d-acef-0da3772d6fad", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644173404, "uuid": "649efa0c-3227-41eb-b0b5-b9017eafb126", "value": "b3astmode.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf29c32-878b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644179533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644179533, "uuid": "5d56bda6-89e4-448d-bf4b-33a9b6055b75", "comment": "Malware payload (Formbook)", "value": "e248e3be4218496826756f87dd66f432", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644179533, "uuid": "6d455c91-bf9d-4dad-a667-871d13853459", "comment": "Malware payload (Formbook)", "value": "8e910fbfbf759e992ecc19c25080e7b16db746df5f559d3ba3ae887b857c11eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644179533, "uuid": "ee70bd68-0b36-42bb-9d5a-91b12d239993", "comment": "Malware payload (Formbook)", "value": "2adaa4f6e1da47b04d9cd2ae50f4a002b35a1a49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644179533, "uuid": "88d9cdc9-b5cc-4887-893c-31c9daf595ac", "comment": "Malware payload (Formbook)", "value": "ebf697cb623370845f1fc27e26d9fd80de0fbcae51885bf7e33ac16c099be6c0da1a868c18ba9ea02b966db4ec6413d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644179533, "uuid": "36f43b6b-29d7-445a-8d52-e3d4b8d88341", "value": "T12FA49DB4A0A78691F10B8974257CF9A102B231E3E9CA4D3917397641CFEEF583E8564F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644179533, "uuid": "1ce094a5-209d-4fe2-99af-ab78b5787b62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644179533, "uuid": "75451fba-983b-4312-8571-a0c59c444989", "value": "12288:b2NVO7J2zn7S5rVlNSOklrHYNz/MMAhmo9WTrQ0Ek:b2NVOVOWZNSOMYNQMamo7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644179533, "uuid": "4e15dfcb-3608-4fab-85ec-c68094a90fe7", "value": 472064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644179533, "uuid": "e992dac7-e58b-46ce-b0ea-cebfb778a19d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644179533, "uuid": "03f9c12d-28a0-4edb-bb53-e56a63774301", "value": "invoice.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bfe9d73-879a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644185757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644185757, "uuid": "87fd54ce-e16c-4676-a5c9-2fccca514437", "comment": "Malware payload", "value": "acd1b9725447033ebec6cabb271b0e75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644185757, "uuid": "02246dd0-44cd-41b6-97a4-553334e833ac", "comment": "Malware payload", "value": "90435b7caea8537e71c7ca50d1738155f77aa82d6e8011bfbddc337113b8b364", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644185757, "uuid": "bdc1dda5-86f1-4996-b018-4728eadc142c", "comment": "Malware payload", "value": "c579747028070e0a546b1bd9e2f7f138788eae3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644185757, "uuid": "f8096a64-c111-4041-acec-aba7ea968a56", "comment": "Malware payload", "value": "388bac97a011c0e27261c3705ae0ac1a1defa2a8cc133c498802aeeb3d7558756a0bd44e483d883f60816bd4fa264f8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644185757, "uuid": "b1a25409-cda3-428b-a417-a8b0d5af3487", "value": "T1DE2633C0C31B53AEE84899BB03BA51594BAEEE65DB91C0510B0072FFF47A195377B239", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644185757, "uuid": "1902ff6e-bf6d-4f7a-9a28-f45a2d0f03d0", "value": "84bb1ac192dd1d591766b467b12ade64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644185757, "uuid": "add5ede2-a075-4965-aea0-8dacc1574781", "value": "98304:A5hcmZH94IEqANKOtn9IHdwORM/FZI/GIhAPfigl3NRVce5WnZ:AHbREqAN1XwdwORM9I9CPfi2R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644185757, "uuid": "02cd309a-474d-4466-be6e-af1ede2a442f", "value": 4593664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644185757, "uuid": "4415439e-fca1-4403-9bd9-49fc6f423281", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644185757, "uuid": "2b1fa275-874a-44f4-b7f5-83c52480eabc", "value": "Apex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32aa5ab-8726-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644136163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136163, "uuid": "fef6a5bf-2a5e-46d0-b22d-2530c92119dc", "comment": "Malware payload (RedLineStealer)", "value": "a7dfa85032951c4557637bf8827e9814", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136163, "uuid": "b2271f0b-9d63-4364-bdb5-40cd8fc4b1a4", "comment": "Malware payload (RedLineStealer)", "value": "922486b752574377692f0c1220595bd1d2b5545e68d3e4442bfd54e1569606e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136163, "uuid": "3c9f1161-296a-487b-88fe-d7f423aab70d", "comment": "Malware payload (RedLineStealer)", "value": "e3fac6198f62d932718b4c8361b30af53ec07895", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136163, "uuid": "9e7da812-1bcb-493d-b998-180160b37e61", "comment": "Malware payload (RedLineStealer)", "value": "5b12195834b70c0f511798085480df053caefff98960564b651c26dace11eb88cf1dddc618a8bfaad71966fd1d53e036", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136163, "uuid": "8c3ed83c-132e-4022-a052-e84d146c899f", "value": "T1EE0633D3ADC1ADDEDB0988742BB3F708B9E4F1B7D055DDA47A2D894A3278384E236414", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136163, "uuid": "3b077256-ebe8-4e83-a92b-67b2455fc814", "value": "41304e4befbbd8a63ad6ec59f252160b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136163, "uuid": "6c5b07e2-c62a-4f79-a008-70dc416fe9f8", "value": "98304:rgF54NPgLKuCydMcA/KmXrf84YMLR5ZuGP78LPQn:rA54tguJl9SiLuiALP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644136163, "uuid": "6ed659fc-953b-4f49-9843-3788c1e24526", "value": 3698480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644136163, "uuid": "0fc55a80-e978-4ccb-b450-edfa990d6267", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136163, "uuid": "d5d910df-4d20-4585-8cf9-98ff4b8fdba0", "value": "a7dfa85032951c4557637bf8827e9814.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18cc9992-8783-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644175766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644175766, "uuid": "aa68f182-33fc-4023-874d-22c7720af5f4", "comment": "Malware payload (Mirai)", "value": "ee0040fad8654e8aa67feebdf3b7d277", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644175766, "uuid": "3b0e7a1f-6fda-4e85-abf9-e356c5d3f003", "comment": "Malware payload (Mirai)", "value": "92659c086830d28a2b481006c48e3657aa1a3d010d56fdabee7ad148b52919f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644175766, "uuid": "89de44e3-eef0-42ec-a721-11bc790f59b4", "comment": "Malware payload (Mirai)", "value": "c50dad3f4751c27bfb8cbffb5f917bc782d41448", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644175766, "uuid": "1655c0ec-f8b6-4b6e-b4d3-8bb86020a776", "comment": "Malware payload (Mirai)", "value": "1c111af2f3b6c12076c275b6152eaf36fb932c55da4226a70ae50acda72f3d6ea86f5925e2ea85f2bf552d8255f3c5eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644175766, "uuid": "6a25518e-cf65-42e8-9864-b12b2465a96e", "value": "T113B2D0681A4B49FDD062D43806F207473DB20BD2D803EC0674DBE98BBE566BC7B469A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644175766, "uuid": "4bd8e520-af3d-4b9c-8751-35d76e97f607", "value": "384:CMmpnBBT3enW9Puy4Oh8WqBGewY9snDMGF+Zr2w/tqStiIjh8hzJgGlzDpH7uNjp:rmBunWkSqunDMdr2w/tFYIj+hzJgGlzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644175766, "uuid": "e7150a82-0287-41a3-ae94-6b377cce4084", "value": 24052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644175766, "uuid": "805ab872-9321-4a10-a09a-e421cb9a1a8b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644175766, "uuid": "dc88cb29-1c12-4fa4-a917-4f72fec79e09", "value": "ee0040fad8654e8aa67feebdf3b7d277", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a2af1a1-8726-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1644135879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135879, "uuid": "acd64306-1b4c-4fad-9ad3-0099b0215c80", "comment": "Malware payload (DCRat)", "value": "a2c2efe4b9f5fe8335a1b6e5fc8be26e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135879, "uuid": "cddf0793-73e8-4c17-a371-59844811a284", "comment": "Malware payload (DCRat)", "value": "93c40537a90a49c4d3d676f33584e98465ec11913803415f20e781958ea344c2", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135879, "uuid": "f9476827-d6cd-45ec-98fa-cefcce87ef31", "comment": "Malware payload (DCRat)", "value": "f1b0e0b1db245a2c1edbf4684b9d34c7bc4edf3c", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135879, "uuid": "68bbfdf6-a1c0-4d01-ba46-f2cb1745ff09", "comment": "Malware payload (DCRat)", "value": "dfa053abf609c746d92dcb543b377087b2ec8845fa58d59f000ebc3d5dc05e3b132d90185c84f24286be8a62afe5a204", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135879, "uuid": "2e1a856c-2330-4ee3-acc7-3af59e1694f1", "value": "T104556B027A58ED21D029263BD5EF401547ECEE417A63DB1A7E9F336D69413AB2C0E1CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135879, "uuid": "7199a000-bc0d-49c6-9ce2-25325578f8eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135879, "uuid": "a31bc94a-2971-4b24-96b7-8bc039a3c5b5", "value": "24576:qQkqCDu1TNxgsUgzAy/D2cre4BOp5Ngr+4:qpqCDgdre4BOvNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644135879, "uuid": "15a7cdd1-9f3c-41e7-8c6b-bfea17d068f6", "value": 1284096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644135879, "uuid": "be84ae69-8e0d-4d12-9f9c-8766c2f06176", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135879, "uuid": "43005a9e-35b4-4478-bd15-db82d0dbb193", "value": "a2c2efe4b9f5fe8335a1b6e5fc8be26e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f4b662c-8795-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644183642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644183642, "uuid": "1dc6adc8-1f75-4022-a569-36d9b73de711", "comment": "Malware payload", "value": "426ff3d773d0975367db8fc3b085c102", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644183642, "uuid": "0868ea98-607b-4b71-89c7-59c030c442fe", "comment": "Malware payload", "value": "93f8ee2b4129c83f41fb3915747b707cfb289a2d4165acf1356764f2a9bcef36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644183642, "uuid": "b15071f6-14f6-46a4-b03a-7c73d9d2e29e", "comment": "Malware payload", "value": "bb5c3366e7d0a73ecd4a97dfcdb3eb3f747978f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644183642, "uuid": "01128bcc-72ca-4b46-9b13-5f9050416098", "comment": "Malware payload", "value": "c115fa18affb6cf0cc6e559d838e8d15ba04205d87e29b111eb0bcc0d4931525276985b30e5a78d14cff3a3e7ec5425c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644183642, "uuid": "1b9233b7-74ff-4311-9ed8-654386a3dfb6", "value": "T14FB2D194B0D6B142E8EA767188F058344BB24C7C7E64E9A59BF1E9C0DA47FA2D35D008", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644183642, "uuid": "f3d56dd3-a69c-45f0-bcb2-983526a67f46", "value": "384:AldF35G/fMTWzcXjyqf+6u9HkmfybdSbYhFxl0+J12cOGo9VdHLJkEz9rNo1oC:AlP3M/aXjyqDGP4Yb2/lrK1z9hYoC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644183642, "uuid": "ff9eea1c-fd31-4b73-bae6-33065678dd1a", "value": 24616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644183642, "uuid": "7a0c49dc-92df-49d6-b559-762c7e87ad73", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644183642, "uuid": "70fcd79a-b3f9-4f40-94fa-ec8901e57ab8", "value": "SecuriteInfo.com.Linux.Packer.Patched.UPX.30669.22544", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8586d5cc-8726-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1644136006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136006, "uuid": "d0a474e5-1175-4eb7-b55d-99119a627774", "comment": "Malware payload (njrat)", "value": "adad6f8febdf3f0f074bc66d9bb54888", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136006, "uuid": "2c5b1058-64a5-46f2-9d90-6a04054ff0e6", "comment": "Malware payload (njrat)", "value": "95010a7aaf2ec9bd5b937b00c8d0b7ece0adcc18303535b30a11a2d25fa8c883", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136006, "uuid": "e4033ccd-1eb4-4b8c-98e7-a65ee0854a92", "comment": "Malware payload (njrat)", "value": "569eb78df0014ee82a04bf84bc60bd2df28cacf8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136006, "uuid": "67fba195-f6d2-4b1e-8eee-35ecfd96278f", "comment": "Malware payload (njrat)", "value": "01d87882817370d26b7e5dffa3cf2ebc2b282e8f2a2edc1fe966efc863e77cd7e1149157e6463c81ae5090fa95a63759", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136006, "uuid": "a8656855-3344-4af4-ad66-e8a55b745316", "value": "T12AF4F09C365475CFC86BC876CEA41C68EA647077670BC243A1931AECAE4CAD7CF154E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136006, "uuid": "8fbf73c4-a446-4bbd-a2af-b1ad7040e952", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136006, "uuid": "c7136cf3-b949-4f11-b692-4050031bab69", "value": "12288:tIk6tXxZbeHmFANaCFwm07+fXPMEuz0J/DdJloyn78J9UXIY:mkeBZbvFA003FHMvz0J/DdJyyn7K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644136006, "uuid": "ea06eaef-d6cd-4e20-bc43-c37fa7926667", "value": 729600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644136006, "uuid": "00c458d4-721a-445c-94a2-416ecdf968eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136006, "uuid": "8856a71c-ab3a-469d-8769-e95548f2e423", "value": "adad6f8febdf3f0f074bc66d9bb54888.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d3e8f79-878b-11ec-9275-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1644179183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644179183, "uuid": "be267a0d-8c8d-4ca6-8d19-57e23f1eef1e", "comment": "Malware payload (IcedID)", "value": "95b78efc8ec9eb41decb5467d8dd0b36", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644179183, "uuid": "3383e470-99b8-44dc-a2a9-dc798ba2af30", "comment": "Malware payload (IcedID)", "value": "96e2e63b51500cff2f266e0e4894a667b11d47245837bcb797b8899e04b16b8a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644179183, "uuid": "4af1bd12-3eac-4d29-b34e-e8bec9f548f0", "comment": "Malware payload (IcedID)", "value": "b14775188ca61afb731947e7c6bc038ab79d75a3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644179183, "uuid": "95a47a43-9bf1-4b0d-bce9-7a35a169edba", "comment": "Malware payload (IcedID)", "value": "456a1f44cb9c249db945977287e718220f8ee3e998b5116d948c029bfd8963a4f017681dc5ff054b8ca97fa9b2e11d51", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644179183, "uuid": "55916f42-5984-41bd-a98c-02ca43beb673", "value": "T14AA22A9B2761069CC0B7C2B9C6572A27C2B234540632825F05F4CFAF5E6B321BE6EF05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644179183, "uuid": "7e330288-311b-49a9-ad55-7433acb0b411", "value": "4c467ff96df28a37c2d255f3eb57cb75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644179183, "uuid": "a7ef7c35-114f-4c76-b663-069cae579e6c", "value": "384:LnOKO6Y7MzPA8+5aAk617tBmgCvSYuGSz:SKVPzY3MjKtOeD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644179183, "uuid": "e2ce7368-3b06-49d5-acd3-396b0fafbcc1", "value": 23328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644179183, "uuid": "ab345c69-8bf7-4f37-813a-bdf3f6ab7c99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644179183, "uuid": "2e919ebe-4016-46b9-bc29-f8095880035e", "value": "95b78efc8ec9eb41decb5467d8dd0b36.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d66a85e-86e1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644106249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644106249, "uuid": "17adbac3-08a0-4d57-9081-f5b988afff08", "comment": "Malware payload (Heodo)", "value": "0d205549d937fc701d9877739b12dbbe", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644106249, "uuid": "bac668f7-f2c0-469c-8cde-524ae24a4239", "comment": "Malware payload (Heodo)", "value": "9ab19f3c5f476959bdafbb5f55dfac1a166b2f4fbd079e4f22490f7751738b23", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644106249, "uuid": "dab0d76e-04a5-43d2-a02e-beb837e375a9", "comment": "Malware payload (Heodo)", "value": "4e5762461d400678c07d8d6b3407b669197d0e43", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644106249, "uuid": "e2229c01-95c3-4866-b399-09f08c694b82", "comment": "Malware payload (Heodo)", "value": "5589a6c5908c19c876a426dd549c540318fd316a5942dedb90a8dc4b1abfa53b54d5b64f6faacd531b1df0126de7438c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644106249, "uuid": "50a6603e-ea72-4206-b3f9-e08061d4412e", "value": "T130D4BF906D8644F1F683293600A7A2264FEDA61503E0DDDFCF88F9725F65CC2A77A09D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644106249, "uuid": "ec7cb77d-0161-4122-a771-55d7921ecf39", "value": "12288:2D/Tukcyj1Giqjxq4s2IuJIMm0WKQTyPNwWe7c1QWImzvxmxsff7TFSuXAOFf6NF:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644106249, "uuid": "6133e265-b803-4fae-9fe8-045b13cdcbe0", "value": 655788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644106249, "uuid": "04dd60c4-3630-4500-8421-44ceaca036ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644106249, "uuid": "907ef45e-1105-4f44-98c8-83d001fc257e", "value": "emotet_exe_e5_9ab19f3c5f476959bdafbb5f55dfac1a166b2f4fbd079e4f22490f7751738b23_2022-02-06__001033.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad1cd0b3-8726-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1644136072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136072, "uuid": "d05dc78e-5b42-4e57-a7c0-64c12d30eaa3", "comment": "Malware payload (NanoCore)", "value": "bb6dce6a82cf0b88665f7d417e0a7bff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136072, "uuid": "b525ca76-3586-42ce-88c9-d28532667466", "comment": "Malware payload (NanoCore)", "value": "9be7f5ccda4bf1bed668611d9d862110305870c96583415b931eeb80a16e7c50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136072, "uuid": "66ffe4f8-d482-4d60-9778-956163ab7b7c", "comment": "Malware payload (NanoCore)", "value": "df6f6a8bf78d0f6ec114398dc1dccd16d81d84fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136072, "uuid": "7666017b-10e3-4fae-b72c-1aac67fb26fb", "comment": "Malware payload (NanoCore)", "value": "40d2cf42d00aeae3ef6643e2d2ecee17ecabeca0198a04a5d7f7e93128c4076af688a9ac04425e83427a622e93a4c642", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136072, "uuid": "cad4792c-c78c-4b7d-81a7-19a1b11e2268", "value": "T16545C49D321076DFC92BCC72DA992D64EBE0657B930BD24398A305ED9A4C997CF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136072, "uuid": "b644abfa-8028-4c21-b1b5-d9c8f7ca9e7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136072, "uuid": "c4dce71c-d228-48e5-8352-c31869cdcfd1", "value": "24576:k8ClpjXIXIETEvlCSB3D2gYsG8D3qhVQ:QZUIEYC62r8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644136072, "uuid": "a3ea24b5-0b8e-4f6c-b06b-59d4ae9bcece", "value": 1167360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644136072, "uuid": "49dd2aa4-d53c-4d04-8637-f39a21f9446e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136072, "uuid": "e363dc49-e35f-4dbb-8f30-79c5535c1415", "value": "Business Contract.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab9b70f-876e-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644166750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644166750, "uuid": "1c270495-6404-41d2-b927-5392710a9f3d", "comment": "Malware payload (RedLineStealer)", "value": "669df180844943f7d8baca8a9a2a92df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644166750, "uuid": "529903fc-ff2a-4e65-8a05-9f1c21a6fcc0", "comment": "Malware payload (RedLineStealer)", "value": "9c75da6b46111e6ebd5d0cba678fd8edceb318290f912d3319274f6ba58c29a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644166750, "uuid": "1a05c54f-0f80-46aa-a2a6-f93bdfec1b67", "comment": "Malware payload (RedLineStealer)", "value": "afef27fd558df89921393bdd1e9bc898db061268", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644166750, "uuid": "d27a06d3-a19b-47bf-8eef-9d5d18ce86e6", "comment": "Malware payload (RedLineStealer)", "value": "20e0d42684db735565e92dfb1c94b2113753e4a246c9bad966650edf884da2d0a6200fd0a497ddad694790f4e0f75cb3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644166750, "uuid": "8c891ee4-a10e-48d8-8fc8-75cfede7042f", "value": "T1430633C701D9AA3BF14C41B08A64DBEB479AB170B4D14489B0A0EF9FEC246D994B51FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644166750, "uuid": "00128133-5c67-45a6-b13d-fcd6a43e85bc", "value": "41304e4befbbd8a63ad6ec59f252160b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644166750, "uuid": "a228003e-11b3-4771-9915-a336c66fb19d", "value": "98304:opOPCCrStIGPAS4xXJpD+zxH9jfU78vvz:opOPCW0jPEq7jfqa7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644166750, "uuid": "5970aff6-1d2d-4935-a8ca-7e5942588ff9", "value": 3730944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644166750, "uuid": "6230358f-fc26-4a61-8080-f803870d9888", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644166750, "uuid": "ecae3fe9-fc65-41d1-8926-d32fca91a14c", "value": "669df180844943f7d8baca8a9a2a92df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d0fd913-8727-11ec-9275-42010a9c0029", "comment": "Malware payload (BitRAT)", "timestamp": 1644136233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136233, "uuid": "b84b3772-8d66-4ce9-af37-49b7b864c9d5", "comment": "Malware payload (BitRAT)", "value": "fe7bdf45de45d5533ec55607c05d7798", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136233, "uuid": "45d1c430-1a3c-4da3-b5df-1b54ad3f685b", "comment": "Malware payload (BitRAT)", "value": "9cc61703f81d88f53847dccc0ac81285408bc8d2f7ae2708c2f195f73881af2b", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136233, "uuid": "8f0674c2-77c4-4337-98ac-c2d70d734285", "comment": "Malware payload (BitRAT)", "value": "5ba703def4321b9a1a805f9c1c41477b9c79ae6a", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136233, "uuid": "53eeff81-e689-4f3e-9225-2bd8c54ea420", "comment": "Malware payload (BitRAT)", "value": "18d5a0edc90b4bcf43b1a325a8a9ce6bea67c39e1aae079af5d6287de0d26d635a6f51d01e5cb02294c3ffc2483122e7", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136233, "uuid": "91d24d4f-3b62-4d4e-8b7b-0adec787a40c", "value": "T14DD4CF132B9485CAE5A2CFF18E3559939FE789631C13EA0A1FE834B70D35B9A8D35D01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136233, "uuid": "7c803150-094d-4f52-b649-3a4a7be46ce5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136233, "uuid": "a958bdf1-4c22-47be-88aa-a0807a4ada09", "value": "12288:Q19+bNvJ8R4E/JGZz/rGHPgzE1oISHz9:QqbNvJe7IZ33V/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644136233, "uuid": "c288c044-9bcc-4970-b004-71507d820c6b", "value": 617472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644136233, "uuid": "44037b0d-7a92-4086-b564-50663d8ea94c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136233, "uuid": "912e8857-c943-4f89-bc0f-047a224aba0b", "value": "Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d3f8c3c-8707-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644122570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644122570, "uuid": "7212c347-1537-491b-a406-92c406a7a58e", "comment": "Malware payload", "value": "b2003217a93f7e1ad918b3b016107daa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644122570, "uuid": "ecd92f97-cf2e-4a0a-9db9-bbf8ca2da03e", "comment": "Malware payload", "value": "9cfe11eb3844475d13e221f84c0cef458a8db460332b7277d57d67bd1d8c4779", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644122570, "uuid": "67f5716f-820b-4d0b-b8dc-abf4c8c8bc03", "comment": "Malware payload", "value": "76e57d170d5f61648fc980c61888987e7ec26697", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644122570, "uuid": "55450b34-7320-4d6f-961c-347002491cde", "comment": "Malware payload", "value": "8de4e78d003329d7ce2559c23dcc2346c4eab7762a15248ddf4f2cc6851d04dea1a2ae6da7e98a12506cfc18cf768a8a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644122570, "uuid": "e2925c4e-fec9-4ac4-9679-f4f5c1739576", "value": "T1AA03E19E4D44AAD4DCCE0F3AE46E4A61AD6DA4503206BE4D47D0DE70CE9C90B7ADE078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644122570, "uuid": "87a248c1-4e31-4c71-939a-24d5e79d493a", "value": "768:6U3oosCRFaYQ2Xukisr5lQ5a8Q/JbZu51zYCHs31Ji4G27jpWRe:coTZdr33fJbZu0K+Ji4H77", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644122570, "uuid": "d7da2fdf-0e65-4eea-856a-e677829ae0d7", "value": 40972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644122570, "uuid": "06b0f49d-8f89-49cf-acb1-09fed13f8640", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644122570, "uuid": "0be8f2ac-f2a8-4aab-aab9-511e6f9f193c", "value": "b2003217a93f7e1ad918b3b016107daa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4176b3a0-8727-11ec-9275-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1644136321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136321, "uuid": "5b4aa8bf-5996-42cb-952b-ed11c774ffc2", "comment": "Malware payload (AZORult)", "value": "253732efc73b152f1f2d496413ed232c", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136321, "uuid": "d12b2507-ab2c-472f-bbb3-b98845d44bf2", "comment": "Malware payload (AZORult)", "value": "9d227eb3f4ff27c39d61130fae6458b06a33ee315a6e2a8fd84afe08d49ce553", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136321, "uuid": "aab55319-378a-485a-8331-6383af2d5e40", "comment": "Malware payload (AZORult)", "value": "9d7d404930cf891bf54a034bf9c9f943e42fba14", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136321, "uuid": "a61d4f0b-4fcb-41b5-b123-84db96654c2b", "comment": "Malware payload (AZORult)", "value": "4da3cbf1f31a3aed94f8ec4984edc84ce6c65c51424c453bd0844fde7ec0199719ab3f38b502c728c69cfe8af4f38552", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136321, "uuid": "beff92dd-2057-4422-ace1-141fef64ef89", "value": "T12E35F161A995A8F3D04F65BAABA1B6D04238FD3A64E70547F30C3D1DEB33941D912723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136321, "uuid": "e7a213df-5074-4de8-93a9-80b0020f898d", "value": "c48c98d8d11cf51c73b194502a508be7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136321, "uuid": "b9895051-de0e-4349-98e2-c1a0f37a415a", "value": "12288:l9SCVijMRXOtQt09oz4FMGH9uct73wNIX0809wFPXtQA:l9bVijMRXOttoz4FM0oeDAa080uT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644136321, "uuid": "cb33adfd-fc5c-414e-b4ac-1a93266d1e19", "value": 1060864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644136321, "uuid": "f403154f-6236-4166-8c81-de8a9fea9362", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136321, "uuid": "ba2e1021-cb53-4375-af54-c817e14530c2", "value": "9D227EB3F4FF27C39D61130FAE6458B06A33EE315A6E2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87eee09c-8725-11ec-9275-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1644135580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135580, "uuid": "280d5213-a0a8-4562-b8cc-2c9b2dcf150a", "comment": "Malware payload (Vjw0rm)", "value": "5887a17b00e9b0e3e6c93283be01e996", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135580, "uuid": "037c8688-c28d-431d-abee-35378de9cb1a", "comment": "Malware payload (Vjw0rm)", "value": "a0904e84a91de930da0aaf6e18df242b50be7003ebd651248224f15e28b9b92b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135580, "uuid": "8b109928-379c-4ffa-a9dc-3a7a2261a1db", "comment": "Malware payload (Vjw0rm)", "value": "aae1174824c27a532368bb30289641feab29e636", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135580, "uuid": "ab864cb1-b18b-43ce-8ad1-e512a6b9a009", "comment": "Malware payload (Vjw0rm)", "value": "15ad8e1ffb28e7155f38a8d99fa6afd4e7e79dbf9adc045723afd41d1d53ce54e1169d290a605d203739d237e86c7697", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135580, "uuid": "4ae02922-be77-4e4e-9c68-f83f65e94eb9", "value": "T14E4356C06BC1F886035B67B77B56A4F5DB2A5C9C31C4496EE100BCA0F0AE99EF5E8570", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135580, "uuid": "1b526e09-e878-4d04-8a3a-e5b935300139", "value": "1536:k5C4UoWXEo801aHKiucd3QX5j7TOnSopn6YkH8waU3qYLqelWHIBZ1S2tm8e6rxI:6zU/XpvDC2PrxVjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644135580, "uuid": "8dbaffa5-62b4-47fa-91b3-548bcefc0c82", "value": 59675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644135580, "uuid": "98efaa88-ba2b-4a96-a217-01fba5168a44", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135580, "uuid": "86e1e763-5e80-4348-8216-faee78f9a936", "value": "RYT658301.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37a2fec3-8726-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1644135875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135875, "uuid": "a92e0daf-b50c-4a33-85ce-68a6a9d56e57", "comment": "Malware payload (NanoCore)", "value": "a1ee74d5b8f46b3f0d768eed0e70809a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135875, "uuid": "8614bc7a-b5bc-47c8-866b-b811320ed1ce", "comment": "Malware payload (NanoCore)", "value": "a4f528ebe4a9d85b8b0e91625acaad6428b00ae54a2c7ae2fe8dffc622ed4dbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135875, "uuid": "1c0b6c2b-1c48-40b3-b6fc-bce93b974185", "comment": "Malware payload (NanoCore)", "value": "2ef3d173bf0f1195a1da2c0ae2e719f737c997e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135875, "uuid": "b55f104a-13f0-4676-96b1-b7b874e155bd", "comment": "Malware payload (NanoCore)", "value": "8139d85c803f299227da1c48a37fb0570a9b6249e71b0e47a7cc8dc7224c9754a5c975eae02a27587def7149d1b20492", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135875, "uuid": "bdb26e3b-6769-44ea-9025-063cd752b03e", "value": "T1D6F3CF447BEA8E19D6EF4AFC1872560443B4F6638D53FB6F5CA520BE5822780C7503AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135875, "uuid": "2ff07864-a3bc-4d43-b9f7-06f24eade196", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135875, "uuid": "369176f0-78b8-47bc-b120-816bdfc5a85f", "value": "3072:FIndDQhVOGWurRMqQqdNqWbDE6lKpEvz2LKCx+ib85WLOSxre9/AxHJG:CnRvurRMqQqdNdbA6Qa2WCE085Qe6nG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644135875, "uuid": "bd6c014f-4d4a-4368-bd31-dbf07ba42f63", "value": 158720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644135875, "uuid": "b6924204-34ea-427e-9414-118a248ff32d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135875, "uuid": "4879f377-2781-49ae-9917-7da990ccce5c", "value": "A4F528EBE4A9D85B8B0E91625ACAAD6428B00AE54A2C7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d298d9f9-8781-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644175219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644175219, "uuid": "2ebe04da-fa7d-4006-b298-b9e47c21899e", "comment": "Malware payload (Mirai)", "value": "7c386903370671f149417d4f62ea7a49", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644175219, "uuid": "f467f0b3-bca8-49d5-8744-70e067549329", "comment": "Malware payload (Mirai)", "value": "a5d323077ec9dfbb8e5c4edde1e0c83400412eea9141b5de59bbd4616a098677", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644175219, "uuid": "f1418ba2-8469-48b4-868a-d49946e799d2", "comment": "Malware payload (Mirai)", "value": "8c95cb13633b460e4016808050886dd79938f9d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644175219, "uuid": "96d00048-b089-4a5f-87f5-59ba0d2871a6", "comment": "Malware payload (Mirai)", "value": "a2460880d4a44b465fab694799ee731f1d2b5937e1ff34ce78c0dd5d4ec4c42fee99d4a9452a46aa6acd09675046ba12", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644175219, "uuid": "dd785d5f-819f-456f-96fa-24aad60f6fd3", "value": "T11BA2CFF4C46A1E85EA6A6FB01DE1D6CF3BB31C8F3B158CE61281F72052562669F486C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644175219, "uuid": "42592f14-b0e9-497f-b1c5-2e6bc293b2d1", "value": "384:ojqkELJFswRcYiHRNHlENtJtak6tM1fnqeAM4uVcqgw05LxJ9a:rlJFswRhiDHEJth6tid/4uVcqgw0z+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644175219, "uuid": "3338b4fd-356f-4b8e-94ab-56593ae33215", "value": 22280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644175219, "uuid": "2945eaed-1fd3-41ca-bcc4-f849e77adda4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644175219, "uuid": "0b6fa7a5-7d62-4feb-8435-42a217d56094", "value": "7c386903370671f149417d4f62ea7a49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6635d474-8722-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1644134235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644134235, "uuid": "5bc6aadd-1f02-443a-8353-f06bb2cab0f1", "comment": "Malware payload (AsyncRAT)", "value": "a4641bf3dcf3e2538b10ecade4d4cc66", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644134235, "uuid": "80ad2919-86d3-4946-9fe6-03a37feb6ac9", "comment": "Malware payload (AsyncRAT)", "value": "a8f32c3a8462991be7a3fc0940d2c99f01566264cd71b33644da7c18966dc6f4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644134235, "uuid": "4081c825-58d6-4ff6-b733-7c346357de6e", "comment": "Malware payload (AsyncRAT)", "value": "6f4abce09136fc6e0d3cfca13eac708c495ca59c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644134235, "uuid": "556cd279-82e5-4f2f-b4b2-d04ef5f2638a", "comment": "Malware payload (AsyncRAT)", "value": "42d12b44b0b3882c5d1127f9b5f1a4d4673c9075766e03fe2ad7676be7d4eb1a7a3f9eca20f8d170b5511d7daffa1f50", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644134235, "uuid": "ad096c2b-91d2-4f2b-8ca7-b9148dce5a27", "value": "T129232B003BE98236D5FE9F78ACF11155877AF6632503D55E3CC841DA5B13BC6CA02AE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644134235, "uuid": "c7582f0d-6cf3-45df-b32d-0ff15eec81db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644134235, "uuid": "3917f549-5e51-46d4-85ed-82449a8d68e3", "value": "768:CeNvT/GoW8AGXvye91Vstjb0gxh5ZJlEOznxBYjiELz2YDDGC2tYcFmVc6K:CLG/Ylbbxrj+OTx+OGDGCKmVcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644134235, "uuid": "6efbb133-6a55-43d9-b86d-248c45a8b0e0", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644134235, "uuid": "f5db698b-b3e3-4d5d-831e-048ac256754a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644134235, "uuid": "967109f8-10c0-4793-b7bf-c6e05411f71f", "value": "a4641bf3dcf3e2538b10ecade4d4cc66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b15c5a7-8726-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644135854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135854, "uuid": "76a4acaf-9ec8-47df-8ea1-8adeb45adeeb", "comment": "Malware payload (RedLineStealer)", "value": "1f1489bebde951a8fce2d0b8897fcdd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135854, "uuid": "db02868d-fdc7-4804-985c-68e83642e223", "comment": "Malware payload (RedLineStealer)", "value": "aa5dc7e3d0c2c292de3b1f9ee0ba29f5b6aefe2e36dfb9e70363c49dfb28890f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135854, "uuid": "1c2aac16-a276-4726-8769-d29c889ff378", "comment": "Malware payload (RedLineStealer)", "value": "dbc43328a9d3fa6568d62bf0071a8552d5c8c174", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135854, "uuid": "7b1a4624-f482-4818-91a2-f3d672f12e24", "comment": "Malware payload (RedLineStealer)", "value": "73df734e86360d2002036d039ca6e0d2213778e7f2449d7fc26e99c7d1aaa3b45424aa161571002cc6a0c37ecc02092e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135854, "uuid": "a414ecd6-6d67-47d8-992a-cb30594dbaf8", "value": "T1FA863B17639D8A24F7BE0A79A4B0021543F1E18B2511F7DE9EC074D93F26FC26211BEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135854, "uuid": "b7769951-b847-4b9f-a518-d3309ecc7522", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135854, "uuid": "cc56399b-7ce4-4959-902c-619e7ac0e6ee", "value": "3072:LnHO0tIeHLbGeYNprkfX1Ebf5oTtZ9Flml:LnfIeva/rYeb4tr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644135854, "uuid": "15ee5992-54a6-4074-8a4a-2c20b63b9c9e", "value": 8524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644135854, "uuid": "04d45ae2-bec3-4d34-a79f-464093eea0fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135854, "uuid": "ae70392d-9817-4e76-a96f-2c0d1ae59ec5", "value": "AA5DC7E3D0C2C292DE3B1F9EE0BA29F5B6AEFE2E36DFB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d440ad0c-872e-11ec-9275-42010a9c0029", "comment": "Malware payload (Stop)", "timestamp": 1644139574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644139574, "uuid": "94838854-3f15-458a-95d9-1bb541a4cf40", "comment": "Malware payload (Stop)", "value": "33008ebe13aa31c17182e6d1281af810", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644139574, "uuid": "66dafc70-8d17-4d02-9c9a-ac721c261e5c", "comment": "Malware payload (Stop)", "value": "ab773ef4933bf0d52210c6494f3611a6805c4fd880d1c62171e96f5d5b25f46f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644139574, "uuid": "d0668fd0-98b8-4c55-b7ce-c814b6d54e12", "comment": "Malware payload (Stop)", "value": "5d2f54a597dd8c66b6a30ccb79017a32743a5219", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644139574, "uuid": "46373339-791a-4758-9f40-9184d2848018", "comment": "Malware payload (Stop)", "value": "23b29e521d5bb86c17b0faed9ba21c260c160ae418681e057a2c45fefcc32ad220c581262457aae9a01b3cefef384a30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644139574, "uuid": "87843bb6-18e2-4ea2-b116-d1d7a24c694d", "value": "T176050100AB90D034F6B705F8497983ACB52E79B15B7494CF53D22AEE1A34AE0EC7175B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644139574, "uuid": "588cf395-d625-406e-b54b-18a6ba929dac", "value": "f582438c21380e695ebb7c6afe726d96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644139574, "uuid": "b3b74d6c-0de5-4844-a59e-9a68911c3d15", "value": "24576:qgxAS9THNrJ+VicU2P5FF/kBtdZ5ITPnpSEs+a:ZvrHqicUKfk75WnEEs+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644139574, "uuid": "5a38ac38-bc45-441b-af66-f77dda9fe1f8", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644139574, "uuid": "226fc863-27c0-49e3-89b6-718b2ca05db4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644139574, "uuid": "8c33a287-1272-45cd-adad-cc414c14bf2b", "value": "33008ebe13aa31c17182e6d1281af810.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45bdc5d7-86e0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644105834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105834, "uuid": "f1724473-b55c-419f-aad1-16dc4abfec33", "comment": "Malware payload (Heodo)", "value": "63deaa9845084d2b0ffe0f896e065e83", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105834, "uuid": "3221f8f3-54f4-451f-a125-3a3452585fdf", "comment": "Malware payload (Heodo)", "value": "acd377cc41bfb4764411585b50a7732cad2dcc29fb96acc92d8a0a5f2a209f46", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105834, "uuid": "412e6db9-2bbb-4723-859f-266596cd5c06", "comment": "Malware payload (Heodo)", "value": "bd8181bbf09cbdc6ac5866e0a018d40fd5c44ec8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105834, "uuid": "39ff33f4-a268-406f-8f9d-c60208d70d1c", "comment": "Malware payload (Heodo)", "value": "6cf504b98f6e5e94ba5ae6eae42d624b94892f21c5745bc152b07eb6f50dc941ed217eb39f593ef3aaf6129d20a1e26d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105834, "uuid": "2202f440-76e8-4487-ae32-8488294ff38a", "value": "T1A635AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105834, "uuid": "47d75441-7b89-4136-97ca-fc310edf8306", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105834, "uuid": "b3044c54-468f-49c3-a4c8-6da19d6eed69", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTKFIIm2m40:wfv1GVFF+765nFvFf6dlzzSuFIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644105834, "uuid": "8a020f8b-d196-427c-a05e-48f32c5521de", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644105834, "uuid": "0591c4c4-c9f1-438f-8596-6d080e02b31c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105834, "uuid": "7f45839d-c920-432a-88b7-a90dc867298d", "value": "emotet_exe_e5_acd377cc41bfb4764411585b50a7732cad2dcc29fb96acc92d8a0a5f2a209f46_2022-02-06__000348.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "827a7ccb-8728-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644136859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136859, "uuid": "de7b6011-4d3f-4b11-b845-571ca228ab88", "comment": "Malware payload (RedLineStealer)", "value": "5892f8b60735633953c8c99652c2b078", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136859, "uuid": "3dd91367-7a79-4b8b-983a-d51a146e6dc4", "comment": "Malware payload (RedLineStealer)", "value": "ae9e7613eb86358cf0c50eb2753c82c605f170fcae1ada510506d037d2987e66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136859, "uuid": "1d772fa6-57fb-4fa6-bf81-d0e72963fce8", "comment": "Malware payload (RedLineStealer)", "value": "dd728e0d453de05f8ed65f9a844e948707c1f032", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136859, "uuid": "4e6bf7e0-7c47-446f-84e3-b1b2d3c7341d", "comment": "Malware payload (RedLineStealer)", "value": "630406aa8e0ea7d7d143a80e3b72639f74a767260e418e32c7bd69e5ef05985294e35be5b3463e2d66ae46367c7ff1eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136859, "uuid": "3cc76e4e-4721-4bbf-ad94-c7c0ea1ad784", "value": "T1C2034919369EF833C25EBA79C990185103959D51DE0FE30AFCBC13DA1602ADDD9B2B4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136859, "uuid": "ec5f221b-9794-4d75-93f5-28a88f2f3ea1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136859, "uuid": "483d84bc-4d95-4855-9bf3-23f6af0f6c53", "value": "768:VRakwtQH56dfNGM0TJ1hP0kCYxABTySIMmHdV1MkJFDonD7:SxQHsoTJHP0kZAQSI71MqDuD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644136859, "uuid": "2886e1dd-21bb-4564-8934-4ab6e8a47c14", "value": 39424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644136859, "uuid": "42845097-3981-4328-a47a-fea9f379e56a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136859, "uuid": "39f6e00d-5043-40d0-b6e5-a32662683a80", "value": "5892f8b60735633953c8c99652c2b078.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "059f454f-8783-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644175734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644175734, "uuid": "d7d642cc-ba40-4370-a5a5-4e9813940722", "comment": "Malware payload (Mirai)", "value": "24e11c6c227ba3d6f81252f9e6ff2eb2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644175734, "uuid": "34a7f2a7-63cf-43ab-95bb-074061c648b7", "comment": "Malware payload (Mirai)", "value": "b4949e87615079586b313dc56c9df49be0d6908122515a801b000cf5958b5595", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644175734, "uuid": "d19466f9-d031-48f5-9aa8-864f55d1820f", "comment": "Malware payload (Mirai)", "value": "dd144aefe1ec7af4c93757b56aa1cedb04d8ca8e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644175734, "uuid": "c0b9e42e-556e-4bb3-9334-6b21046e3dab", "comment": "Malware payload (Mirai)", "value": "98271e18dec631eb73e3f31d0ab8c450d539552ccf59537c30c0e1f412473f524002254ac0eb8cb4bb94ab1a33b47fe0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644175734, "uuid": "01892d57-84cd-4d67-a3dc-0d95e82235e0", "value": "T1EAC2D034D653A4B1CB70B93BD9794241BF8D36B892C7B373150986E82843A83ACB59C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644175734, "uuid": "882c8f20-765b-405c-83da-f25e399dad20", "value": "768:vscWiglXV5ZdQEtPLsi1fjCpkQywza5y1I9q3UELjsi:P05ZdHtVNjCphyOa5KL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644175734, "uuid": "4afcb33f-8162-4fae-9ef2-bf60c7866b58", "value": 27480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644175734, "uuid": "1dc9961f-ffb3-4bfb-9ead-8cbb9b447e60", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644175734, "uuid": "500af4ad-2c83-4271-a721-ce42f9c4a3bd", "value": "24e11c6c227ba3d6f81252f9e6ff2eb2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d3dcf0c-8727-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644136448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136448, "uuid": "393ee333-8c47-497b-8a22-6e7b7d1456e8", "comment": "Malware payload (RedLineStealer)", "value": "a1172c1d1ad6aeb11994493f08c56ceb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136448, "uuid": "7ea3bda5-b4ca-4975-bbc5-1a7330182e54", "comment": "Malware payload (RedLineStealer)", "value": "b56b3f42ced56671e251f8533930662a98b3051aa93db71414b2f13b77abaaa1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136448, "uuid": "f7777adc-2201-4ac8-ad7c-86ded5dd75f0", "comment": "Malware payload (RedLineStealer)", "value": "818b9a0120c9b816dc9c83480a50741fe0fa6e93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136448, "uuid": "1aa3cd84-8db5-4553-8621-4acda6a43522", "comment": "Malware payload (RedLineStealer)", "value": "1b28f888766bf3a0b98ffd1bd0322a33e1b51e7db59879b9658bcf662b665c420fc06ac48c3dc0da62a4a6ed4f3e9fdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136448, "uuid": "06d7b677-25df-4944-8449-2d559c9ea4ab", "value": "T1D1D5BE17A87805CED088C2F47917CFAC5BCF3A2AED9B3CEF202A4E867E505255D46179", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136448, "uuid": "e9ea362c-828f-4eca-8aac-1cabcdc7c722", "value": "60cbb474a171ca6e4505f8150cd8b9a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136448, "uuid": "68c4ad7e-3171-471f-8693-4895002ba49d", "value": "49152:hyLgVipFVS9N0Y+WueeKDwzXrCfUxJ8Km1RJzGuxak:8gVqrSlleKsDrsUX8Km1/Gu3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644136448, "uuid": "5c64f8ce-eb2d-4502-b8ba-e59147909826", "value": 2745360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644136448, "uuid": "31ab4a3e-79c3-4b96-af60-0e6302a04c2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136448, "uuid": "610e0e3b-1b4f-4999-a045-826d2037c7dc", "value": "a1172c1d1ad6aeb11994493f08c56ceb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6259e0ae-8726-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644135947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135947, "uuid": "ab8ee360-a90e-4c67-b5a0-bb58a8905dd4", "comment": "Malware payload (RedLineStealer)", "value": "af817aad791628143019ffde530d0ef7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135947, "uuid": "0fd7aba4-a32c-4870-89e5-4a8c0990a744", "comment": "Malware payload (RedLineStealer)", "value": "b638538c670872163350a1cef199d388a65e3cce2694f868c0ddda13cf66d723", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135947, "uuid": "fe904f68-2464-4a47-a1ae-74274bd9f9b8", "comment": "Malware payload (RedLineStealer)", "value": "0d353454d6ad1c8e54490bb270c29407e807e62a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135947, "uuid": "3a8c3de7-dd01-4499-a089-f1d4530a2b0f", "comment": "Malware payload (RedLineStealer)", "value": "a376a1cff72125b041198b7e455b397588093e10a4df58029da5d2057f81154968edb15a4e07cd679e521b0d999913da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135947, "uuid": "e50e4daa-9948-4182-95cf-783292b11f59", "value": "T106C423A37B00A7E2F53526777D065D950F8BB873B1BA65DD3308B3364893021A62726F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135947, "uuid": "d0f4c9b4-ecd7-4716-a464-0c8ed3164457", "value": "cb839c236cd028c01bd7fd21b5a46597", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135947, "uuid": "65715861-f658-4659-b5fd-be96121540dd", "value": "12288:pPByYCyw4wf3WvAtM1/+kILoswlwRVJPBv2:pPUuMWvqM1/So5wnfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644135947, "uuid": "5ee27606-5df7-4ef4-b5ee-e7ecfb86d8f2", "value": 563920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644135947, "uuid": "d3257494-c28a-4ddf-bc72-3f1e65040c83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135947, "uuid": "bf7791cb-db82-4df0-82af-90474cce34ec", "value": "af817aad791628143019ffde530d0ef7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a54c50f-8726-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1644136040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136040, "uuid": "f31cbf21-c38f-401f-aac4-892387f3e581", "comment": "Malware payload (CoinMiner.XMRig)", "value": "a3cbfb7ffc4be9201530d97fd6b3d7e5", "object_relation": "md5", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136040, "uuid": "c879d894-f7e2-4fcd-b861-797baf70a764", "comment": "Malware payload (CoinMiner.XMRig)", "value": "b749b49e18893137d57693558f9a1a106fdb8c5af98968ff38149b91a27371c6", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136040, "uuid": "515874ab-f8db-4616-b38d-8868e277bebb", "comment": "Malware payload (CoinMiner.XMRig)", "value": "87433e57c1087e840ad1964f8ef0fa9375bae171", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136040, "uuid": "8697e168-b268-4d92-ad18-3c83c7e098dc", "comment": "Malware payload (CoinMiner.XMRig)", "value": "82e5b26f66b6828169cca887a29e0d4192b0ee486cae2d48fa974ebe030f6ccbe7c4adaefb0599b9a84d6bd9abaf20a6", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136040, "uuid": "0fae05ac-ad04-4b21-ad91-8893b67c4f2b", "value": "T14C34AE1136D0D372C4D72539496DCBE13ABBB83216B58D4B3BBA176E4F703E0922635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136040, "uuid": "b61f6e21-c800-4180-8fd8-714b83924a05", "value": "bb549f57f2afd62976d0e4074d762a0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136040, "uuid": "aa659e8f-9279-47a1-9347-03c2cd1d832f", "value": "3072:CVEoSn0XX3+v7LgfYpx83lVI5HdccQRTPBwlsJcQYZk6oN/DxENWVz5T:sEoSn0Xny7LHx84dqrBgsJU1a/DcO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644136040, "uuid": "a6af6502-b530-44f5-b26f-62ee387d1f7f", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644136040, "uuid": "942ad750-25f5-4d29-8a75-5081a1ec3330", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136040, "uuid": "cd6679bf-4296-4371-a79d-6a06c373dd82", "value": "a3cbfb7ffc4be9201530d97fd6b3d7e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab13b5fd-8726-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1644136069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136069, "uuid": "c7a0b6a2-b7f3-47d6-8376-8f5ca82e2f58", "comment": "Malware payload (NanoCore)", "value": "38556070421de051825e20375ffe769c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136069, "uuid": "8b8e7b39-38c9-44f3-9a2c-59f6be6d926b", "comment": "Malware payload (NanoCore)", "value": "b8b55d1819b829761a132990140ab01c3f0cc3a8db238f51a4cd9f96a2eea824", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136069, "uuid": "3d62b89f-fba0-4e50-821c-9caf4cdb3cb1", "comment": "Malware payload (NanoCore)", "value": "000dd4b6cc41cb62c85cb5bb60cb55333f0518f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136069, "uuid": "586af848-1cca-42f6-a451-bee9bbe51bdf", "comment": "Malware payload (NanoCore)", "value": "495abf28eb16d0e76b70e00402ceff45716595bd87c46e97662731a434d2ccb8703a565362cff4dc17d7f6b37001df1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136069, "uuid": "774d3425-99ca-41a9-a000-dd79d8ca9f46", "value": "T11C058CBC312075EEC9ABC431DB681DA8EE506C77930BA627901771AD996CA87CF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136069, "uuid": "3404dee8-9c77-45e4-9eff-0457bee4bd13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136069, "uuid": "b85dfccd-edc7-4170-bf3d-987d1ca879f0", "value": "24576:12r8bSQGgsuFiwZiqZ8Hfdebjl+mjARE:12rOhsyHEqZ8/IbpG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644136069, "uuid": "97259698-8518-4e4b-80d0-5d662ccbbfb3", "value": 835072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644136069, "uuid": "3c650778-3400-4c5f-a977-b09f908b4cfa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136069, "uuid": "e4d97c19-aeed-4be2-872d-4be244f342c0", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c6b3179-86e0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644105818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105818, "uuid": "52bdf77f-64f9-463f-9368-091b40395ab3", "comment": "Malware payload (Heodo)", "value": "66b6c0d717f87b935a7a3b5500f6c278", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105818, "uuid": "16b87795-032e-4384-ac66-728e9524017a", "comment": "Malware payload (Heodo)", "value": "bbdc1489d7d512d88b7c85ac32c3e37ab35d270ec887de2c95c7cc5459b01e1c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105818, "uuid": "1d50dbe5-ce23-421b-b182-e4f5886a51d7", "comment": "Malware payload (Heodo)", "value": "1ceee4901d3b3183d123b9094a435bf61f007b06", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105818, "uuid": "7de31f00-97da-4743-8dc6-98402e766e24", "comment": "Malware payload (Heodo)", "value": "a88178ff8b4571d7e171f107d198c0186eb96785bfbcae1c91a5f41306ad2c8eea5bd821d214447cab7e7c357627f1d8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105818, "uuid": "cbcbb6d1-4cae-48db-9149-612bec97eb78", "value": "T18B25AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105818, "uuid": "76ba11d3-9c6a-4da8-8930-4d4196ab6c55", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105818, "uuid": "7a0f2d2e-33d7-4835-b056-87e0784eda9d", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYx2fFIIm2m42:1ZsYB7vLsnZI1Hb9DNFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644105818, "uuid": "89ecfdf1-f7ab-4688-be20-7ccc62d13a3d", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644105818, "uuid": "0804af08-66ca-4ec3-ba7a-232ef14c23f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105818, "uuid": "0f777048-4199-43c1-8f09-a98ccf63777c", "value": "emotet_exe_e4_bbdc1489d7d512d88b7c85ac32c3e37ab35d270ec887de2c95c7cc5459b01e1c_2022-02-06__000334.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c39696b-8778-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644171182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644171182, "uuid": "a2201969-2338-47b1-aee2-375aad284302", "comment": "Malware payload (AgentTesla)", "value": "3c85eb615385165fd66c003ac8629119", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644171182, "uuid": "c64a3c78-ab07-43a0-a7e3-4d5b41c3729b", "comment": "Malware payload (AgentTesla)", "value": "bcd3972b37a369ef74a40ad364b7cef4cec678b7496f3f1a275ba6a1279aa9d0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644171182, "uuid": "1e4c0efa-8c42-44ff-bf73-ba771a4e2e50", "comment": "Malware payload (AgentTesla)", "value": "d32a2936f1bff9acd5fa60323bc9eb35fabccdb7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644171182, "uuid": "50dc62db-e200-4b51-8285-4166b8db9a7d", "comment": "Malware payload (AgentTesla)", "value": "5996f86de6091a1161f6c0a72dd4f849ae23b32146352ff1995a9514fbd5cc20a49e8fa95cc89cf4887b580f40956f26", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644171182, "uuid": "31f7c843-aedf-4175-aa3d-71d340f7a1e3", "value": "T1A0B423EE3D606381774E344D85D52ADC321BB222707FE785BA2C53FA6568531C4B6E38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644171182, "uuid": "b84e5635-de77-4f4e-a41f-d8c2755e154c", "value": "12288:AlqLyEWcpC7QeegN+NPQCuSY5V8JAqytrcA7v4+1KJ:rLkIkJN+NPESYwetrbJYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644171182, "uuid": "48fe4af7-c4c3-44a9-8035-d05e95c7715b", "value": 501402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644171182, "uuid": "8ceed1d5-429f-4fdf-8c12-1604b935c388", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644171182, "uuid": "292133de-a8cc-40c1-a1e9-dd9b36a7cb25", "value": "invoices.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c804642a-8726-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644136117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136117, "uuid": "4d95fb7e-ae63-4b59-a1bd-cefecedbfa2c", "comment": "Malware payload (RedLineStealer)", "value": "aaa6235ca133050ce567a123af940272", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136117, "uuid": "d7e791eb-96d3-42ba-9e58-ef6819ef4db6", "comment": "Malware payload (RedLineStealer)", "value": "bdb945c486492aebb1c4706926770813cbcd3d7f6f3e1e8baed113bd88da4bc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136117, "uuid": "b1706169-8974-4dd3-8220-a3a876c5c8b5", "comment": "Malware payload (RedLineStealer)", "value": "7203ff3b300cf2949e43bb428069e6569706e8be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136117, "uuid": "4908ca3b-e205-4215-80be-dbb2cf12e9f2", "comment": "Malware payload (RedLineStealer)", "value": "e7f8a0b1b138aee931491072511cd0f08b0000cb037d1fd8f6cc425d361456d28f5cd47ffb3b303fb8188fb2aded81a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136117, "uuid": "aad39268-50a7-4017-8ba6-105b66c36fad", "value": "T1E4B4A33839FB5019F2B3AF76DBD87996DB6EF6732A07E41D204103864A13B42DD8153A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136117, "uuid": "5302cb5a-53b2-4e13-ac8e-9eed40dff581", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136117, "uuid": "411ac71d-04fc-4f35-9b40-dae0bf67b330", "value": "12288:tZPeE7ewz8TxfzqCOsjekgNBZvPoI8w3:tkUAvCHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644136117, "uuid": "a63be077-992f-46dc-a260-5d26f2c6b4bf", "value": 501760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644136117, "uuid": "1d7f7b24-f2e9-4536-b792-07af0e88a9ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136117, "uuid": "de117fe5-08ce-4846-b4d9-83b728f4425a", "value": "aaa6235ca133050ce567a123af940272.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c2964df-8729-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1644137171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644137171, "uuid": "cabe674f-d5e6-435d-9754-a1bc84292c3e", "comment": "Malware payload (RemcosRAT)", "value": "a44ebd5bad064c6e12dde25f943e8455", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644137171, "uuid": "b1ff9349-8b50-47ac-9c3e-5531f9289270", "comment": "Malware payload (RemcosRAT)", "value": "be4c31c9068c0b668963f0bfebc8fae269f7955862caf2680f23e21a22924ccb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644137171, "uuid": "a9319762-824d-4dfb-9a5d-887fc4ca711f", "comment": "Malware payload (RemcosRAT)", "value": "8fc824bf928bb7c031bcd244ce02c77ad7ad39cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644137171, "uuid": "ab5ce8c6-55fe-4ca2-baa8-f4492ec93210", "comment": "Malware payload (RemcosRAT)", "value": "55c5fc0489d256f43b02383c2d90b9d4fd2462cf487090b0fe77d872db8bd2918dc7e0ce71f32534a2395f1f6f1b7839", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644137171, "uuid": "64f30a62-f2fd-44ad-9f98-1a42feee2c05", "value": "T1B9D4CF132B9485CAE5A2CFF18E3559939FE789631C13EA0A1FE834B70D35B9A8D35D01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644137171, "uuid": "d9de4f92-5309-454c-a22b-914e85fd8637", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644137171, "uuid": "9e3d4392-87ca-4364-abb8-f81adf43aeff", "value": "12288:rC9+bNvJ8R4E/JGZz/rGHPgzE1oISHz9:rJbNvJe7IZ33V/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644137171, "uuid": "977209b8-38d5-42f9-8227-d8f2f3cac2d9", "value": 617472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644137171, "uuid": "f0bcb83e-2f6e-4d0b-b79c-7a113e244272", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644137171, "uuid": "e2be6e5f-5e37-4084-a62b-0bc547e08b46", "value": "Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa01721-8726-11ec-9275-42010a9c0029", "comment": "Malware payload (NetWire)", "timestamp": 1644135861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135861, "uuid": "84377fcf-dd37-4cd6-b83f-154227fc20cb", "comment": "Malware payload (NetWire)", "value": "81aabb6f9db36c97ee14faaefa9393b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135861, "uuid": "9198d8da-f261-425d-8694-5689fb897420", "comment": "Malware payload (NetWire)", "value": "bffd7ff53ce71a47f2b7b769b3a8819f678afe4f62e2737b08d72eb568a795d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135861, "uuid": "98b009cd-b701-4dee-a2b6-a37fe0f47115", "comment": "Malware payload (NetWire)", "value": "b90700fbd8340f90502860e8f881b92cc57ea7c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135861, "uuid": "4cbfd5e5-42c6-44b8-b3af-15dcb7aec5f0", "comment": "Malware payload (NetWire)", "value": "00be63fb10ceff8fa71c90da839f3f2d55576710ab96bd6fe4d8b711ffe1b7e4174b0bd1884725b05f9cf937ffbc8af0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135861, "uuid": "5d54d840-9bd9-4649-b4e2-363c8aec1ee5", "value": "T11B5412613270A07AE9334B31687E4B660FB66D258E7559471380FC6FBC73BD2690D32A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135861, "uuid": "abce9db5-38cb-4ea2-8639-45935c7888b0", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135861, "uuid": "442acee2-3182-46ac-82cd-a0846e7d80a2", "value": "6144:IbE/HUnJ8iw5oL8gNvFou1nj58N3qTHW/Jp1yB8YqQrKdKKc+aOh:Ib7J7moLFoud5mp1MTqQrKdKKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644135861, "uuid": "4faa99de-05ec-4ab8-b60c-676101a54c9c", "value": 300184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644135861, "uuid": "ca82ccd0-900b-4c8e-9aa5-182c4c3fe008", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135861, "uuid": "ab6dbfe0-9b6d-4557-8467-016bad6de5da", "value": "bffd7ff53ce71a47f2b7b769b3a8819f678afe4f62e27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea47e1b-8730-11ec-9275-42010a9c0029", "comment": "Malware payload (Stop)", "timestamp": 1644140182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644140182, "uuid": "653c3aad-ec81-4d1f-a0a4-29ae94d722a6", "comment": "Malware payload (Stop)", "value": "69af4dbdcba8da2e24fa0eca0db7d656", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644140182, "uuid": "0316345e-6363-4d90-a40b-dae7b2eba466", "comment": "Malware payload (Stop)", "value": "c0b3a63304ff9fc71934e14bcdd6d6e30b5e40095f5d4723b47d7f73729c58e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644140182, "uuid": "d708064b-9e3a-4e61-98a3-bd06a62f0982", "comment": "Malware payload (Stop)", "value": "7138c637f8719774325ee8b1b6ddd3f1f8f00888", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644140182, "uuid": "2af4e67b-a341-4b08-ba8e-ccec5fd5f15a", "comment": "Malware payload (Stop)", "value": "3476d4a37cb67d53ffb818aa059a70f82ce29629c3c1bac509decf3d6134e85890e3d6524421919a2bdc0589d8bc4ddb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644140182, "uuid": "9e79f906-3688-4910-a017-a4863b6f8aa4", "value": "T107050100ABE0D034F1B752F8593693ACB53E7AB19B6091CB63D557EA06346E1EC3235B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644140182, "uuid": "eb0d6087-bb9a-42ef-abee-8d6fdcc71ffb", "value": "1a3cf179d845c62d49a765b8e54e41fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644140182, "uuid": "a77900aa-9167-4fb0-a67f-350a88313333", "value": "12288:cz09401GyC5n6yLT+98zXdS+DuUWzNCBYB5WM9Rf9jwHSo4IPXSBcFtZcO:ALy0nZLTXztH9WzNRnBwHS8/qKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644140182, "uuid": "99fe643f-d7c4-4fe1-a00c-1b2dd9889d59", "value": 805888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644140182, "uuid": "465d05c1-e22b-438d-af04-e509b8bfba7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644140182, "uuid": "c98c0e47-539c-4adc-a80d-bb4a88c85ca9", "value": "69af4dbdcba8da2e24fa0eca0db7d656.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc5d76cd-872c-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644138701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644138701, "uuid": "1d81707f-d6fc-4a98-859c-2e9b8c7ae69c", "comment": "Malware payload (Formbook)", "value": "cba00ccbd21ddde7f5df576783f6b783", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644138701, "uuid": "f7197ba2-fdc8-491e-973a-5b787a55ba90", "comment": "Malware payload (Formbook)", "value": "c0de6ddf3f58ec526f3c55003f073b4fc1413c3097dda51fe477c426f68d2eb2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644138701, "uuid": "7b162079-aec8-4f3b-af78-0fa7e865e341", "comment": "Malware payload (Formbook)", "value": "eac4da265a1559a9aa01a91d5e40734627673f9b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644138701, "uuid": "4f9e944b-0bf0-465c-ae2a-71d192bf5349", "comment": "Malware payload (Formbook)", "value": "1d1ef812fd58c6cde3626286644586cb7689ab90dbfe5120325d6b962a48125fb0ec978730f1c1cfa3ca9cd7bcdae953", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644138701, "uuid": "4e9314f1-0fe9-42b3-8dce-8c35f60249f1", "value": "T18B742307609ADBD04013A7AEE7F185C293D35EC52E2AD5492B1998D67F900CDCEACF23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644138701, "uuid": "def162d8-881d-4962-bc52-5d69c40d9bd8", "value": "6144:xd9u5XAyu4U9fUCCZIxCN7ExyMBLfkZDp/EuxJjsDdDgun:b85wHvtwIxyycLlol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644138701, "uuid": "96390993-587a-4872-a84e-3c943a79ba4c", "value": 366582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644138701, "uuid": "a23ff55d-c7dd-4ecc-b2b6-35d7947fd537", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644138701, "uuid": "6aa219c1-cc79-4231-9946-e8567389b016", "value": "1644066365.Vfc11Ibb909dM911048.dynamene_boleto de pagamento.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6f06939-8726-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644136142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136142, "uuid": "38be7c70-0a15-4a30-a59f-f72bb13abe5b", "comment": "Malware payload (Loki)", "value": "311b4de7e6c1a21fbd1d4986b64968f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136142, "uuid": "2164e389-aa95-40cf-b1d9-e435b420b525", "comment": "Malware payload (Loki)", "value": "c1040895515f5e908812f52bd9eea004303961f4e53c1c887583ff152d5bfd3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136142, "uuid": "10324d92-057f-488e-8129-f4eff359c349", "comment": "Malware payload (Loki)", "value": "ca753366cdc83e6b12f8162d149849b83190c992", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136142, "uuid": "91c2a0ba-a4e9-429c-a131-0fb133dd63a5", "comment": "Malware payload (Loki)", "value": "734cc29ea2fd65181052789c9af3fb8f21200e6fc7b4a827e3e461e54dce8512d1ee027b64d76742ed82000a62a6077b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136142, "uuid": "18067bfd-a91a-4dbf-9f15-0e3f96313b1b", "value": "T14194BE9075B84FE1E47D9FF8252DB8A007F4316F98D6E91E4ED861C56AA4F022E44E0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136142, "uuid": "a811b9d2-5b11-4edd-aa5f-ccec21756392", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136142, "uuid": "d7585c44-3fbd-4e7d-b9a1-5495ea5f6df6", "value": "6144:qnlZFHUVoI94w7KL5hU+TKY16faN06wz1m2uesu7yTa:qWVodv5UY1iFRm2u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644136142, "uuid": "59f18346-456e-486f-b8da-39a2674ab090", "value": 430080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644136142, "uuid": "473a975f-d964-49c7-92d2-6d4f22d0cf71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136142, "uuid": "a3f30766-d6d8-46e8-aacd-900b397b1b58", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f398bb6a-8726-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644136190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136190, "uuid": "debfa3c8-9ea6-4aaa-8cb9-7c24dc7c0fb1", "comment": "Malware payload (Loki)", "value": "095609bb3bf19571dcf6d9e5967cf1d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136190, "uuid": "2841d209-9aa2-4180-a5ea-f04cb37531d4", "comment": "Malware payload (Loki)", "value": "c5fc4b85610131a73ed687423dfb23363d187e19a3fa9d7a2f2b8d73478e085b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136190, "uuid": "7666d9f3-df1e-49e8-9edf-b232e41cc40d", "comment": "Malware payload (Loki)", "value": "9fcb123b28221710ea8f664221f4418c18d39a07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136190, "uuid": "4e633f13-4de0-45c0-beea-bb622797b80f", "comment": "Malware payload (Loki)", "value": "426f35c3ae0ad49e22fd7819b3498c90f8c6cf70d3ed0de9c903ab121f521dd4205c924d22ae2fa003fa13647328a8a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136190, "uuid": "f9aec38c-8845-4014-b379-afe8c15261bc", "value": "T13294D0A5F6975691F52BDA312135B81106763ED3AEC6DB081728F2080FB37A04F76A4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136190, "uuid": "79d13ff8-2eaf-4285-9093-a3a087cd6378", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136190, "uuid": "c3d84579-c8f1-4ede-8afd-2cd4d6c57472", "value": "12288:Zd7p3c9J9Y+t5naapiGNjOiyostFcO7YUOJ:m9J9QaYGBONcQY3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644136190, "uuid": "3f9995c6-4985-4c56-8c88-a3afc7a7d79f", "value": 443904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644136190, "uuid": "a6b44de0-f924-411c-b55a-c0271e20f0d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136190, "uuid": "ce25f2d7-d2bc-4e58-ba68-e8253c86e9d0", "value": "wNDTao1piBFLlHP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "456b9eb6-86e0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644105833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105833, "uuid": "f4fde59d-812c-4e14-bd71-6d125914ae88", "comment": "Malware payload (Heodo)", "value": "d0e1c875bc6e74e859952a1cf9aad470", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105833, "uuid": "33d6eefb-654d-43a3-9cb3-bde7281076de", "comment": "Malware payload (Heodo)", "value": "c9d5d893e0dff8b63efab77eaca699f35aa73d1b8efafaa5a4481a05a04a0c40", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105833, "uuid": "752c8826-feb5-4de3-b1d8-249c2fa1ff55", "comment": "Malware payload (Heodo)", "value": "683e9dde000aa4ca60f59f2fdfc3e7bc50b8637f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105833, "uuid": "bedb5f5c-ffe3-42c0-a081-b35845224abb", "comment": "Malware payload (Heodo)", "value": "be0763098c81cba200c00aea0ec93d33c60dae277dfa6191a7d1c7a61d78262d58299987c89d95e19a686737c3778f98", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105833, "uuid": "60f1201d-4ec2-42c9-9029-be16b74a32db", "value": "T1D435AD50A98984A1F687153900A6E3744FEE6D0107E0DCDFDFC8FCA77A26CC2967919E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105833, "uuid": "20928926-05bb-4b57-94ba-1461dc4046bc", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105833, "uuid": "26b1b0f2-ba54-401b-a0ca-d68faf589e92", "value": "24576:w/Tzzj1GVsPuJ7He7cSWImvxmWff7TFrrFf6O+li+w1ABdQvTwFIIm2m40:wfv1GVFF+765nFvFf6dlzzS0FIr2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644105833, "uuid": "7d932e0d-c850-4a0c-9621-628bde05ce0e", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644105833, "uuid": "bba60efe-d7f2-46d1-a6cf-94ebd8b7be9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105833, "uuid": "b5bfe5f1-77e5-4ca4-a076-e3e39d8d3d24", "value": "emotet_exe_e5_c9d5d893e0dff8b63efab77eaca699f35aa73d1b8efafaa5a4481a05a04a0c40_2022-02-06__000348.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ab442a7-86e0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644105815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105815, "uuid": "0718e661-0a39-4d2a-94ee-6fd0c562f920", "comment": "Malware payload (Heodo)", "value": "776e13e5e55b5c723e2a3a9df3e92742", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105815, "uuid": "bb0ca5ab-3db3-49b5-a068-e918722d251e", "comment": "Malware payload (Heodo)", "value": "cbafdb36e6bbba89a66b0e906f60f332c33683d9a4094385763f947f0b82cdb0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105815, "uuid": "8d2af9fb-6a02-4387-bbdd-114720cae883", "comment": "Malware payload (Heodo)", "value": "f6c0b4542edfb79baac87b28d6e7f92b3e3f6c76", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105815, "uuid": "1dc8a048-95b9-4112-80b5-ce82c00a7a08", "comment": "Malware payload (Heodo)", "value": "cd237035d60bd98739b4a7a8be563c8c87a974f3e15e98f03236536aa162a3dd39615a2e59bd1b024fe984603f896a54", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105815, "uuid": "1689650c-6827-4aed-acee-a4ef594a12f6", "value": "T19E25AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105815, "uuid": "771b9622-4094-44cc-90f1-aef47e3fd1fe", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105815, "uuid": "a0447208-5b83-4aa1-a74f-159fd83623fa", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxtfFIIm2m42:1ZsYB7vLsnZI1Hb9DIFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644105815, "uuid": "376681d4-d3fb-43fe-9800-3ab939790bbc", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644105815, "uuid": "676a5d6e-65ac-4a3c-bf55-ac15ba8e20f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105815, "uuid": "1063d23a-9232-4a92-984f-082b4d6de204", "value": "emotet_exe_e4_cbafdb36e6bbba89a66b0e906f60f332c33683d9a4094385763f947f0b82cdb0_2022-02-06__000331.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4285dec7-8726-11ec-9275-42010a9c0029", "comment": "Malware payload (Stop)", "timestamp": 1644135893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135893, "uuid": "93704ae3-c101-47c7-b131-8e98f6f3e964", "comment": "Malware payload (Stop)", "value": "a40f08171a299434ee7871f1ba0467ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135893, "uuid": "0cb4448a-1819-45e4-9a29-118d0257b884", "comment": "Malware payload (Stop)", "value": "cc16ec8062a3ed597edf121dc8e74170c70dc50159a70604f9e6f4256974c396", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135893, "uuid": "3177cacb-ee7b-4702-95e9-8720cfd1e85f", "comment": "Malware payload (Stop)", "value": "b02f891c8124f06f347947f95d831c7683ee6781", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135893, "uuid": "fa1dfc50-d0c2-4ae7-a7d0-8a7b2c89341a", "comment": "Malware payload (Stop)", "value": "9f10922c343e164f1ab679598b5772a07b9757f2c5a66ac6e6b612e9b69a0b244bd55f8e1db67f6d295bbd443b7e75ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135893, "uuid": "095a5b9b-aa16-40b9-9a2d-52471587bd83", "value": "T192050200AA90D035E1B76AF4057AA369A93F7EA2672460CF53D47AFD46743E4EC3134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135893, "uuid": "a855b0b9-5175-4f39-bb43-4a20a13f5319", "value": "6f6aeb6fc382a28ed1adc7823a20786d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135893, "uuid": "3f8a7d72-a068-49d1-989f-7d9ca928cb83", "value": "24576:hWQWntWyoYnCW5qNs+d0KbyG4mCrkRVX38ocn:hWd/qvKKbx4m2kRdsoa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644135893, "uuid": "543d647b-fdf7-4436-9aa7-08052c414afe", "value": 848896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644135893, "uuid": "c2dfb449-3dca-4f8b-87d4-1cc488f7ca81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135893, "uuid": "91e7885e-efb3-4c17-8981-e7970f14682b", "value": "a40f08171a299434ee7871f1ba0467ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "974f9b63-8726-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644136035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136035, "uuid": "e2d050d9-c3ec-4483-8956-21d3b85fddc6", "comment": "Malware payload (Loki)", "value": "c49df28c6a12a83f161d9b93d9565e56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136035, "uuid": "8df92d47-d247-4e5f-bf6f-09a6de4eadbb", "comment": "Malware payload (Loki)", "value": "cdc7a28f5bfae148bc0317f4bc0614df9744614a79c758d29f4f154f73712063", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136035, "uuid": "8e4dec3b-325c-4a5d-8e64-f05144306916", "comment": "Malware payload (Loki)", "value": "7bc4c4833b35084faa1686520258ab2a7e27cc8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136035, "uuid": "83a98632-1bc3-485f-add7-e187e9dd7430", "comment": "Malware payload (Loki)", "value": "bed1a2e229a18864cc0abec0d8229bf4e0db1a3afff4f5c4eb55241da45e842cde5b9705f315f6966d69ac2092989cbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136035, "uuid": "6222f8e1-55dd-4854-af26-60c3b17f70b6", "value": "T13DA4D0A1F6975691F46ADA32217ABC4103773EE3AEC5DA141324F2080FF37505E7AA4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136035, "uuid": "e683d36c-4175-420c-827a-2628725fb5a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136035, "uuid": "cba95ed0-914a-450b-8375-86813439c74b", "value": "12288:P/7p3h6jJF7yYbNLYMwjELbS0kZB+33KnJ:qjJFxBLYM6GbqZBxnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644136035, "uuid": "315601a6-7bbf-4b77-ba93-dbb2aa5cab23", "value": 451072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644136035, "uuid": "80a7b799-f59a-4a6b-a065-9d6908fa1b5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136035, "uuid": "07b791d6-eb74-401b-bfaf-75df5dab08ff", "value": "c49df28c6a12a83f161d9b93d9565e56.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "454cbdbe-8773-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1644168969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644168969, "uuid": "a652848f-20eb-4d48-a82a-af948e70f802", "comment": "Malware payload (njrat)", "value": "3222144e0d006d838de78777c121d977", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644168969, "uuid": "4e0695f5-2f25-4bf6-a981-910ce9c57362", "comment": "Malware payload (njrat)", "value": "cf0f62c6105ceec3db23af296678feed3ea95d14ff032223d5397c7351cfc9e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644168969, "uuid": "75db2a17-6f2a-49ee-8a9d-008c204d6ead", "comment": "Malware payload (njrat)", "value": "ca3e9697d6e4fb220cc85c7bbe9622634a3e90d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644168969, "uuid": "9c6c73f6-d00d-47ab-9920-e52442c9d9f4", "comment": "Malware payload (njrat)", "value": "22c27af2b48db2fe91eaaf11be1b89b742b3829370aedee4b232b2086eea61f672e8da1eabf6552ae0d8d47439be5f25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644168969, "uuid": "084eb93d-5a10-4872-9f67-f320172b227c", "value": "T18FB4280AFD84EC1AF6200A3845ECF77850EE39E0EA327D8946BD1C5CA6735506E5D7E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644168969, "uuid": "c61e922c-460e-4af0-9621-d5d674d4f17f", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644168969, "uuid": "ea57d202-357a-4d13-a007-0505508d8f62", "value": "6144:J8JsLcpjzTDDmHayakLkrb4NSarQW08R8q2IdY6YZXv0TtVPmf4Cz:WzxzTDWikLSb4NS7V8R8OAZXv0nmfbz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644168969, "uuid": "b38d8226-4545-4c52-88fd-bac187ce89a8", "value": 494878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644168969, "uuid": "eb7b3f80-d7c2-49af-943c-d381535e85ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644168969, "uuid": "80c88074-f060-4715-bfbf-99d0fc2d9ce9", "value": "3222144e0d006d838de78777c121d977.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72f7ff9b-8768-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644164321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644164321, "uuid": "a533d473-c8df-466b-9c63-a76069abe2bb", "comment": "Malware payload (AgentTesla)", "value": "a9b7afea724255c15d061c4ae57a1c18", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644164321, "uuid": "fbce30e8-6a95-43a8-9c71-1b1a613b193a", "comment": "Malware payload (AgentTesla)", "value": "d11b632d2afd581303f5213dc2a49d6d3aa29ca2da6c2c2bed67a7f9ea1f50ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644164321, "uuid": "5de37086-112a-4b97-803d-c943b349117e", "comment": "Malware payload (AgentTesla)", "value": "6aa15525ba7cbb9f9b3bedd46d16993383a985c8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644164321, "uuid": "bb4fb448-852c-4f91-9cbf-4a2b7bdaabbc", "comment": "Malware payload (AgentTesla)", "value": "d25c1c858fdd0363eb8fc1bccd6615170d7ce3302b96268360875aad95dc5b04c0aaf778ae7db6ab4605f91fefc79e17", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644164321, "uuid": "d3ab3e35-b893-455e-8f1f-f9de726b758f", "value": "T1BDB4AEB4A1AB8590F10B897425BCFD6402B235E3E9C50D39277A3645CBEEF543F8960E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644164321, "uuid": "862876d5-fa43-4515-9a91-feaeba94a24a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644164321, "uuid": "3289769b-0486-415d-9682-e1395ae2b153", "value": "12288:GVO7JBTZWNXBZz/E8328/WQ1QKyN/FYBn:GVOVPqXX7E8G8/WEcN/FU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644164321, "uuid": "940b9b01-e048-4648-bfdc-b432e853697a", "value": 519168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644164321, "uuid": "804216e7-e10b-4175-8aa5-73608b250e45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644164321, "uuid": "40c1d987-e406-4bb2-99ee-358b78e0b530", "value": "a9b7afea724255c15d061c4ae57a1c18.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ebc3d9d-86e8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644109204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644109204, "uuid": "09ce8a26-c394-4b1d-ab78-08727cf3ecda", "comment": "Malware payload", "value": "798355ff1f4e57e414151f552fa5f547", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644109204, "uuid": "ba0c99f6-cf2e-4dfd-a3a5-76a73f3f6f69", "comment": "Malware payload", "value": "d1d841bac1de129b031440884a1340a706977e8017ffa3d8663018d9b592d8ee", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644109204, "uuid": "000dd70d-d54e-407e-a298-ac85946e7721", "comment": "Malware payload", "value": "bd116d222c278246a717b7f70ae8ac67868c43fd", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644109204, "uuid": "b2d83950-4bbd-4fd5-8e4d-0c9a4a9678b8", "comment": "Malware payload", "value": "91b1c34a4ba6b9d38c34dd90df8f5c9c3e02037df6102b1bcf20116b52c17276806a7363ee7c777b6adb56edf5955cd7", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644109204, "uuid": "6c18af17-cbbd-4f16-99fc-a3f7407e1a0c", "value": "T137F533399D3B68D7903E2616941A83F392217DEE1C28F415E3FE56DD304E5F4A8C1AB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644109204, "uuid": "89b4f9b5-9d19-414a-afdc-cd9a8c481280", "value": "98304:DJmAJI9M9yZqQEmKlqi7REM+mvb2TEKR7O4gLtubex6E6H7YcpKdCL:R4FEQETHt3/b2TdR7Xgqo6F3pKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644109204, "uuid": "541a72b8-8132-435e-aabf-5340953d7574", "value": 3567616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644109204, "uuid": "e8313566-b215-4f63-b601-8e687d374306", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644109204, "uuid": "07665ed5-fe11-46ca-ab59-054011699385", "value": "d1d841bac1de129b031440884a1340a706977e8017ffa3d8663018d9b592d8ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18838c38-873c-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644145272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644145272, "uuid": "b62b567c-aca4-4f9a-897f-a1f98693838a", "comment": "Malware payload (RedLineStealer)", "value": "cb5661771bdcac40d0f9359eab882ffa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644145272, "uuid": "58aef72d-c24c-471b-81fd-2bb3dfcbf057", "comment": "Malware payload (RedLineStealer)", "value": "d2d0690651be391bb60affcb094efc79b3aafae8587103eed4595717191d981f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644145272, "uuid": "df369c5c-3038-4b48-9e75-5e9a63576690", "comment": "Malware payload (RedLineStealer)", "value": "6fa1f2df0d4a30bdbdea28be78fa3af28d09943d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644145272, "uuid": "1170337b-884c-4d2a-9d9d-2f8fdfc04a22", "comment": "Malware payload (RedLineStealer)", "value": "4bdd5c4d69c6d88e67fdf1e930ebc8253206de60cfba992914ca0fa2a267b9aad7cc3c40cfced42bbe8bcf5097a76b32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644145272, "uuid": "65c42242-f22b-4028-ba6f-d9d902dcac4e", "value": "T15A44AE10BBA0C035F1B711F8497A936DB52E7AB16B2490CB63D52AEE16357E1EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644145272, "uuid": "681050c9-406c-4669-b4ad-84073ff236be", "value": "f582438c21380e695ebb7c6afe726d96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644145272, "uuid": "c61971c9-2a44-4405-88da-721d7c8777f5", "value": "6144:lFQ3HU110agjdSGzaYnmfp7JEhItOj/LjRZ:lb110RUGzazp7JEhItM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644145272, "uuid": "a39f8069-d6ea-4dc7-b7af-37f23a118a93", "value": 273920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644145272, "uuid": "a8c45e08-a511-4bf8-b8bb-6a915cf65c09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644145272, "uuid": "4ed2b923-158a-49c1-803b-31a871c878c6", "value": "cb5661771bdcac40d0f9359eab882ffa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "142d66b7-8783-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644175759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644175759, "uuid": "fc3270fd-278b-418b-a242-44c885835dc0", "comment": "Malware payload (Mirai)", "value": "86b00f278462ab80a580ffc33c096c99", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644175759, "uuid": "5005ff66-8623-4d9d-93b7-2863c23f06a8", "comment": "Malware payload (Mirai)", "value": "d47ace60070e7629b0d4306633f645dfe40b14c8ac7f16cd567c1a7cc5ac229c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644175759, "uuid": "a70d31a9-1966-482a-b787-e1cb60e511f0", "comment": "Malware payload (Mirai)", "value": "fdc9287e5a45c323bef39a242e400b78d7f0e002", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644175759, "uuid": "aea65bf8-e46d-4ea2-a4fd-f77fe4fc4cb9", "comment": "Malware payload (Mirai)", "value": "a7e7cc0f5ea547f4c526ceed5299e80195175334a82006e27db5495e55167d068fa683d8e69ed9057c92664903bd831d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644175759, "uuid": "95ce646c-7fa7-4c58-b5c4-d313d681af9f", "value": "T1D1333C86B801BE7CF95FE6BB4533490D7920B2559183072377BBFD936C322A89A12D52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644175759, "uuid": "683f82c1-9272-4251-9f4c-d640535a86e7", "value": "768:ckeCohkvsBVTN2unCq0OHqBsqwip9EhOtMnE4v+b9SQQcdeEnF7968ria5hz:vfokq08i/Eh4I7vRQQcdrF7g82aD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644175759, "uuid": "aad20f00-4d3c-4a3d-9d36-9f403feecaf7", "value": 52272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644175759, "uuid": "bb3ad3f0-4488-4482-9819-82ac9d5e66d2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644175759, "uuid": "b6170aac-e9a2-4ded-a0e8-ac8f8307298a", "value": "86b00f278462ab80a580ffc33c096c99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6e2832f-8726-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1644136062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136062, "uuid": "acc5c5ee-ecd8-47c5-9c50-f2cc9f1766df", "comment": "Malware payload (NanoCore)", "value": "0f0f43e085654678d81e26956f76695c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136062, "uuid": "8905a05f-4dca-42bd-a5aa-4e85a43d60d4", "comment": "Malware payload (NanoCore)", "value": "d7b4a60369883476a00b0dc1c06de9ea2c7982da306284dc483c270518fa4707", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136062, "uuid": "25082598-0fc6-4190-be85-90340b62313c", "comment": "Malware payload (NanoCore)", "value": "14eea13ca4749acb714713a25a654a4722d5ed1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136062, "uuid": "340a195e-9d31-42e6-a956-9dc6cb7e8f6f", "comment": "Malware payload (NanoCore)", "value": "2c211a2d36d86a1415c9284aecd0d528c95ec8aa3c850ef247d932268195c332b8ee5e11625a4af36071a08bec92f092", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136062, "uuid": "7eaf4a8b-75aa-4bf5-bf2f-a9c21f634051", "value": "T1D6D4CE7A313A4F52DA7FEB392324D2391FE4AD31E353F62D2CE871990472A454E72912", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136062, "uuid": "a19ab988-4b61-4663-842d-862e5cd27fb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136062, "uuid": "dab86d65-b4d2-47a3-a952-9b344beb4544", "value": "12288:7jApdfaTntwptIrg5DCTQG0Xqxn7Zmrm9b4L:7jA7faTStTw8G0gn7lEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644136062, "uuid": "7edd099d-4974-4417-a6d1-0d9e7a2a43c8", "value": 641536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644136062, "uuid": "826661f5-41ba-4b0e-8294-0a2725bd1cbd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136062, "uuid": "f3ad419a-bccc-421b-90fd-102f165c1b39", "value": "Contract Business.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9091d31e-877c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644172961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644172961, "uuid": "b682fa1e-39e2-4bf2-b5d7-b240a500fac6", "comment": "Malware payload (Heodo)", "value": "8b5066d5bd95a2e584e04397dee2ac6b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644172961, "uuid": "8e1af2b8-ed53-4a93-92cd-fb03d077a323", "comment": "Malware payload (Heodo)", "value": "d8983719cfc2713bf3464d35cba05ca88b38b82e6bc4dde6963a262c4f4f3db0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644172961, "uuid": "f4f44313-2ac2-4417-964d-45d050ec38a0", "comment": "Malware payload (Heodo)", "value": "9ea28a94c79e683f11a936456beabb5ebada165b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644172961, "uuid": "a6d62612-2da3-4344-9638-fbb5d5db0f49", "comment": "Malware payload (Heodo)", "value": "56737ea6a49d0209c32e270137b1f1db105537c889a7b98fe5fc363c37d907ee77a26b407e5176e82a5ccfa7fe5c3a5d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644172961, "uuid": "4f9587c7-da8d-4d3c-ae62-e9bafffb8bce", "value": "T1C325CF51AD4A8096FA4B293E007A63648FECA81107E5E8DFCF44F9A76F21CD1973C45E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644172961, "uuid": "0babbbd3-04bf-4e3e-b74b-8af091042034", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644172961, "uuid": "87818c80-7517-437b-9126-58f93aa9b934", "value": "24576:eLTJyoT2k8nRahk1AFnkRCLWctN4DBE1ZekTyPyFIIm2mHv:exyq2kpWGWRCLWeNWO1tyaFIr2mP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644172961, "uuid": "1bfc9f69-e720-4326-bfbd-e3eeddab2260", "value": 989184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644172961, "uuid": "f8a521e2-5df6-465e-b333-68e20c973f14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644172961, "uuid": "6ef024ac-4c0f-40cd-8f6a-a04ec6873762", "value": "emotet_exe_e5_d8983719cfc2713bf3464d35cba05ca88b38b82e6bc4dde6963a262c4f4f3db0_2022-02-06__184236.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6574affa-8727-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644136381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136381, "uuid": "7a56c494-d00c-48d9-b1a6-a058e311af0e", "comment": "Malware payload", "value": "b216e3369dd13ae12e7bb0f87c53c785", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136381, "uuid": "166989fa-dd40-4c3b-98f2-b2d7207ffedc", "comment": "Malware payload", "value": "dad06241920a1520de401b3d3c1edcb21c60c9969c1ff3de4b56586588f15e91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136381, "uuid": "1d4dfe22-d0d8-43cb-9a71-954378554073", "comment": "Malware payload", "value": "ed228ae8b67fd5a1256f8a63069c6b9765c545d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136381, "uuid": "38e5e5de-a61d-47c0-8173-5b7c0293c29e", "comment": "Malware payload", "value": "395c3c4b253160f05ae5fdea8f43d0c3d9a442b69646e407e8b3c281ba18280cd96cfc99ef0d2bf29d364a1715b5aa88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136381, "uuid": "ea10cff6-cd8f-47a4-9dc4-b3e304422dbb", "value": "T19E94F1B0B0EB8CE9F56B99B0656DFDA5067233E388DB4954036C66005BF5F163E48A0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136381, "uuid": "058125f1-de16-4e0b-9241-1afa470b259b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136381, "uuid": "51847b5c-0a92-44d9-a4bd-b2422afa60e6", "value": "12288:hSMVx/Ad/lFRhngZ0f+GTM2IXhpHPb0y:kMVx/iP3gCfw5VX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644136381, "uuid": "3132f0c6-602b-4104-8d8a-e19db031d151", "value": 447488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644136381, "uuid": "5388a96c-68d0-44ed-9a78-0de9b80be277", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136381, "uuid": "b6a5902e-0b5b-4bb7-9d18-05c83a618e26", "value": "009MT098UJM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0dcc018-8726-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644136132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136132, "uuid": "696afe04-a20f-49ac-ad5e-d395f58dcb8d", "comment": "Malware payload (RedLineStealer)", "value": "c65931beb95510246cd3839ec87aab55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136132, "uuid": "bf35fb80-0559-46c2-8015-cc81367cf332", "comment": "Malware payload (RedLineStealer)", "value": "dbcf23d005a52b75c4f553d810b212782c76e6545da40f649976c3c3a1f92814", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136132, "uuid": "9fbd1ab1-748e-4b12-803f-27bc11645d47", "comment": "Malware payload (RedLineStealer)", "value": "a9410bf24de1381fb5cafe587d5c4ff92d5d65f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136132, "uuid": "67d99c97-83ee-40f3-8df8-3659a87062d8", "comment": "Malware payload (RedLineStealer)", "value": "bbd5ac7457d6affbd20b68e9c509493a2e3db4ddd7748b6f55f2a0071d5fae8d1249a378083f4089929f7f6324df4535", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136132, "uuid": "fad50882-e7da-45cd-ab02-846f28ce04a7", "value": "T1FA0633ADC86B666EE1560B359476D4D231BC5A08E6EEC9D8793443EE030E82B33D6522", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136132, "uuid": "78e9dee2-6194-4160-aaa1-6e86fc50230a", "value": "41304e4befbbd8a63ad6ec59f252160b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136132, "uuid": "2a915d08-66f9-440d-93bf-8c5982940228", "value": "98304:sNyepUAEcl3zHfU4VgFNZYSWtwDgGNqRxdYvq:sfpjpHfU+8ZJer7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644136132, "uuid": "1ffb4962-a791-4134-b1e5-2a17e66bacb9", "value": 3725824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644136132, "uuid": "e953f41d-f87d-41fc-8a6c-af5b3b7736d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136132, "uuid": "e792d4ba-db4c-4ef2-8a6c-2ed96be5134a", "value": "dbcf23d005a52b75c4f553d810b212782c76e6545da40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f4402a-8726-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644136174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136174, "uuid": "5330ff80-eda5-4e57-bdf6-0b125f9885d1", "comment": "Malware payload (Loki)", "value": "cda415396473b5704fb68b8ea88c24dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136174, "uuid": "55802246-abcc-431d-b5b1-a268beabf6a2", "comment": "Malware payload (Loki)", "value": "dec44075aecbe3a36660f6fabce5b7893101922b5e17181d62fccbe84050b235", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136174, "uuid": "82f3e2c8-aea4-4f0c-ae15-4bcda354c986", "comment": "Malware payload (Loki)", "value": "7a61182ca19fff2a328d5f67f4b2a8c1943f0274", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136174, "uuid": "fd876e0e-dc22-49f1-9f84-42cd2996f5f1", "comment": "Malware payload (Loki)", "value": "369d837dd666e418dba0b802f614a24d096a8f9e805243eb1db675e4458fbc4e188284ccc145a5c23af97d626d1cd2d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136174, "uuid": "7051f27b-4684-4c04-acea-4c28839780e5", "value": "T1E0A4D0B5F6D785A1F41BDA316135B85106763EE3AEC6D6191324F2080FB23A09F76A0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136174, "uuid": "b7623404-a749-4dca-af3f-835cdef42947", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136174, "uuid": "fe0dba74-b9a3-4c39-809b-aaac4e109ce3", "value": "12288:0x7p3LjXJNZI0gX14C0NMfePrMgMoSVI3uFX/qDJ:iXJNth3NNuaDJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644136174, "uuid": "bb70fbe2-f3db-4cff-978b-c2fc75004cbf", "value": 449536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644136174, "uuid": "1a340d4f-0f2a-4264-aaf2-c2362fa12883", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136174, "uuid": "afbcca89-1d50-4bf1-b5bb-814b6fb9adb9", "value": "DHL EXPRESS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b8f525-8786-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644177127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644177127, "uuid": "c2a63c26-eba5-4633-8a48-bbf2f0d2827c", "comment": "Malware payload", "value": "5d0546466f96865cbeb16a39148a394d", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "DoH", "colour": "#E26275", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "trickortreat", "colour": "#ABDA83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644177127, "uuid": "48413709-468c-4a7e-a59f-7c59690013b1", "comment": "Malware payload", "value": "df2853a1bc08e8f9ee97a33a001e84597e85d5834c540d846dce4d4f8183bddd", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "DoH", "colour": "#E26275", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "trickortreat", "colour": "#ABDA83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644177127, "uuid": "c9ae950a-c6fe-4a37-b4c0-8003560cdd7a", "comment": "Malware payload", "value": "80a99f2a6b9fbf352926cc3bde50b6ee115418ad", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "DoH", "colour": "#E26275", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "trickortreat", "colour": "#ABDA83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644177127, "uuid": "60fdc440-d571-4faf-ae24-0d8a39f5192d", "comment": "Malware payload", "value": "69974ffcf87a6ea1a7a88eab891a7dcfd2c8d5f891a0be7fc0a0bedaa1739f12774d393f10f8052b5be5e6a79414a0cc", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "DoH", "colour": "#E26275", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "trickortreat", "colour": "#ABDA83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644177127, "uuid": "8c82231a-b4e2-4c2b-a234-bd47ca884917", "value": "T18366122176C6C536D5BE02703E7ED66F052ABD200BB184EB33D80A2E1E719C25676F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644177127, "uuid": "740f6ccc-e863-4c56-b0d5-c65b5edb47c7", "value": "196608:dKp2wBL4NzaUeQmoJG98Ui//iv/UGtLnh3:dKzaNznYoWi//ivRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644177127, "uuid": "cb3a41c7-50f4-406e-a7fb-be8abe2da2df", "value": 6782976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644177127, "uuid": "7c8b8241-3d11-4a82-8f6a-68b640bb31ff", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644177127, "uuid": "30fb6887-8092-4871-9ce1-1b3c5494c226", "value": "02-02.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "417866a0-873f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644146629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644146629, "uuid": "6918d29c-9616-4626-99fb-95b8257a600d", "comment": "Malware payload (Heodo)", "value": "98436f9b54e7f722bba2c5cede0c3f76", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644146629, "uuid": "79c7aead-8bde-4871-a4f2-035cc0aa5f7a", "comment": "Malware payload (Heodo)", "value": "dfd38778a6ec28d6399146604a99a2bb16f40c7f33c6a12d08316c9d3572537b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644146629, "uuid": "e519cbca-7195-453d-9843-3a0986b81fb9", "comment": "Malware payload (Heodo)", "value": "3e3e0b168e15b7997a0bcf56827ee9fcc2ab1ab5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644146629, "uuid": "5d09e780-4a33-4122-8408-2b7d08a5dd41", "comment": "Malware payload (Heodo)", "value": "0dd4665bef08f46a53a2f4cefa5723aa900295a51b08ef5395bdaedd418e8290657f3ddff37b9b3ab941ec04c7d8a516", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644146629, "uuid": "1b0d9e89-fc1e-448e-b510-401b74964501", "value": "T13D841A9EE104DC32EFFE63F151E5CBA3C15B9430275845AFE7FD91661A3CA988238582", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644146629, "uuid": "f1a9b684-4d68-4d54-9b26-f4d79c0ae761", "value": "7f57698bb210fa88a6b01b1feaf20957", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644146629, "uuid": "3f57cb39-fb69-4869-9515-e0b641f60ad5", "value": "6144:cNU5LwA22222GgngDrDRVyYli/ci2tEGW78ODQiEBtvOSF:x5w7YM/cYVV7Ev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644146629, "uuid": "582a7115-cb42-4691-b08c-01b1f072a962", "value": 376374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644146629, "uuid": "2d91900b-6851-423f-931e-aa42f415ca6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644146629, "uuid": "4acb1b44-edf3-4a8f-a704-6c49aac2f605", "value": "emotet_exe_e5_dfd38778a6ec28d6399146604a99a2bb16f40c7f33c6a12d08316c9d3572537b_2022-02-06__112344.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df48d209-86ff-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644119406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644119406, "uuid": "4465fbea-35cc-4a5c-8110-7342f8d77fbb", "comment": "Malware payload", "value": "d88f1650af911e7d3ddd9d4231cbaa0f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644119406, "uuid": "aee7e2e8-d65c-4b0a-a0a0-3e9f17faa8eb", "comment": "Malware payload", "value": "e519eefe9d20944aab6d37ed7a3e551689d837ae8cb66f674f40398880b5227e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644119406, "uuid": "7ed2973a-1865-4aa0-954d-a6753f3d5c32", "comment": "Malware payload", "value": "350e179787bbe6e21c03ebc18703a8fdc69938e9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644119406, "uuid": "65974d6b-ec5c-44cc-bf13-5b1c7f2b56e1", "comment": "Malware payload", "value": "2246538e4737a9ea030010c64219f3f53afe2b6886cb04a6d99c6aa6a54fadc827f167683a06c5a5feb6475777386b2d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644119406, "uuid": "7cdccaf4-5fe2-409d-b221-a9d5767e33ae", "value": "T102530215029489BCCDF33A37712DCA1B27A766F9806CB07D327263047BD622489F866B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644119406, "uuid": "18306327-0165-4ac8-9cbf-7b4fe8aa9d66", "value": "1536:lwL0rI0XQymgX+Bw9VhHlJAswQn99eYGGJK0Nfbvq0M:lFUX3gXJ97FJnC3Erqz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644119406, "uuid": "ad1ef517-5d97-454d-9279-282a2abc3c54", "value": 64636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644119406, "uuid": "e04858ff-e747-454a-86f1-0283ab82f504", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644119406, "uuid": "697716ff-7ee8-4698-a207-4810bb3370c0", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "360bd447-8796-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644183976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644183976, "uuid": "964c351e-8cc6-4017-b78b-7be79627f9ad", "comment": "Malware payload (RedLineStealer)", "value": "a4d39ec1301390762e8b47f4617a6991", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644183976, "uuid": "17158343-0c6e-406f-8ce7-bee1cfbb85f1", "comment": "Malware payload (RedLineStealer)", "value": "e592d4874e782f1857f2c0b5c02671ef7f704943791fa3236e60ce1d4916b843", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644183976, "uuid": "e5e1cef9-6353-4944-b06b-0e6e44e492aa", "comment": "Malware payload (RedLineStealer)", "value": "d21777d6ae32819901a8b3f834e1556845405e7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644183976, "uuid": "b9390df8-a7a3-47a6-81e6-63ce4a153125", "comment": "Malware payload (RedLineStealer)", "value": "94cd065282024bb86183ddfbd22cd58d58d6c2b26d6dfb44e4e37fa1b6c092807aea838b786e1aff1c58dfedcbc4ed77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644183976, "uuid": "fda6b880-0d3c-4940-8b15-88ea8818b678", "value": "T144D4D0132B9485CAD9A2DFF14E3459939FE78A631C13EA0A1FE834B70D35B9A8D35D01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644183976, "uuid": "f62146c3-0a7f-40a9-83a6-729f1784b009", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644183976, "uuid": "b1800cc4-6fdf-473e-93f9-9f15bd9dbb79", "value": "12288:G59+bNvJ8R4E/JGZz/rGHPgzE1oISHz9Y:G+bNvJe7IZ33V/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644183976, "uuid": "b5de0b4b-eb26-469d-9ba4-579f4428c282", "value": 632344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644183976, "uuid": "1c7a6f08-f6ae-4621-b450-20d69ea6d720", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644183976, "uuid": "6091545b-338c-44d3-94d1-4f2c87c81806", "value": "a4d39ec1301390762e8b47f4617a6991.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6954b3dd-872b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644138106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644138106, "uuid": "7e71e4bd-b3f4-4384-85ac-2232deec27c4", "comment": "Malware payload (Formbook)", "value": "468108596909ffa07287df694f356526", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644138106, "uuid": "00ba47ae-b784-4d68-96fa-bb30898e5e43", "comment": "Malware payload (Formbook)", "value": "e5938a9efbdbf0a81790e0287b086b4a322b756db37ec4006419a6ada47073be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644138106, "uuid": "7dd8e37c-8171-4ed4-b390-36ab1d8a9d75", "comment": "Malware payload (Formbook)", "value": "10204b2d5f6784280c97b45c688a36435af7ba8b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644138106, "uuid": "235dbd29-f6d5-4a74-8f83-a62d7ac88cef", "comment": "Malware payload (Formbook)", "value": "d3b6f4fed635fa4a34b49456836a9cde52f7b09171507e09c45985b7982976a3863e3c0337eacacfefb4e259b8f14893", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644138106, "uuid": "429f6a2f-027b-4ada-b495-26a0881950ca", "value": "T19794E0B0B0EB8CA4F52BD870367CF9A1027233E399C71A65533866448BE5F697E4494F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644138106, "uuid": "3a18d886-08ae-43d3-822d-c341c7c7c14e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644138106, "uuid": "dbd6177b-6738-43b0-b9e7-d9dca018ae95", "value": "6144:/MSnO22PARGT6nq9glKS7/Zx9SMRPTSxHJarr4DECAl/yAkQCFN7yTa:0SO3PARGT6nqal8paXFxyAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644138106, "uuid": "b1e563ca-fa5a-4d2f-b3b2-1e30eb3f0aae", "value": 408576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644138106, "uuid": "16878c6e-8742-4e34-bb56-d2c9c1750f07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644138106, "uuid": "569d32f3-5ed9-472e-bd40-007e1ea84fc3", "value": "468108596909ffa07287df694f356526", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6a407ab-8726-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644136115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136115, "uuid": "8f688cce-2e1e-4846-824b-a008d7b03ece", "comment": "Malware payload (RedLineStealer)", "value": "426c00e961c6ae4010043068b3532733", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136115, "uuid": "306a5d43-9e43-47b1-91c7-9abad1486f49", "comment": "Malware payload (RedLineStealer)", "value": "e63f7b73cd4e32fd905eb1a0173f03fcc699381db17a4017fa0b517c3b58403f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136115, "uuid": "0dd71462-64db-4ae6-b374-b4d1cb23751e", "comment": "Malware payload (RedLineStealer)", "value": "98da3acd4e7bb8a495205e8a226a585ee13555a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136115, "uuid": "3a807884-7681-4030-bc70-536be181b9a1", "comment": "Malware payload (RedLineStealer)", "value": "c0e5623db8efd0739dd05a8a835dee5e783e6fe19bf4f532d56d642603a3cd019a1961cfe3dbd5564d1fa1009d00f3b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136115, "uuid": "5b3945b1-d770-4e03-8040-83cf630d82d2", "value": "T19DB4B53439FB5019F2B3EF75DAD87596DBAEB7632707E81D208103864A03B42DD9163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136115, "uuid": "620516da-77c2-4251-b165-414ef57bb74f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136115, "uuid": "adb31af7-7adc-43e2-becc-3b76c9d6e0ca", "value": "12288:waDcR7yv8YIjovuWfONVjZS6DoTaqGHJ/gGwZ:wgXkph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644136115, "uuid": "f47ae206-28be-45e6-932a-b3cc829e942a", "value": 501760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644136115, "uuid": "9573f8a9-fe62-4921-9837-74b4189661c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136115, "uuid": "28cdc838-de7c-408d-900e-27e22f5f4ba8", "value": "426c00e961c6ae4010043068b3532733.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb629a72-8761-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644161517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644161517, "uuid": "b0914012-88fb-43dc-81a3-37430f46f772", "comment": "Malware payload (RedLineStealer)", "value": "8c7c8512e1de244c679575f825640f2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644161517, "uuid": "b897c294-ddd9-4364-b4b2-1299e100985a", "comment": "Malware payload (RedLineStealer)", "value": "e6496deacc785f638940cc3b3cef72bdb9ffea30624d992bbd35d29aacdcb7c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644161517, "uuid": "15cdaf0a-1b80-4d23-9f73-35dceb3fe7d7", "comment": "Malware payload (RedLineStealer)", "value": "f5164e0228e18a37de301eeedf6494bae72ddba5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644161517, "uuid": "ae7f8d23-be89-4536-87fd-51fa4f373894", "comment": "Malware payload (RedLineStealer)", "value": "be5bdd6cf3fdea83d6eca10b9ce98364da2513827575ab721ef3714e32293e759f48605f5589ba92391cd360ef9b16ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644161517, "uuid": "71e34a84-3b83-4555-aa6c-9ac9b8fdc4c4", "value": "T1AC8533511F106D15EE160B72638AC6BBDE806EA3F931127FF2C43D77BA6A6216432D1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644161517, "uuid": "e031956c-d44f-434e-9a7e-ec9662ea187c", "value": "29fbd92a5f6b7e05ae5c2457133f88a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644161517, "uuid": "0474955b-4890-43c1-a316-778ddea47328", "value": "49152:eq6p+41BYVIX+t7HKasbF+gn3qVDB2uM1Veq:eq6p+I5+tjKBln3ADU1gq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644161517, "uuid": "30e498c0-c39b-4c5a-9c5b-cac353ea76a4", "value": 1859240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644161517, "uuid": "b6144166-4140-4b84-94e6-1405b9947be3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644161517, "uuid": "a4194735-3c70-4206-b9f0-e4842a38ee6b", "value": "SecuriteInfo.com.Trojan.GenericKD.48274970.27549.13362", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56680d3a-875e-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1644159978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644159978, "uuid": "35947b6b-ee21-4c01-b692-398e13554b03", "comment": "Malware payload (njrat)", "value": "a9b6789f9e05497879db11cf13b8cd15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644159978, "uuid": "0c35e1d5-b073-43c0-b956-1a6da87b7725", "comment": "Malware payload (njrat)", "value": "e68bfb6f09d45e724818173b900d3871347e921b142f33aaf1d53a8a785d4bb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644159978, "uuid": "17cf3987-7218-4fa5-9ecb-d423fe3f0f3d", "comment": "Malware payload (njrat)", "value": "4b8cfdd6e0fb9b2ec19e58abecbd899aca786e32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644159978, "uuid": "4ddd488a-4fca-4b9f-b00e-2162e58e8300", "comment": "Malware payload (njrat)", "value": "c58701fd42682303d572d249402b970d28795c2eb532419f3ca9353a14eb70508632ef670a758c8fc66430bebc9e5443", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644159978, "uuid": "adf11b6c-8501-4490-a28a-df45b9d841fa", "value": "T130C5294D7FE18168C5FD497B05B2E01307BAE04B6E23D90E8EF1649A37636C58F50AE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644159978, "uuid": "dc200c9f-9064-4c66-91df-60014746bdb3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644159978, "uuid": "5b7bdc98-a31a-4e8d-851f-74da736d3a29", "value": "384:ueLx1kit8Zf5W9cTYXyc/bBM0izvncnPMInrAF+rMRTyN/0L+EcoinblneHQM3e3:DLxKjjTYic/be0PMmrM+rMRa8NuG2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644159978, "uuid": "4173b8d2-9183-42d6-8625-b235282be4dc", "value": 2619392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644159978, "uuid": "40b6d27d-8479-4311-a587-2d2730f9490e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644159978, "uuid": "f10d8f7b-e924-4f5a-878f-bf768ae74e4d", "value": "a9b6789f9e05497879db11cf13b8cd15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5710a142-8745-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644149242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644149242, "uuid": "352e5148-315c-4a0d-81ab-532347a0ab82", "comment": "Malware payload (Formbook)", "value": "1b368429bb54aa475c67fc2e45380c3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644149242, "uuid": "62124a8f-c38f-45b0-ac36-2764a0a89c70", "comment": "Malware payload (Formbook)", "value": "e6d85a6287cb583fc5dec0b47a3288d9d0bed8e103991797b14a0e16ab41a9b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644149242, "uuid": "dc4cd4e4-b6fd-4f2a-9a10-d36185f99674", "comment": "Malware payload (Formbook)", "value": "ef6e114cd73b2ad5af2da580ff37ec65a789969a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644149242, "uuid": "aa6d5cfb-835a-4b91-8e44-60c0d5750828", "comment": "Malware payload (Formbook)", "value": "42012b82f0f846edc31dead2f1ed835e1c94af96f7ba8345d4cbc9a1836810329ff1c2317cb60308cf1519e9e614ff67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644149242, "uuid": "825c5d1a-f25f-4ff5-b214-17ee627b05a1", "value": "T1E1C4DF6071E64B58F0BF87F51138F8A027B274EB65D4C61C0E9822C85AB6F515F94F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644149242, "uuid": "45cc6be3-d3bf-42ad-968f-ea49d6102cda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644149242, "uuid": "8d6a505a-aa95-4444-8475-c574b45dfe22", "value": "12288:x8qAaehX93VjqTuaxT7HVVOdsxaO6RScOHj:uHaehX93VjOuaj4d0aO6POHj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644149242, "uuid": "c5eafd84-8219-4a42-becd-ec1a7e09886f", "value": 578048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644149242, "uuid": "38783cd5-57ac-46fe-8bff-52bd89eeef70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644149242, "uuid": "84f57634-27ec-49df-8a3f-412d979172e0", "value": "NEW FOB ORDER.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fccd3e81-8726-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644136206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136206, "uuid": "2c90df6e-2171-485a-b5ed-0526a210bbd4", "comment": "Malware payload (Loki)", "value": "e21339d1135ba8f7bdba647763d8b26b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136206, "uuid": "50fcf644-925e-4fd2-bac5-6d04a77962ae", "comment": "Malware payload (Loki)", "value": "e7fb27d7d89ae0ad8c00bee050bb53970a501985f306466ab34fa545d7b3fa97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136206, "uuid": "08ccd183-f243-4165-b51d-d7f617911875", "comment": "Malware payload (Loki)", "value": "040149c0b6fc4cdfa63c909d417d11973bebdcb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136206, "uuid": "68bd7b44-546d-4e1e-b76a-33b20114042a", "comment": "Malware payload (Loki)", "value": "92c3fd036e4395490b2302ac0139c695bed68f5efc13a6d0986aaa903d6b18bf576af868f89762d8c7bd9fe0d1ec9053", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136206, "uuid": "9c741741-0748-4ce9-b298-a1c896adf0e0", "value": "T11CB4BF7AB78BCE41D015213211BAB85103B23EEB96D3D6163F5CB3580F722664F9A64F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136206, "uuid": "59a6a63b-aa06-4acf-bf96-9ae4b9ff8c69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136206, "uuid": "9b20c33a-b2ca-4429-bcb9-dbd5066b0e20", "value": "12288:MqOi7bKJ8ZDAzNRvVWcECFPE7quUKUfJ:MybKJ8ZDmk1GcMKUfJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644136206, "uuid": "b5b45bab-c012-4dca-bbc5-bcaa7dede0ad", "value": 499200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644136206, "uuid": "05c0ffa1-07e8-4bef-9d7e-0eded715c7ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136206, "uuid": "c726718b-9435-44ab-a548-b186ec3d8524", "value": "WE093873.COM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f6bd429-8726-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1644136049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136049, "uuid": "6348d362-b8d0-4246-acae-78e605786450", "comment": "Malware payload (NanoCore)", "value": "d1b8d9ed974691dfd1e52fcdf479fd64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136049, "uuid": "076d6486-a579-4f47-a020-febbaf50ec16", "comment": "Malware payload (NanoCore)", "value": "e84e456bf87d8e7fdb411cc833bf8efc21a8b5d831e17908dd86258e91baed96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136049, "uuid": "b147885d-ddd8-4ded-a39c-6e1dc8ef0405", "comment": "Malware payload (NanoCore)", "value": "f88f5b33380ed9adf9197a02594518cb667e5c8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136049, "uuid": "aa74eff9-c971-4693-97bb-546dfe28b04f", "comment": "Malware payload (NanoCore)", "value": "63d6b9a2a650cacbb36215578e22bf3f6d457ca0acc8461733e3b8f9929446a0e8fcd8887e9ac402871a02cf5768f069", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136049, "uuid": "7f2044f7-66ee-4f48-9e47-08cb41cc9cbd", "value": "T158B4AEB6B0AF855CF10B8974257CF96402B235E3A8C90D3437A9764DCB9EE583E446CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136049, "uuid": "708639ea-f07c-48b4-ae6c-1efb921303c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136049, "uuid": "c6e409ba-df17-42ca-8b4e-4701c527caa3", "value": "12288:sVO7JxBFr+nVIhl71GAz2w3tvYsS9hj2zbaWWr:sVOV7FrGV+l71zywdwzh4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644136049, "uuid": "a59b9fba-c758-48bd-be90-2a6b4464f3a1", "value": 518656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644136049, "uuid": "65bd4a4d-b1e9-48c6-b866-ab932b02acde", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136049, "uuid": "78c289cd-4583-47d9-bf19-b3c5677d1710", "value": "Order Confirmation Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a8afa96-86e0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644105815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105815, "uuid": "93c5f494-433e-4711-a381-9033cf748da5", "comment": "Malware payload (Heodo)", "value": "976b33c2949795579663a097746fc380", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105815, "uuid": "67e408ab-8920-4d4d-8d3a-00a9a776d273", "comment": "Malware payload (Heodo)", "value": "ecb44a2bd3bd66c64d7cfd1cad7ac2dedc19992310f5f9bc32cd282c83ddc88e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105815, "uuid": "8d8c2739-bfec-4b76-a366-2a1430319905", "comment": "Malware payload (Heodo)", "value": "694ee653b8930a84642d208224860835030ad420", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644105815, "uuid": "1193a390-3e5d-4c18-8bb2-b0cff4e1b072", "comment": "Malware payload (Heodo)", "value": "6edc61f639034633b7749ec0ac127c60626c7544c48aa3ad83141eb8e7734cdf8891eacc085dbf185c5c4921043550fc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105815, "uuid": "905dbc29-3f38-4384-951b-9e32e252d8f6", "value": "T16725AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105815, "uuid": "caf0f07a-0f42-4f55-a693-6327e3526938", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105815, "uuid": "9e0e03c6-5792-4a8c-98c5-b1a429a63642", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYx2fFIIm2m42:1ZsYB7vLsnZI1Hb9D9FIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644105815, "uuid": "4caa536b-5c09-4745-8fc8-daa6d1ac872d", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644105815, "uuid": "4e476cd1-f6da-43bd-a13b-04fe64f6c624", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644105815, "uuid": "7fd77b46-665d-47ec-a7b1-da71acf7573b", "value": "emotet_exe_e4_ecb44a2bd3bd66c64d7cfd1cad7ac2dedc19992310f5f9bc32cd282c83ddc88e_2022-02-06__000330.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ff6be0-8726-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1644136052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136052, "uuid": "f3da81a0-2dc1-43e6-93ac-ce466888acbe", "comment": "Malware payload (NanoCore)", "value": "db22830e7f181a179102c6519914b54a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136052, "uuid": "111013d7-15f5-4a5b-9920-56ec9ec9a11b", "comment": "Malware payload (NanoCore)", "value": "ee5dc726a74a9fe391f2f6a6edc69e279a8aea2d9ef06710e9b1dce94503f58b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136052, "uuid": "ca67996c-27a0-4a5e-bba5-f3af17d2d24a", "comment": "Malware payload (NanoCore)", "value": "fb27dad7096772ad7e3514219e8993d75983907f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136052, "uuid": "5d641cef-2d39-4adb-b450-af2d161e53c7", "comment": "Malware payload (NanoCore)", "value": "a67959b565a2313a3897e0803b16fac76791776774275c8fb6c3376e110e6eb7652943a5e57f831ae04b9e09c1cceef6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136052, "uuid": "83faea2f-3516-468c-b01c-c17ff6e9171e", "value": "T184D4CF6BBA8EC999D025103221BEB41003B23EDB5DD3C6163BD8B35C0FB26555F9A5CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136052, "uuid": "9c03f95f-343c-4abe-9f62-74ba3dd0227b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136052, "uuid": "ed8b1a33-8b85-45a7-8aaa-3ebf28c983ba", "value": "12288:J8JKB5uT6hJ/KRTCNIs1LldMf0lNKxAAmrONXlSifJNpoJ:WqFhJy5emFNXljJNpoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644136052, "uuid": "8bd1bbd5-fdfc-4db9-8544-1ade20e44509", "value": 637952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644136052, "uuid": "c401db00-48c5-439d-b615-8f8005e218f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136052, "uuid": "e3b4519a-46da-4e2e-8bac-c23524de3249", "value": "New Order- Tec Mariac8810.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f64fede8-8745-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644149509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644149509, "uuid": "64cc3020-fdb5-4a96-a6f3-d5d73029ddcb", "comment": "Malware payload (AgentTesla)", "value": "82b624cb0c33170be83ad75e44d409bb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644149509, "uuid": "7d01d245-95b7-4558-88ee-f5fa63e473fd", "comment": "Malware payload (AgentTesla)", "value": "ee80188091f64530993307363b7c44a0a91335b3ef67b6056ccf9c557d1fdd32", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644149509, "uuid": "daa947a5-4d08-49bf-bb61-28823ceaa8e2", "comment": "Malware payload (AgentTesla)", "value": "c03d8539e0ff92fbee4180455d3bccc21385e16a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644149509, "uuid": "04564c77-d5cd-4ebc-9d7b-3042875ca09a", "comment": "Malware payload (AgentTesla)", "value": "684d6d21d804703ab3abb9ac88d8563afbbfb9f5216ad9c291914a79491ed15024f667c3852536a74a4824ea89f84362", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644149509, "uuid": "ad7ca849-df63-4ceb-a48b-df8e6a5f3923", "value": "T18CD4D06072FA0B58F5BF97F51178B89417B274EB69D0D61C0EA822C80AB5F415F90F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644149509, "uuid": "8815a444-190e-4e24-840a-8af2bcbb3418", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644149509, "uuid": "4a933d1d-d5d0-4cbf-926b-a88c1068d86c", "value": "12288:2+xqX93VjqTuZkZONatxE9K7ZMJ8lCRq+KWNget2zFbKC:HxqX93VjOu2lxE9K6IoS4geMzYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644149509, "uuid": "f0c1b581-68b7-405e-905b-02cd27a206ae", "value": 625152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644149509, "uuid": "dbc38e07-700a-4041-b2e2-8c42dcaddbb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644149509, "uuid": "9ae20567-4603-4ecd-b4e9-23967bd44211", "value": "invoices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "413b7086-8725-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644135461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135461, "uuid": "22d3267c-ad3d-453a-b764-925421b9ba0c", "comment": "Malware payload (Loki)", "value": "629cb490f2f00e1908a3d493a51d9ba0", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135461, "uuid": "8229e967-21a5-4dbc-accd-da1db2fd1fbb", "comment": "Malware payload (Loki)", "value": "ee9f0c1ac5d39548dbde377348fd89d3667160b0d4db063e3fab6103dfd1c191", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135461, "uuid": "a2e36a38-5103-4521-8cf1-59ee70981a82", "comment": "Malware payload (Loki)", "value": "a2a7def53f570f0886800abc0f854da3efab5ba3", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135461, "uuid": "d9466e7f-3828-4633-a8eb-c70574f07f4a", "comment": "Malware payload (Loki)", "value": "25afd6b23c8d0d3576f94ba8d5b51f68f43a0c9cf098a79e0bdc7adf8a4beab917731c10f1d5ad5c7d9f9d953c0c02f7", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135461, "uuid": "749a442e-a232-43d4-9a00-139c37afcde3", "value": "T10B159EA3B181943EC2231B319D6FC6A9A926BE103D399C493BE95D0C4F397817D25ED3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135461, "uuid": "7689bf93-284e-4830-9f29-1560d253f908", "value": "974c8f82371179980cb83391b3426c77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135461, "uuid": "bf07cd38-7f00-4bff-a37c-7563ff63e7f4", "value": "24576:SkIG/rliEYkFMlpPBGCdapKHNDwsPOa78NlpO:S+jYbxpF2awf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644135461, "uuid": "9eea8491-85d7-4b1f-bd69-4dd3723e8b9f", "value": 877056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644135461, "uuid": "f26cc6f3-961b-4566-874c-e3e752039862", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135461, "uuid": "bacc8a28-b3e3-4b46-8ac3-e04f4b11c17c", "value": "DHL Shipping Docx_Ticari Fatura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "763c4b7d-8726-11ec-9275-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1644135980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135980, "uuid": "c451d78b-eb32-4546-b49c-79902ff94bba", "comment": "Malware payload (AZORult)", "value": "7bae1ba5836f9395b04e1a15067ae2b7", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135980, "uuid": "b01ee7a2-520a-4668-94d2-fc2b017f19ef", "comment": "Malware payload (AZORult)", "value": "f3a5d61ab00807691f32d2597edc79cc7a197f64cc71110c1b36e3fde15dc458", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135980, "uuid": "c6729f7d-ab7a-4713-9ec3-c610208024e2", "comment": "Malware payload (AZORult)", "value": "538e5932c271b1a3c34e1d419d061888386c4a52", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644135980, "uuid": "8c9245cf-9a8d-4676-95d1-e756bbd24c36", "comment": "Malware payload (AZORult)", "value": "a60fef49648630f843ba9383ffcf951ce67ba94e302f5221e1cc6f17228a7a7077c626c5f3f4f6abf657038b07661d6a", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135980, "uuid": "77cc6009-8866-4e33-8852-74a398bd84f8", "value": "T18494E3F871F1E27AC81182712A257C7193F54DA0DDB0A915EDECF9E4D530EF62B2260A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135980, "uuid": "96e47699-2df8-48c7-9f2e-13b093a8cce1", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135980, "uuid": "128d1e1c-ea91-4d42-961f-f180daee15d2", "value": "6144:BwTa4ogLe8hP8ApUNbasv1HzvpffI0GIl7fsXxKpPCzTqgz:kJTR/aN1v1HzBffFGIl7fuQpPWz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644135980, "uuid": "d4ebfaed-358c-4cbc-815c-ac129beb31e6", "value": 422625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644135980, "uuid": "e1879fdd-1024-4b95-be07-73c055fd9d3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644135980, "uuid": "1ccdbd03-3aa8-458b-b7f0-b0466d2bc4d0", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dff646be-86ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644119407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644119407, "uuid": "3f9e763c-ae66-49d4-b066-e9ec3c327798", "comment": "Malware payload (Mirai)", "value": "7119c9806f079f5fc845e20ca492b4ed", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644119407, "uuid": "2ce91a91-e62b-4ab9-9c61-ad8111cc2e08", "comment": "Malware payload (Mirai)", "value": "f61a4ea23f81f9bae221103caa13f11b8019c8a48f4c3fbd96c238631dc105d3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644119407, "uuid": "0f57c975-abf3-4e96-a672-3019a8d9baa3", "comment": "Malware payload (Mirai)", "value": "b7653f3b4581515d88c79c2895dc86a0fdb2255b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644119407, "uuid": "d85a7c47-0e51-4066-95ad-89a384f3b257", "comment": "Malware payload (Mirai)", "value": "af210e1cd354878a93cc2ba19163e3f13ecef07392d0188a5655570523810a559558307c317ff4658a8cfdedd89c3ca9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644119407, "uuid": "eecec92d-93b6-46ae-a201-604f73eb2bc5", "value": "T167D2D023D3A99598C92500BF095F260F9848E91ECCC197E14B587276DD11FBCBD4DF8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644119407, "uuid": "591fcec5-422b-46f5-aad0-933e6f9b70dd", "value": "768:HQNQcOqeVIo26C8HC6+kDklmsYG0DjYZgRhX0kTVbgnbcuyD7Uryqk:H0QcJe6ff52qmQ0DjYubX9Cnouy8mqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644119407, "uuid": "80d64f72-c349-4fc9-bfea-8f0831925bdb", "value": 30860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644119407, "uuid": "5bc8294f-eb79-4a14-9a10-c3af1066b9e0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644119407, "uuid": "cb83b76d-9a65-4dd8-8109-866ef6fd7f5f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a32495-8726-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644136138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136138, "uuid": "dfef4058-d554-4ba2-acb5-2e9c27b599da", "comment": "Malware payload (RedLineStealer)", "value": "a6805cbe5fa886b0562f6456c9a0ca0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136138, "uuid": "2a9ede16-1012-4c14-9185-fb8044892fb6", "comment": "Malware payload (RedLineStealer)", "value": "f7345a1a93f4c4f8f3f596be41dab44e67053b6f6bc3e57090881f07eb900ce9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136138, "uuid": "2ff013bf-73cf-4c56-8f1a-5f98f24dba84", "comment": "Malware payload (RedLineStealer)", "value": "3a5c36b366b2e771d24aa05d2b8f51eb26b68d5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644136138, "uuid": "50ac5602-22c0-4a5d-8084-968873740a1b", "comment": "Malware payload (RedLineStealer)", "value": "ff040bc96bf8073688c569453dbe015b3af7d241e8c17f301073977458b9b71c0c83816649db153d7b3aa56729b5dc97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136138, "uuid": "78eb2729-6ebd-44ec-a970-d6b42feb8e12", "value": "T17406331634D1D494D38AE8781910BD181FF12EA01B97B4F2A9EEC466485C34BFBEEB5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136138, "uuid": "6bae2246-80b2-491b-9f41-17319a698ddc", "value": "41304e4befbbd8a63ad6ec59f252160b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136138, "uuid": "f3868f2a-ce37-480c-8aba-06811dfa86ac", "value": "98304:8g30e07dIYhUDWmjo3ScfpAubRo2O/v84SdTFaEjnYi+CO6h4S:by7GwUDdOpAWRDO/v84aFaEjSohx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644136138, "uuid": "154e06d5-954e-4a26-acfd-fd127108c888", "value": 3710768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644136138, "uuid": "1667d36b-46d8-41f4-a08f-741ec4017fd8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644136138, "uuid": "bbeafde9-f042-41ef-9465-9f1e57c38397", "value": "a6805cbe5fa886b0562f6456c9a0ca0b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bbb3b4b-8722-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1644134217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644134217, "uuid": "00a4ddac-050b-44cf-86df-83390a0eda94", "comment": "Malware payload (AsyncRAT)", "value": "9805d089929af6e88a928c5db365ff46", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644134217, "uuid": "8fa9fbf4-367f-40d1-af11-1b27b15afb7d", "comment": "Malware payload (AsyncRAT)", "value": "f9ca68d46bfdd5710abe9d01b9c6de61a0861581b0de9684c202b0c9aff11ccc", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644134217, "uuid": "361fdfc3-591e-437f-a308-c6498814da34", "comment": "Malware payload (AsyncRAT)", "value": "918f78abb1d021e95e2f37444dbae6a0bdda0ff9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644134217, "uuid": "3507d4fc-4405-4d36-a426-9c74efa5a51f", "comment": "Malware payload (AsyncRAT)", "value": "20939509b4a9b5d0d5afddaa771fb7818a26f953d1c1538c1169e064a959ea6c7b8631231528bc6e3601c93ce389089c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644134217, "uuid": "fd62343c-b970-4fab-ba38-32a8dbaf4402", "value": "T1F2D2E449B7F99F27D8FA9BF86572A40157F2A8AF2960E71E4DC130CE1627F104A50B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644134217, "uuid": "6fb2f35d-2f38-42a7-84a3-f22f60232a2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644134217, "uuid": "f205936f-a8dc-4ccb-9053-ca556f73cc34", "value": "384:qBuTpxRzqQzWqpARNVaTCFAaqpUxcC0FxJzHMfKmsh3//cjtNr8Y/+D+TsAYKztc:/2RnECH8cKvdcGK2jC5t7JSrn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644134217, "uuid": "ad81f4f3-677d-46b4-bbd6-39a40cbc1b83", "value": 30208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644134217, "uuid": "c2d923ae-1ca6-449c-9128-422c5919fac2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644134217, "uuid": "41d8b685-bfcf-47a4-b7a1-a0cd30e0e309", "value": "9805d089929af6e88a928c5db365ff46.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9462fc7-8766-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644163607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644163607, "uuid": "fdea5d7e-1bf7-4787-8aae-1e1edb1dac51", "comment": "Malware payload", "value": "e004424c68afaaf02a88a2bc32726287", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644163607, "uuid": "b8d87a74-0700-430e-8e48-c017a631476f", "comment": "Malware payload", "value": "fde3d4f799a4035feb109f203c16b43590f7e950da7f1ca5b648dd99d4631fc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644163607, "uuid": "21e94398-f52c-410a-91f5-0941d2a6e54e", "comment": "Malware payload", "value": "1a6de05ea038691d1c7b039f032fa29c379a0fa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644163607, "uuid": "ad74e1dc-4b1d-480e-a607-f33664fa50b1", "comment": "Malware payload", "value": "cd0c521588e0b8a15e44e68b8e94abfc228a0e0b51437837a9d1bde6125a8ac5fd9cc428489486eb1c65581d4456fb7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644163607, "uuid": "b84cae6d-dc20-4ce1-90ff-20d65efc59e3", "value": "T12B442262BDB72607D88715B208B06A41EC3FD416F740AE547A7FCD8399F65B190A33B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644163607, "uuid": "166bae7f-2c59-4675-91fb-be4285220462", "value": "acc384cfc66d33262df1bf4ba30ff02d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644163607, "uuid": "ab2f4d0c-46b5-4131-be91-b0720da95ec6", "value": "6144:sBABAdbouCA9dctS6HrFGDrbyyu6vzTr5dNKTToAH6s:smB0OCW1gDpu6nrcVas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644163607, "uuid": "5aef5157-001e-4cc6-9335-6303baecdbc2", "value": 261120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644163607, "uuid": "ea1b9599-f883-45e8-90ec-a5012588e539", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644163607, "uuid": "f1e77ce1-436b-47b2-8b33-43879bffdecb", "value": "e004424c68afaaf02a88a2bc32726287.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc42cde9-87a1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644188952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644188952, "uuid": "90a215c7-a476-45d1-8ad3-07b7ddce6c31", "comment": "Malware payload", "value": "cc8800c7010b055595e0a3b76c48b9a4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644188952, "uuid": "18ba39b0-4e1c-4b8f-bfa9-b9cc7c4d309a", "comment": "Malware payload", "value": "fe4d1e58308ca6a5cf3ecaf60e983f28ecd0cce4b059b2acd1e2254c8c546e54", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644188952, "uuid": "031ecd58-caa5-46a9-94d1-206f4dc4f688", "comment": "Malware payload", "value": "414849a5171065a8722dce2df89bcec6c4bcb271", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644188952, "uuid": "90356f55-f98a-46f3-a64b-215edfcaff39", "comment": "Malware payload", "value": "ced49a1181b7e414bbc0a73c58f53fb44c2a4f3d6c3ad5a2c79442a6c4d00399f2a0339157fa50c4f3240969a6b78897", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644188952, "uuid": "fc9c1219-7d59-4db4-8c4e-e45a63ccf027", "value": "T18DA48E3D75A0A435C37B34F076FAD2B3949FAA524B28469797FC412B1E2D5828E3850F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644188952, "uuid": "31d23ce2-5a95-482b-8b2e-d23345dcb363", "value": "7247c2c21974aac9c8163fb2b0a2c7b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644188952, "uuid": "01a8ecba-af48-4536-9558-21eb405db3ed", "value": "12288:FMEB4sjSekFwPNWzomLEX/SXzA+UeV84+B:FMuXNkFwPNYEX/wWeV84W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644188952, "uuid": "70b2acaf-964a-4049-8315-21473a628211", "value": 473961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644188952, "uuid": "06152a53-582e-46a0-b5ff-c243c3304284", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644188952, "uuid": "56beb4d7-f905-4e0d-87b3-465caaaed6b3", "value": "emotet_exe_e4_fe4d1e58308ca6a5cf3ecaf60e983f28ecd0cce4b059b2acd1e2254c8c546e54_2022-02-06__230908.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }