{ "Event": { "published": true, "date": "2022-06-08", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-06-08", "timestamp": 1654732982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "766205fa-99e0-4624-a641-3233357ce421", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cd5bec3-e6ec-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654666365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654666365, "uuid": "d0f5c288-7895-47fa-bfc9-69c09ebc6504", "comment": "Malware payload (Formbook)", "value": "139050b76b50c7ddc55ad7d70e1369e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654666365, "uuid": "6cc414ce-1c64-474d-b738-db9feee40638", "comment": "Malware payload (Formbook)", "value": "00509d2de60dcdf523ea44b90e5dbbb510f6298bcd9810686ea625d33160176e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654666365, "uuid": "7888ec51-2a4c-4628-a908-5a4a6693d019", "comment": "Malware payload (Formbook)", "value": "3e0129ab7d7950170b92945347be4a8ce1c14d82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654666365, "uuid": "f97649f0-bf54-4bd7-a88b-34393a130153", "comment": "Malware payload (Formbook)", "value": "45f2b831c6c3bdeab76209f5236d24b6b145afc6275cef35320857cdf7a1907ed4aa2501dd7fe2f674ec376548c67cfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654666365, "uuid": "2780ad44-8f78-46c0-a0a2-b4b5021d70db", "value": "T101D4121437E85BA2C97D5BFA9C65004147B1A267602BF70F0EC135DB0EAABD0C96772B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654666365, "uuid": "05bf51ec-244b-4973-a356-872279155b49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654666365, "uuid": "94586679-cb01-4ba3-80cd-9f6247d53e7e", "value": "12288:w4htPoduPmaECQVyXeoYEI0BnxsHUVucwDQhx79Gr3Pbo9q:PPoduPmh/YXenEPFx8Zc8Qj794bo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654666365, "uuid": "b93efc74-4ceb-4d50-8574-187e25b18224", "value": 650752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654666365, "uuid": "6becbe8f-2a8b-48a9-aa22-eeb3bef33984", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654666365, "uuid": "ab146ce2-ff1d-40f8-a599-d8cc969295b0", "value": "SecuriteInfo.com.W32.AIDetectNet.01.8099.11456", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b2cca1d-e6d0-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654654336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654336, "uuid": "85d502b6-d7ea-4258-a136-068c59d64176", "comment": "Malware payload (Heodo)", "value": "bae83ac8db7ee7a03a2482764d319137", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654336, "uuid": "c47ee1f2-3c3c-483c-91b9-89f1d7992e2c", "comment": "Malware payload (Heodo)", "value": "0134825e97dc5bab73bd6829850e945a339487e927d6d1c5945fc70bdadce657", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654336, "uuid": "f6b8a359-b892-48d2-a88f-bbe6e55033ca", "comment": "Malware payload (Heodo)", "value": "43f4f87480bda78dd69060c12c8f5656351642d3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654336, "uuid": "260a2e6f-a56c-463b-848f-cf9e8d15e431", "comment": "Malware payload (Heodo)", "value": "3c5d589bda015e6a0a095d353680f9e387a5556a0c805be0b2b0763e69e0e6e72e05904ad01ebee2e51dfe3b8a0cf1fc", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654336, "uuid": "367d794b-9b8b-484b-bd78-a078d40117d3", "value": "T1F304023EE5031A98C22ED8FC58EE6DF9D5F634006268063A1BA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654336, "uuid": "f0770985-9d6e-414f-a5dc-774624007097", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654336, "uuid": "a46b0005-730f-4051-85e4-319d4ba34778", "value": "3072:VpjftkFs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VRKi1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654654336, "uuid": "80cf71cb-bf2b-472d-8c41-8a44f1941a48", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654654336, "uuid": "bbb2e5b8-4cf0-43ae-bc03-5d24fcf0a277", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654336, "uuid": "217965ff-5bc4-4b9a-a6cd-93059dad3f5b", "value": "bae83ac8db7ee7a03a2482764d319137", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2aa7f99-e6f9-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1654672119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672119, "uuid": "047c5b4b-a631-4146-9105-45440c64ccce", "comment": "Malware payload (GuLoader)", "value": "12b2426deade6eedfe076fd6ebe61461", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672119, "uuid": "1b1401e1-4648-4f41-85d3-90c324b33678", "comment": "Malware payload (GuLoader)", "value": "0141651f2a28bda2fea909dd73f57a510b911fa61228a3159dfd1fc6fa005bff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672119, "uuid": "25d4f629-0313-43bc-ba0b-e96b0e915021", "comment": "Malware payload (GuLoader)", "value": "3388742bf8d689d598c11f0f9409478d70dbf530", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672119, "uuid": "07568626-6c25-47b3-b907-76692ae41228", "comment": "Malware payload (GuLoader)", "value": "2632dd46849d4b32d13ac5a71349eb4124cd1cc5c3c12bb92aa8820d491f1e9a12ffe76503e56f19666cc3c2a6b3005a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672119, "uuid": "b0c7e3d7-731c-4ed7-bba8-b460d0a21914", "value": "T12294CFD1B11045EDEC7A173268274DA61D932CBDE6B5D11C61FA32227FF72A3002E66B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672119, "uuid": "a11ec52f-bac4-4b1e-8c18-d34d31d6def3", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672119, "uuid": "2c9c3461-577b-4874-8eaf-8d89785ee2fb", "value": "6144:AbE/HUAWVqB0X88nOc9h3CLeT+SpuGvpPVxjG+ZZ64v0c:AbBW0XlOmhS69xbLZH0c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654672119, "uuid": "b9aa0f18-d512-420d-9934-063a16dd2b66", "value": 443528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654672119, "uuid": "6cfad588-ab75-458c-8697-c9f3d8864e62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672119, "uuid": "700e2174-75f1-4adb-9c1f-f60e7d324ce4", "value": "9009876545678990098765.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b5ca8d-e722-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654689576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689576, "uuid": "5564e8d3-063f-45f2-a613-5eec731e9c94", "comment": "Malware payload (AgentTesla)", "value": "dfb955bcc1ee255de7884d82a4293449", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689576, "uuid": "98a584ce-3997-49d3-93a1-15cb851087e0", "comment": "Malware payload (AgentTesla)", "value": "01b9dcef06125de378e0a88f398cb651e2b3200eaef8d4847136b1dc6560057f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689576, "uuid": "d3fe4002-0463-49f0-a4ca-21b57e8a3cb0", "comment": "Malware payload (AgentTesla)", "value": "6afa626be8675bddedfd9026cb1a441a919b9ffa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689576, "uuid": "a43f12cb-d6be-45d5-978e-ac94582d910e", "comment": "Malware payload (AgentTesla)", "value": "abece6a0f1fcf22fcb862fb90773e49998420e1edf28829bc175c7da7b162dbfaf756d5586acf2a3f7e6073d1ff3477a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689576, "uuid": "3b69e497-577a-4e78-b4b4-7aa8c50c3dc7", "value": "T11905D001E5FB8E72E6964377C4D65820D3FB8202D1D7E76B324812E5AD437DEC952AC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689576, "uuid": "d9a5771a-b5a8-41da-b8b8-4efa78272ef1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689576, "uuid": "e1260f4a-29ec-40e1-a9c6-c0f45dd1d43e", "value": "12288:3dpimWAfhE9qtJNCvTPi5cLYHI+c7FqkdOCm84ahwAZvwUVTA7goNuG:PIAfhE0NCrPi5LIMCmhJAZYUm79gG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654689576, "uuid": "74ca5332-d771-47bf-a971-1c159958af83", "value": 812544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654689576, "uuid": "e13894ec-e397-4e0d-a2ee-c6fe4f7398d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689576, "uuid": "3682cece-400f-4e63-866e-31e1d71e565c", "value": "PRE ALERT DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e12ba659-e73f-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654702208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702208, "uuid": "fac80c8c-cb50-4f07-a59a-1e121f27c750", "comment": "Malware payload (Formbook)", "value": "b6b36dae4c1320985cf635679b8c3187", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702208, "uuid": "e7286a3e-1cc9-4ca7-9d33-860bd6a862f6", "comment": "Malware payload (Formbook)", "value": "024cb5cb433bfd8e1b5e55016311bd477800b58b662fbaea35af605669c61fa4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702208, "uuid": "298fff72-fce2-41c3-923c-18cbeb721222", "comment": "Malware payload (Formbook)", "value": "f16d4f551d089b4332d1d373797e714709bfa71d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702208, "uuid": "5288bd45-4edd-457d-99aa-63615336ec48", "comment": "Malware payload (Formbook)", "value": "69060119d67a7d2aceaa99066eb54d4b09098ff09654cc71df6227d794d12df4f6f73cf1805c627fcc4184401ab38bf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702208, "uuid": "c1acd617-bcac-4440-863a-f12450945ebe", "value": "T1D373EC7260F2A5D5FAE99EB3AC158184BEEB5C18CD12801EE01971F51673BC8C25A4FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702208, "uuid": "aa4b55ca-d0da-4ec1-b44a-fe885419cdd5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702208, "uuid": "b9e40c27-57ab-45da-90ba-e186024ec401", "value": "768:+Gfh4bodkNdVxf6666666oVZPzSNxWP9VUAKQ/e+/5fYxNSk6666666O2+/y:Dfh4bkkT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654702208, "uuid": "edc8f758-f7e5-49bb-8ced-ff5d0b14d43c", "value": 78336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654702208, "uuid": "643b9b8e-0ad7-4c6e-8df5-95d222fadc28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702208, "uuid": "89382dca-c355-4ac8-929f-91d91c66f2d1", "value": "IMG-20201028-WA000332.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff8d2d77-e732-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654696676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696676, "uuid": "e7bf182c-bd1e-42dc-b826-3c1d1523ab63", "comment": "Malware payload", "value": "c16ff66bab45271e0035b5479315fd7a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696676, "uuid": "8d7c2a37-84bc-4ec5-9b4c-60a4a7ba71bc", "comment": "Malware payload", "value": "0259ca681d4177ebefe238f65856ac0560b6d60ba7a6d913080daec668736663", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696676, "uuid": "535ad5c6-7f70-4040-bc8d-f935479eed6d", "comment": "Malware payload", "value": "579be24fe60541e5c58ba8fa1b290fe8eb8bb1b4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696676, "uuid": "c89c18d9-c78b-4fe6-80f7-6a2bd22b0685", "comment": "Malware payload", "value": "b88606e86ec7bfc8c08676e8c88cebb0e7c3628d7aacef6d94fe60bfce1c7060fc1492cabc9a4f3c224080b47097a67e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654696676, "uuid": "6443d90e-0a36-4d64-a975-32e9e5a4f85a", "value": "T16C33E0121D3CFBD1F4A58E3DC6770A5B738948E885A4B610631E9ED2AD92D5389F04E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654696676, "uuid": "a9ce7fca-974f-4bdc-8814-d12f62dfae54", "value": "1536:8WexEMNCZLMZnudKUlI4jPkTkKFpI3ACmgo:1Z+nuM8b//3ACFo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654696676, "uuid": "7aa41232-6266-4f32-b4b7-d052c0eb8c32", "value": 50356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654696676, "uuid": "c8e6ef07-a215-40ba-a6af-58af29ec6f57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654696676, "uuid": "9d28e3a6-c531-406e-919f-c72ae432920b", "value": "gummy.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4fece04-e774-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654725005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725005, "uuid": "f05a541d-3d35-46ad-8535-86af99696d66", "comment": "Malware payload (Mirai)", "value": "dba4ea41b1c02e7c21843597e515e768", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725005, "uuid": "0df24c2e-2f6b-4f87-ad00-7f3686d5c713", "comment": "Malware payload (Mirai)", "value": "0279dd08074970341c66f1cb1c0e762f91b45f8c5587b2ebe287ea395b0152eb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725005, "uuid": "c0f9ed7b-527d-4897-9f48-e5ddee65ac7d", "comment": "Malware payload (Mirai)", "value": "520d3b7dc9331fc6ba04821f2fac27653bd6716e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725005, "uuid": "969a0820-e5ff-4c32-9a4b-0ec02f42f53d", "comment": "Malware payload (Mirai)", "value": "a46cbbbc843b041eb2ed94b88a192ef8972551bc5b19d4efc336c20fa2a9917ecb211be6b85b4d3144456a8c528b85fa", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654725005, "uuid": "be2b2c7a-9137-46bd-aae8-f4c22b2594d3", "value": "T1A3E34B46BA409B17C5C227B7FA9F41463322D754D3DB330689289FF43F8BA5E4E26606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654725005, "uuid": "920f5fcd-20e1-42c9-8119-39dcb3649f60", "value": "3072:ZD6yU2wDvaYJi7Eb9BR+lfEOvHtjAAMF8Uj7badpWHjuQM/9f/qEDG:ddtwDvaYJi7EXsRAAMF8UnbEWHyQM/9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654725005, "uuid": "1917e8f3-6943-4773-836c-b5cffe667697", "value": 143896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654725005, "uuid": "1ce2ee81-9d4e-4596-8af8-b6c0fffad0ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654725005, "uuid": "f674b1e6-556b-43f0-b506-595e37ba2131", "value": "rift.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bda63e01-e70a-11ec-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1654679385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679385, "uuid": "50bef6cb-1712-4c65-b3f3-e5d9d998e29b", "comment": "Malware payload (SilentBuilder)", "value": "c481f7563bef874c11cd8f1fb0468c17", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679385, "uuid": "cac6c77b-51c2-40f5-9bc2-c7ad70d95c02", "comment": "Malware payload (SilentBuilder)", "value": "0294cfe5681e3c46e586bff78af90452d84f26f5fc3db783e172aa21c61f5714", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679385, "uuid": "434cb92b-926a-4ca7-a488-d698c4e7eb8e", "comment": "Malware payload (SilentBuilder)", "value": "c1c79c12a0196c04fc12bb3ba4dc7675d7cb945c", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679385, "uuid": "88639cac-6f18-41a8-86ea-d00e5c6751ef", "comment": "Malware payload (SilentBuilder)", "value": "d330b5bc836967b3abf0bc7693facc81351f54c33034513385868c96a58431ba87614635f5fd1dcd54339bd87372964e", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679385, "uuid": "7f1b8a32-0996-4c69-a82b-daef9c6be2f9", "value": "T11C23A446BB5AC85DF914873448E747AA7323EC314F6B0B433669B3256FF89A05B0315B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679385, "uuid": "3276cb6c-01f4-49a8-830b-2d51d9c624a4", "value": "768:pDMPKpb8rGYrMPe3q7Q0XV5xtezE8vpI8UM+VQTUs77quK7KtGu6E:pYKpb8rGYrMPe3q7Q0XV5xtezE8vG8Uq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654679385, "uuid": "735cd430-bb22-45b6-a99c-df81f405be60", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654679385, "uuid": "05897d59-bde3-434c-9d2d-7bea9e50d597", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679385, "uuid": "a69380f0-0ad1-4564-8546-226105622219", "value": "RechnungX2022.08.06_1104.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83065958-e74e-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654708493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654708493, "uuid": "44590d51-a763-4456-b21e-d1ecccf76e6b", "comment": "Malware payload (Heodo)", "value": "d69df9a9602f03ae18525bac7651c1d8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654708493, "uuid": "4dd222ea-b371-449d-88e6-4aef024a8d52", "comment": "Malware payload (Heodo)", "value": "02aaf083124e0064c6d00f7e1d5228e7cd401a3c0f96020124fd17dcd36f49bc", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654708493, "uuid": "88aec36a-498c-40e3-abfe-229ff4c2f095", "comment": "Malware payload (Heodo)", "value": "6dc15da4eb78426b9d97747b6d33a53b763ca50a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654708493, "uuid": "b72b2df2-18d1-4029-a56d-dc264b981d61", "comment": "Malware payload (Heodo)", "value": "22f4965d2abc9dbaed7829dc1b73dd3f6a2287e04673854b183028471f8b823d06c0a4046a9cee54c479be2b50f46249", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654708493, "uuid": "59bc3214-8466-4e95-a5c9-864e0c26dbb3", "value": "T146B49E17A69194B7C086C330D5DBA731B331BCAD07239A2B5A61C7385EA67E04F6DB1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654708493, "uuid": "a230cd8a-723c-4c67-94b1-971a0d4c0571", "value": "17a9db8a367c83d15112ca6763718dff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654708493, "uuid": "c750dce3-3c0a-4666-9be1-03d1827ace95", "value": "12288:9OT6sIypRSjjElCBQCRbpNdUzJwxDD2+UkoX8LlGf:9OT6zypRSfyHCRbyKVD2+UkoX8hGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654708493, "uuid": "f8ec4823-222e-4579-a032-1c27167610da", "value": 522675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654708493, "uuid": "73ed5a02-47eb-4cf0-9cc7-37da3a67cc36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654708493, "uuid": "b80ecd9e-4c13-4dc4-bf61-fa20226997f9", "value": "CS9MPM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70194078-e738-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654699012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699012, "uuid": "f55f4566-7092-4c8b-9838-d00782a6d405", "comment": "Malware payload (Formbook)", "value": "f8dd6cbc17573f7bd0e0beb981522c86", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699012, "uuid": "119404d0-48f9-4967-a8db-2524ae826324", "comment": "Malware payload (Formbook)", "value": "032d8c993d7dffbb2d0c52d13afd4aa7d17a324c241c7f8cd453307ef66ab818", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699012, "uuid": "e7eaa6a7-1dd3-4f63-b7f8-2f1c169d6a7e", "comment": "Malware payload (Formbook)", "value": "9eae27f905c0b07f3dc4da61a8bb94257d840ad7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699012, "uuid": "2767427c-7b48-407e-bb26-1aea21c102df", "comment": "Malware payload (Formbook)", "value": "4ff4fc263298d37e42c3e7a04d66bb3403c3203b0efa7dd631303a5d05e3421c520f5abe9e56fda1d313924f3be9a209", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699012, "uuid": "bf9431a9-9afd-4425-98e3-d44ac90888b1", "value": "T14D121ABCE1484FDCCF4871F46B1A3D48008EBD5963C4B0E3B97D67614B5627EA60B8A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699012, "uuid": "c41570bb-d971-4153-85e5-8271db0d8c46", "value": "192:lRLCz1nUVk+J7cQcW+dgAgLvRjq3QtX6HrWuMakJtnhPKwuJK46es:lRLEnA/cDd8dleCuMNDPT6D1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654699012, "uuid": "085ca0f6-ddd1-44a7-a29d-7d6a86e2cc08", "value": 9032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654699012, "uuid": "8452e462-6b5f-4d60-a260-0ab029b180b2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699012, "uuid": "b4fd8318-a0c8-4634-8469-3156e4a0b768", "value": "CV.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d547d3f1-e76f-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654722804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722804, "uuid": "2686a5f2-bfa5-458d-9463-ad220f074966", "comment": "Malware payload", "value": "6aee108087817b0ca4ce0835ff4d7905", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722804, "uuid": "3ca24285-9b35-4ab3-909c-017e96845acc", "comment": "Malware payload", "value": "0341ef51d2ea3d5ec4d0341a78751a3e642d2dedd55020a511720a23347395d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722804, "uuid": "e4a5c9ef-b20b-44a9-9345-57121c0ee7ab", "comment": "Malware payload", "value": "d69234a4bfb72b4b7bff4aa07413df86d4476540", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722804, "uuid": "aa3f0846-e154-4b27-ac0d-cd18d4a71ebc", "comment": "Malware payload", "value": "6de3ba6c82cafa64f2e1d4e5294744c4213f9e2eeabd00cc8780eeab29b45e4fb4ca5152faa25df5a81ca12063a63746", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722804, "uuid": "dd6a0f24-d49f-4704-a939-cae4f0cfe0ad", "value": "T169051947E77341FCC96BC97483A6A732B930785841397E2E4F84DB226F61F20952EB64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722804, "uuid": "a3c3a278-7dcb-4204-8a02-16040b64b095", "value": "733e4ccf9ef47c6e471d93270b5eb898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722804, "uuid": "7efdf9ea-0bd8-4f37-bb49-e2ccc68a9ee9", "value": "6144:Jb5xjIShSnbDu6ee0WU3LdUsypcNfAsubd5x991A6cUPV2m7rlb4rZxcg47wsuIO:JdNIShSnbfaLdUsypcRPub09mHlY9uA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654722804, "uuid": "e0c9a23f-34c1-4ac5-bbc1-b213ec30f37b", "value": 845824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654722804, "uuid": "796ef08b-b00b-489b-9efc-3feb0f51c10f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722804, "uuid": "53cfc110-17c0-4ae8-901c-c1a410a58609", "value": "6aee108087817b0ca4ce0835ff4d7905", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01e5159f-e71e-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654687660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654687660, "uuid": "17cd4ca1-e5dc-450e-8a2d-38d790d1fb32", "comment": "Malware payload (Formbook)", "value": "bcf8103de1bc06182176eaa8c9becfed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654687660, "uuid": "eb358b45-542a-4005-8927-d8f2d866a079", "comment": "Malware payload (Formbook)", "value": "036074f9f86f9b3e2d946c8ae225b017d54f84d1e62cf60d965226a1f7f9299d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654687660, "uuid": "f285b3ca-92fd-42df-ac1e-1e0ed34c90e9", "comment": "Malware payload (Formbook)", "value": "d8b8c4063524d240860ca6aa06c9f8b6055a213c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654687660, "uuid": "97956ecf-c7b6-432c-bafc-599b5259a827", "comment": "Malware payload (Formbook)", "value": "395ca85c24a330e644c07c2b73dbd346325a3657bcfbfee0664d2ca10a9f8eeeb6441b04b9214908d2e8ef47971183b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654687660, "uuid": "30979823-d391-4eff-9be4-649eb926d88d", "value": "T120F4D00179A7CA72E69E03B7C4E34500C7BB814AA9D7E70B264813F96D433EFC566786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654687660, "uuid": "b6f96a41-1f22-4c56-9e9d-49e42dddb76c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654687660, "uuid": "48140206-020e-46f6-a217-9404d7f6cdf5", "value": "12288:ktzzVT1PoRHHhgzcH9qDVEzmtkJqQt7ynhK+QYeNzDKxLYe6OMgzd:kvEhKEkESsvNAWDKlYlOMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654687660, "uuid": "f4bbd4bc-0408-4bda-8982-eb39664b4898", "value": 762368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654687660, "uuid": "b1f0f5b9-ada1-405e-93d2-c04bd664d1ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654687660, "uuid": "4f178b8e-6f3d-477b-baae-fa91c6006098", "value": "Shipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c3b2414-e77d-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654728534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728534, "uuid": "da23137a-be5e-4566-9e62-34ce992887ae", "comment": "Malware payload", "value": "6c10df1e962440d6ff4d4fa6c3998e85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728534, "uuid": "5daa3a2f-fab7-4590-9826-7fc9da479f6d", "comment": "Malware payload", "value": "03a4c33f6f7f7779b380145ac6099ef6af0eb5d255dc899db518850e4d05745b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728534, "uuid": "def8bbce-ac39-4ee4-b21d-f03e08cc399c", "comment": "Malware payload", "value": "e5abb4ee6c55537d24a1ac29afa2425ab5e5739d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728534, "uuid": "986527a9-284e-4d75-8bb7-9cff8b8ebc0a", "comment": "Malware payload", "value": "b3c5e36858c979e8a5ce7b0740128425869e18ffa23ff7060e8379fc49847b351c40e3c969b85607aba0a373aa668061", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654728534, "uuid": "60402889-3fdd-4a38-ba16-2933d5beaba8", "value": "T15E051947E77345FCC96BC97482A6A732B930785841397E2E4F80DB226F65F20953EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654728534, "uuid": "259a4893-c855-4754-a7c0-24a6e2d78a21", "value": "733e4ccf9ef47c6e471d93270b5eb898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654728534, "uuid": "230011b9-6bfc-484f-9261-0243fc4f910d", "value": "6144:v7rc6Wk6SYnaKOai5uWLwrd0jSjc0vNPqBVzLFW3WUPV2m7hzS7583Tg7A+++ncE:vXcFk6SYna2Frd0jSjcc9SFmBZX0TMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654728534, "uuid": "98994702-aae9-40b1-a6a8-fce370fa277f", "value": 841728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654728534, "uuid": "97084104-df98-49b2-bd33-2f7dc00d29c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654728534, "uuid": "df7fa2f7-86cf-4234-a0eb-149d5f0f5035", "value": "6c10df1e962440d6ff4d4fa6c3998e85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b19a280-e748-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1654705956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654705956, "uuid": "89297ea3-e7af-4307-964d-9e518bb38088", "comment": "Malware payload (GuLoader)", "value": "cccb07e753e8e29737927de422188171", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654705956, "uuid": "8ae880df-b472-4a93-b4ee-b34ab63eea40", "comment": "Malware payload (GuLoader)", "value": "04b4300a7104bd33352c148f858bd7de02b72291c29e21dcb8eb4dfcdd1e9499", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654705956, "uuid": "59f3af29-1e6d-4b64-8085-cff5a8ed3869", "comment": "Malware payload (GuLoader)", "value": "8cb3bc7082d53756772fb50f7319f44866efa0cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654705956, "uuid": "b14d9983-d0b2-467d-8b7c-fe24333b8e7a", "comment": "Malware payload (GuLoader)", "value": "acb4dbb213e24967dc8de1bd5ad128ee9a7b1c9cdce828a560957270db8daadf5f904ec4a7f3d9b7f994bf8609964de6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654705956, "uuid": "3a2e8c1a-3143-4c6b-826c-2af3dfbe0efb", "value": "T15314021876A2C1E3D4F2097069B6AB626EED631306A4571F47203E0D7E73BC0E61E776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654705956, "uuid": "fe95b413-a489-49e7-9cd5-955be13a3868", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654705956, "uuid": "34880302-4df6-4e5c-8021-0a649a7cf1d1", "value": "3072:61NjcVVnLpPuFRbl2FnzXjP5XugeLkFDLH50RQJs4k7GguoJPHs5jllAj46kmA9Q:aNeZ2Atrj5X5PHWqJa7GguoJ0Ok6rAa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654705956, "uuid": "942b045d-77c7-49e5-891b-7947cae383ac", "value": 199480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654705956, "uuid": "b163f8fb-2cd7-4ec8-b068-0c7d4e4041ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654705956, "uuid": "7ac52d56-085a-4845-987f-32f28e5d755f", "value": "HYIS2206506 PRE-ALERT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2263e59-e706-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1654677729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677729, "uuid": "ab3ebce0-2036-48bc-ae2f-d3ae4a42a76a", "comment": "Malware payload (SnakeKeylogger)", "value": "118e374ef647b59bab9fd5a48eadb549", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677729, "uuid": "535fae66-6b07-49ff-98f6-1013bec22f15", "comment": "Malware payload (SnakeKeylogger)", "value": "06bf758c09b920259a4408855cdcac6a5d09d30370a32ec500cc90b1bf057e17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677729, "uuid": "a655c5a5-71b7-43ed-955d-59c6629f1f9f", "comment": "Malware payload (SnakeKeylogger)", "value": "3143c54e77679736b1c148df680e0f7a2515f6dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677729, "uuid": "8e60f382-af83-4b5f-baa2-09b7f8ccc4aa", "comment": "Malware payload (SnakeKeylogger)", "value": "81e126dbe115000d77f99ef8cff165d47d58dedd3f7c9689b8560020a9fe1acab0b7f498a1ffb59ed7fa0a242e8e3376", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677729, "uuid": "d5ab2307-9c2b-47bf-94ba-bb6bad3d4f46", "value": "T10EC402293AF90B62CA7D0BFD98A5064003B19627596BF70D5EC171EF0E77B91CA12723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677729, "uuid": "ecde14c9-350c-429e-9b62-ebbfd3c94353", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677729, "uuid": "9fa669eb-d112-4756-8abe-58966b4c4443", "value": "12288:WiQHrd+P2qfauvt00o+39YasTNfkZDX17tZ9XaSbo9q:8HrdEVfauvRoSyf5SFxZ9Rbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677729, "uuid": "b115f72d-6f6c-440b-aaf1-76f99c84a3ce", "value": 596992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677729, "uuid": "48921d1f-d4cd-4f39-90d0-e5d3227a348f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677729, "uuid": "acd403e5-c1f7-45ee-a7d4-9046b1c082b3", "value": "Bank Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc0b92e-e705-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1654677319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677319, "uuid": "87686630-5efb-4853-a8ad-67d187128307", "comment": "Malware payload (SnakeKeylogger)", "value": "d2a78db1f7f753450ea0f48c56b83601", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677319, "uuid": "237c33d3-7f11-4756-8043-47c41699ccd8", "comment": "Malware payload (SnakeKeylogger)", "value": "07e117ea443e83b38b94b4b7324adb7ab1beeddae58e40951a2de4956582f3db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677319, "uuid": "a7ec5575-326e-4450-bba9-1a5c65bdb837", "comment": "Malware payload (SnakeKeylogger)", "value": "9c37c6eda92639d5a770e111e3d7655378c702df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677319, "uuid": "3600033f-6ad5-4928-a8ba-2cdc8e86f1b5", "comment": "Malware payload (SnakeKeylogger)", "value": "e8f7cb0b883bc094d7e9c43ab24d7b8a72ad1dc3771a589bddd9dcfe12809a48597368de963152ebaa2aa6f4844b3402", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677319, "uuid": "53b8a280-ffaa-4613-ab03-9ebc9a659eaf", "value": "T160D47C12325D3A49F57BE7725416C43003F2BE1FB726E68D3ED71A8F6890B068276726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677319, "uuid": "aed77fad-6e18-4f2d-8ed4-389beffb46b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677319, "uuid": "3d1e4776-3c9f-4c72-bc07-8901ee4a20d1", "value": "12288:2+znoXcHwljYqr3nrQS8pBB8uQVhdz8QhS2kftkku4nzSr:2+znoMQRJ0jGvSQkNtkku4nzSr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677319, "uuid": "3a9caf35-92ea-4174-90e0-beb4a374b72f", "value": 654336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677319, "uuid": "ec53211a-15c6-44d9-8871-7e314c771c23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677319, "uuid": "a6aa84da-c54c-48bc-bd65-a126b1512b05", "value": "d2a78db1f7f753450ea0f48c56b83601.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c35138b7-e6d1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654654914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654914, "uuid": "79c78ccb-daf6-41e6-b27f-924db9d55b85", "comment": "Malware payload (Heodo)", "value": "7ab825827f7c20f91bac9433dcdb8863", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654914, "uuid": "d2e1e682-3b56-4950-9168-d4b0e1f3870a", "comment": "Malware payload (Heodo)", "value": "08707caaa85ed34c276fccfb8461916ca6497484c2f5524548b5943817f52a97", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654914, "uuid": "7b67e8b7-6f4a-4904-b72f-64b358224661", "comment": "Malware payload (Heodo)", "value": "5a19a0da22362cd475302ddf8deb2d0a3da93db4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654914, "uuid": "8ff9a8a9-94a6-40a3-bfe6-69d88dbb4aa2", "comment": "Malware payload (Heodo)", "value": "7cd61b932bfef11da85c99a673bf49d7e20351d8d70c2a55da07dfd926042cd716ac234838ebb6a5486fd4bd53751647", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654914, "uuid": "73120cf7-5b7a-434a-bd23-234384a8e212", "value": "T17704026DD14C06DDD611137CACE90F3392FCF980A0262B5BBB70A6774BA4B96DB5B900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654914, "uuid": "6c73b887-9dd1-430a-8c6a-0af279d8f8bb", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654914, "uuid": "5502ed0f-ca45-4f91-92c3-af8f5f2a9b07", "value": "3072:rpjf/FcO4J8FYMh1PAzu8GmeR8dk5pL/rRn/02QBgjVcoe5Uy5i6zNL4ZNgzPKcQ:rRHWW6u8QKkXzN/09gjV/eey5/NsAziz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654654914, "uuid": "7d10c595-941c-441d-bba2-8ff8651c2e3c", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654654914, "uuid": "f7cd792a-238d-40ca-9954-cc1145b47462", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654914, "uuid": "5f4be247-b38c-4aeb-89c4-5c00da518639", "value": "7ab825827f7c20f91bac9433dcdb8863", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87bb7180-e733-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654696904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696904, "uuid": "5f04d085-9a30-4862-bef4-f0ac4c5102b3", "comment": "Malware payload (AgentTesla)", "value": "eee2aa5ef3b67e8b05ba5b3d631a636d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696904, "uuid": "8234d2c2-dce1-4522-8c27-f0c57d706342", "comment": "Malware payload (AgentTesla)", "value": "092901ddbfe4a5016f73b30bd2a92f30a1db8752621388f803957bd9b2b02077", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696904, "uuid": "a0ae6572-291b-4484-abdc-2c1c40fa354d", "comment": "Malware payload (AgentTesla)", "value": "3aff1d3111bb49dcd2218e42fd95a61aa810de9e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696904, "uuid": "75a821b5-4573-48e3-a87e-662bf016a792", "comment": "Malware payload (AgentTesla)", "value": "af75e98b3a3e9d0bdd1dc0e46d23912853588d3cfdc5e6b5f98ceb0db827c6006ed1569a7b99452afaecb9fb5e5e71e2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654696904, "uuid": "642e557f-239d-4267-9464-7d21982518db", "value": "T18F05E10571E79BB2F2954773C4D28420E7BB8646D29BE70B360813E5AD43BDEC84678B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654696904, "uuid": "b60d230f-1e5b-4198-a518-32396812c1d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654696904, "uuid": "22262c53-f8f4-41db-a51b-002e7ae92cd4", "value": "12288:WFOOzZPxVciwHomhD9qhZLUa5Pt5V1zXDx7L6qRkISyCKP1aJI6:+RxC+mhD4LUav5V9XDRL6qOId1aJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654696904, "uuid": "41387db2-32bf-4438-8b4a-fba7ffe396fd", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654696904, "uuid": "7423fce3-c67c-4a1e-be0f-19c8aca4f86b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654696904, "uuid": "9565b600-a913-4cd3-bbf4-f25f6942cdf3", "value": "Statement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6a43e7e-e6fd-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654673871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673871, "uuid": "648482a5-2b7f-4b4a-bc2b-b09c61d6d4f7", "comment": "Malware payload (Heodo)", "value": "85f6fc87a4c7466e4a1a9500c102bd7c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673871, "uuid": "56643b87-9273-4bad-8bb9-99c31c3dab69", "comment": "Malware payload (Heodo)", "value": "09934f75691dc44fe1ca287521e3872c712c38aef42080600373b1804d8ee9fd", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673871, "uuid": "894c83f2-6ec6-4aec-8c1b-54035860703d", "comment": "Malware payload (Heodo)", "value": "70104d9da62be462eb2fb26372bf3f6cd2059129", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673871, "uuid": "716e0f61-b3f6-416c-b4f0-08cca4730684", "comment": "Malware payload (Heodo)", "value": "0adb7c49f3bcd6f59f9e12d84e7df9cabd00124c00754e28e15e7aa52da9e20d26f7185e2e07aa95094496b92d8b3542", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673871, "uuid": "9ec262c3-3653-4b2a-a51b-80d767443012", "value": "T13144C089ABE1ADDBD51407798DD6D324333EF2814B838B076B2598390F23BA4BFC5645", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673871, "uuid": "6cda5061-34de-429b-bf53-b422ff908e33", "value": "963f2e88a5b03877d0583808b2526c1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673871, "uuid": "2f8da5de-6d22-4e3f-8db3-ba00d6b07614", "value": "3072:7R7Ye82w+Oh+UjuFJrfr7CS/FmikytkqroMdjaWtHCqPZ4PEx2ES2vZg3f4L5ZJi:7lfJuk4uFxOmFwytLVxDtfPZ4PE2sPs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654673871, "uuid": "e50d4c18-5ae6-4344-864c-fa22f10ab237", "value": 270403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654673871, "uuid": "4bbb2722-c808-4247-b855-7877cc5d36b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673871, "uuid": "a00a3a73-2189-4cb8-9d4f-e904ce08253a", "value": "85f6fc87a4c7466e4a1a9500c102bd7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aad21eea-e6d1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654654873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654873, "uuid": "50bc840d-f1e7-4787-96c4-bf65f44d8584", "comment": "Malware payload (Heodo)", "value": "ce050bf59755ca9793d61062eba528b4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654873, "uuid": "b171b05a-fc79-43fd-a405-d22a1a8e1f6d", "comment": "Malware payload (Heodo)", "value": "09f927b9d9e029d09c4c5c991b147744b394dd29f9244ed2b7db2fe68874f8c9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654873, "uuid": "da63c8b4-cb68-4c58-b49b-4a3ec12d6301", "comment": "Malware payload (Heodo)", "value": "280637ddc5b40c91a05ca915db870e84a9ca346c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654873, "uuid": "30e0daaa-05c8-4ba2-83ab-9b5fccd4b893", "comment": "Malware payload (Heodo)", "value": "93c6560a08ae3fd15570cbec9093c1b763708973cdec82acd51ca3f6ccf37e0193e4478ca8a3ab8a421446ea4e8da2e4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654873, "uuid": "36f95b74-be77-4500-b210-28b9d2551e3c", "value": "T13504026DD14C06DDD611137CACE90F3392FCF980A0262B5BBB70A6774BA4B96DB5B900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654873, "uuid": "18fc59e0-3ba0-4d3b-b9c2-5187ba72eb41", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654873, "uuid": "db8e17af-e8c5-4b2a-bac5-a196f0e80790", "value": "3072:rpjf2FcO4J8FYMh1PAzu8GmeR8dk5pL/rRn/02QBgjVcoe5Uy5i6zNL4ZNgzPKcQ:rRuWW6u8QKkXzN/09gjV/eey5/NsAziz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654654873, "uuid": "35b8f98d-3cca-49d2-b538-19d7b297a848", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654654873, "uuid": "e7126a89-3100-4c13-bc24-8e852ede3d91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654873, "uuid": "8893df68-5fd0-4608-b73e-a0a8ad0c0c4a", "value": "ce050bf59755ca9793d61062eba528b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6db5a14-e740-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654702567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702567, "uuid": "f86e8b71-9a8f-46af-9fab-44da0edac095", "comment": "Malware payload (Mirai)", "value": "430b336ed74b88b70a472abc6857a4b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702567, "uuid": "7fcb64a9-d754-4f41-aee4-3ef100ee40a1", "comment": "Malware payload (Mirai)", "value": "0aeea653660f1889ee7fb0f71eb0418a5f18e08394f6c08eca8a977bdd2e3e3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702567, "uuid": "972d2348-d90f-4712-8bcc-12248c42bbd6", "comment": "Malware payload (Mirai)", "value": "e13429849837ef18c1f777888958c3281e7c43b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702567, "uuid": "bff9b8f7-cc76-4ec9-9f43-8727a52c4cae", "comment": "Malware payload (Mirai)", "value": "9c4a5a24f0c4154a5c021791222e43d0e4049ea6f4dca5e49fa9a59d4bfd750fbeda790079d6ae44bf755f2829dda20e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702567, "uuid": "58df778d-e29d-40e7-aa6d-4d7c8b202e4d", "value": "T1C592C06463ACEFB0CA711C3CAE75C2927A4646BDC2FB70632540092D5AD652A23F41D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702567, "uuid": "11d11779-7a68-42ed-88d0-07c6de5bb56d", "value": "384:4+j5eO+5IouymNQ2eYc9N1yFCzGXvnH+Zwktg1KOpxsevaqL4R2+hymdGUop5hKz:4+Fehiy0QnYkN1BGfoqrpWeJ+s3UozYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654702567, "uuid": "ff658c7e-c2a2-42d7-8508-14297b074cef", "value": 20420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654702567, "uuid": "a96c282d-8f50-4e47-94e0-942656c774a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702567, "uuid": "2ad3306d-8482-4c67-8239-4199bebff371", "value": "430b336ed74b88b70a472abc6857a4b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4dd9b7b-e73c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654700872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700872, "uuid": "9b1dcc54-d1ac-463e-a247-78d7343c03ae", "comment": "Malware payload (Mirai)", "value": "ef266bda7889485fabaf9ffe6969f8a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700872, "uuid": "0e4dd178-7f07-4887-b10d-af6381849b05", "comment": "Malware payload (Mirai)", "value": "0afda424369b91b7e6d2134549f13414cbf8de99a15ea348cde2b0274315230f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700872, "uuid": "0b1d63d0-c4a9-469b-a799-a72d0c49aeec", "comment": "Malware payload (Mirai)", "value": "d39d20044ed18f6c61525b79de4c099da78a3632", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700872, "uuid": "6ec588f0-dba6-4e7f-8744-4bfaf2baad20", "comment": "Malware payload (Mirai)", "value": "8c953655cdb0aa6b18a898a19f6732433128948bb6c76848e2f8812c4b57c58d82293d04ab9c80d6bc95aa73d9dec371", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700872, "uuid": "4ce70b72-80bc-4259-a993-02ed99eac17e", "value": "T1B963AFB2E0165D64C0024730B0F6DE750F63E5C452672DB5AAC182A9544BDFCF62AFEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700872, "uuid": "f78e917b-119a-4ee9-a681-b30ea3aea08a", "value": "1536:hasvIQYbHMwtUM/ijIJtF4/Nkh3jdFfFSCc+rMw:hLvIQYbHMjSjjHfFSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654700872, "uuid": "e12ddfff-8fb3-404b-b2a3-9d9418ae3295", "value": 72732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654700872, "uuid": "b720087e-98f6-406e-bcde-e96b2a27e4b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700872, "uuid": "7f993592-e61e-43e9-9474-fe1fe9ead951", "value": "ef266bda7889485fabaf9ffe6969f8a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb34895e-e742-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654703433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703433, "uuid": "84ddcf45-28ea-4362-a30a-f0663a465d9d", "comment": "Malware payload (AgentTesla)", "value": "99c77d8fa802a1bacc3100b4e87f2181", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703433, "uuid": "95836ab8-9f5c-4c6b-9085-b7df7d02bd3a", "comment": "Malware payload (AgentTesla)", "value": "0b1c3985cfe6fd26489cc745f60cf63e6bea52b410c099e3434befa2c6568b19", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703433, "uuid": "06f17504-0e4b-4ecf-ae3e-0993361d4504", "comment": "Malware payload (AgentTesla)", "value": "702c7e9a7eddb7ada223618e71b744193aac2952", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703433, "uuid": "296b5768-b9a7-49dc-8b15-cd51fe5adf2c", "comment": "Malware payload (AgentTesla)", "value": "87408b5498f4918e23fd1b4c31403e074d84792681eb3384badc6d2a36ec3caa158e9a595b0995dba1dc1759a3a1fde4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703433, "uuid": "55c539f1-a373-463e-baa1-b4454f5383c5", "value": "T15614ACF36BD8C8DEDB586234F3421E1707516DEC68D6A23C1FDE7A29C530A6A60F8560", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703433, "uuid": "72e7f18f-2018-4458-90bd-c743f95a63db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703433, "uuid": "fed2ae8d-8df2-43b6-b438-f7da9d40a8a1", "value": "768:hw13N4bqJhp6kELfJSCChd7ntnR+iEiiiM8n8nsoGGTdjt+++Gvx/bb2exNEzAlj:y94bqNWSjwTOfhhGo8r2PYBU4cIGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654703433, "uuid": "5385a311-fdc7-4d73-939c-268f276454ca", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654703433, "uuid": "3c3c735f-6a24-4478-8a6b-5d81ae90f2ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703433, "uuid": "2b4cb330-9036-452c-a750-b6fa1fff7e9c", "value": "SecuriteInfo.com.W32.AIDetectNet.01.31314.23696", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f58f0245-e742-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654703531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703531, "uuid": "081ec5ea-7199-4b9d-802b-cd4fb2559b7e", "comment": "Malware payload (Mirai)", "value": "188c25628e02495a7c2da90f45ecdc08", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703531, "uuid": "5d712021-06d2-40f5-be87-45417847083f", "comment": "Malware payload (Mirai)", "value": "0b8d6a8a200216aae76d7156485e1db9e6db428f9e5c253af819aa9a7aeabce8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703531, "uuid": "8803ec2a-04bf-43b0-bee6-e0572d5c298c", "comment": "Malware payload (Mirai)", "value": "a4f3038e4e6573a6e0fee1db5367d1a1dff19545", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703531, "uuid": "a22f8678-7a15-4dda-bad0-2c286974cd9c", "comment": "Malware payload (Mirai)", "value": "0d6f3fa05d0b50b68c238e18677f3efa7fef57be5c6760cc6789fc12de7c9bff44dd27c1335acf66014c3c4187cccd58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703531, "uuid": "631ee417-cf54-40b4-8e97-a446da0ef28c", "value": "T12ED2D0614F4135E2D361BCBB8C6DC30E2849479061EA78EB99153FADB8D0B533C78183", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703531, "uuid": "0a12a615-3780-408d-afdb-f9b998249d85", "value": "768:+W2K93ZmoaRZpOV9JCiSroNQFjJN9piEh9lSe9q3UELdw:+vKpZwQCiLk/nd0La", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654703531, "uuid": "3bf17c40-c7bd-455b-9ed8-60dd21d71dfa", "value": 28992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654703531, "uuid": "cad8939a-3579-4537-afed-2fe4a1ceb322", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703531, "uuid": "9900d085-a9e3-4548-94de-39b77a0ee751", "value": "188c25628e02495a7c2da90f45ecdc08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c873a1a-e723-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654689826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689826, "uuid": "2ad3a5af-6c7c-4719-af62-7ea0597847dd", "comment": "Malware payload (Heodo)", "value": "5d120d485fbc25c82ceb648e3a3ee6c7", "object_relation": "md5", "Tag": [ { "name": "7449917", "colour": "#973C3F", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689826, "uuid": "b1efc185-6a35-48c8-a4bb-ff54152b1f27", "comment": "Malware payload (Heodo)", "value": "0be06b3fc1ef144b7e1a974a4f73337352613f3732117a0d74f8822741208d28", "object_relation": "sha256", "Tag": [ { "name": "7449917", "colour": "#973C3F", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689826, "uuid": "3c0af683-0997-4831-9dd7-b9dab4900dcc", "comment": "Malware payload (Heodo)", "value": "34879ca83af2cf7366ce89aa4e1bf3ea730c2c81", "object_relation": "sha1", "Tag": [ { "name": "7449917", "colour": "#973C3F", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689826, "uuid": "8dab163b-f76d-48e9-af48-338c855914bd", "comment": "Malware payload (Heodo)", "value": "2d35d71c6d5f47c2653ed0c8552f2de213d9ad2908ebbc8aa1bfe88bbd54e3994c04bd745c8392afb472146a3e3a9700", "object_relation": "sha3-384", "Tag": [ { "name": "7449917", "colour": "#973C3F", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689826, "uuid": "b9e0d52f-72c8-4408-b889-bebcf2120b63", "value": "T13E72D0B210CB6C427C75DEE3E50DB317D500FC96A21805586EA5F9A2ABD9D7A3F0C60E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689826, "uuid": "b5c4e5fd-a3e2-463c-a687-b87a2f341bfb", "value": "384:I5ByT/o34wU0Z59izZ7Fw12jt8kI6XxkpZ6EbQBbzoj:I5kTU4wUQ9izZBwUjukxy76EIkj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654689826, "uuid": "eaab9acb-8135-4789-a6d2-b1be252c76b9", "value": 16038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654689826, "uuid": "a066ba84-3659-4acb-a499-9223e69d9259", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689826, "uuid": "6433fa73-b019-43dd-baff-a5c81ee966c0", "value": "Awaiting for your confirmation 08-06-2022_0757.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3637435d-e75c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654714377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714377, "uuid": "0cc55be6-5be2-4c5b-af51-3f216aead48a", "comment": "Malware payload (Mirai)", "value": "2efe5b6e45e6fdff8a2440f7002dee59", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714377, "uuid": "0bbe26cc-bb10-43c6-89a8-4ed0e00bb5ff", "comment": "Malware payload (Mirai)", "value": "0bf6c2447cdec7e6a378637bfd8c221b3a894a23c1ddcfa5992f5d817e020d87", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714377, "uuid": "3917db04-ca4e-43c5-972f-03384032f27b", "comment": "Malware payload (Mirai)", "value": "1359654d5f8c80045ce3e31126dfcde5a378dcbb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714377, "uuid": "60780e82-f8b9-41a6-a30c-7ffa3639dfad", "comment": "Malware payload (Mirai)", "value": "8043ebf06541025f0aede7ec2a2b9f004adcf2e47251f9480ce3dbe80200c490d13594771970a44a3639c978609e6042", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654714377, "uuid": "7f31c0e8-48fe-438d-99f9-876c8022e16d", "value": "T1D3939419BF610FF7ECAFCC374AA92B45248C641A21A87B767934D818F64B24F15E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654714377, "uuid": "242dfd45-5909-4251-b490-bc20e0d1be5f", "value": "768:Yikg2VZWdCXszYdFxuhWlKB3xp8RZ647WqdvTvDMyLXyVd45S+W/f6Jan2AIktAX:ba4doEYrxuEkuYXwgJibwNmK9ZCkvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654714377, "uuid": "aa610dd3-1c02-4090-ad09-6f61b6469740", "value": 92368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654714377, "uuid": "d41a5bac-fc18-43f5-b7d9-c4fcb7d59c95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654714377, "uuid": "301ec1ea-e6d9-4cf8-9919-1125f542afc9", "value": "2efe5b6e45e6fdff8a2440f7002dee59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1500e571-e6fe-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654673949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673949, "uuid": "620c0a57-c2c9-4a23-b8bf-8b5d7e125e44", "comment": "Malware payload (Formbook)", "value": "b5dab52ae7b98e51cdbb8e76ffabef82", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673949, "uuid": "141d35f5-37fd-4523-a945-8746e250a2e3", "comment": "Malware payload (Formbook)", "value": "0c0b5e8b3363597f3fcc44cf49311027d3de87aafb8f8604280143bae20dddd1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673949, "uuid": "95e71852-08d3-4df8-bc74-f8fb06394ac9", "comment": "Malware payload (Formbook)", "value": "eca67a8719195071bf7abc5691d7e7a85ad4f3e4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673949, "uuid": "c7151836-8f4c-4b52-ab8c-96d9266354d0", "comment": "Malware payload (Formbook)", "value": "a5d396e74e7002956c701c28411d43a08c531c33cbf2da19eed41acbeb871fd2c083a7dfd015b0d787775059fe748432", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673949, "uuid": "0b36643c-112b-427a-a6a8-9d4566f77471", "value": "T17E030288FF8EC62D96BEEA3458C7B6443F9944B97B85564B0FC3A079CD445FAB05C012", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673949, "uuid": "e79dd360-6fa4-4731-9aff-9d997fb5a0f5", "value": "768:KYZ4IzGsHnl3+NwQG29NCqJ8clGUdkpwLjOUM/SM/MrNwM:GIz1HpGwQG29NCqJ8c3A5KMZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654673949, "uuid": "a44a3092-0139-4ccf-8089-07ab272aba18", "value": 40247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654673949, "uuid": "522f22b2-7b2c-41a9-aad9-b740a8467a0e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673949, "uuid": "4b1f1cd7-17d5-4968-9566-925b20ee17ac", "value": "P-S-8622.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08aa45e9-e70b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654679511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679511, "uuid": "69676da3-44ef-414d-aa6c-27ad44e3e260", "comment": "Malware payload (Heodo)", "value": "bbab3bee3a636e83f38c252e28d2ce11", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679511, "uuid": "1b81ace3-1678-4ab4-985d-92473dc49ab4", "comment": "Malware payload (Heodo)", "value": "0c1d78e86a6dbf11e173f6e941762adaaefc761687673b1174b2a885bcb8a6d9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679511, "uuid": "493358b6-b2de-4b27-b70b-b07cecc1a676", "comment": "Malware payload (Heodo)", "value": "e8d1159538a9c63beccbdd6aa0c45cb8112d79b7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679511, "uuid": "efc7188a-2bb1-4e25-aef8-27aa19c486ee", "comment": "Malware payload (Heodo)", "value": "ed0c1881a0f59cd56f64c18502896f33690c32c84c99a27ad9827436771b0e8cb4349e5c3d10e29c75016bd7bb8536fb", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679511, "uuid": "5896b1c3-62a4-449a-b5f6-15e1d2f1310c", "value": "T1AB44C089ABE1ADDBD51407798DD6D324333EF2814B8387076B2598390F23BA4BFC5A45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679511, "uuid": "c404b611-036b-4137-98ed-797a78f7a283", "value": "963f2e88a5b03877d0583808b2526c1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679511, "uuid": "d8bf5297-c903-4e0b-9fad-21d62b874fb9", "value": "3072:7R7De82w+Oh+UjuFJrfr7CS/FmikytkqroMdjaWtHCqPZ4PEx2ES2vZg3f4L5ZJi:7laJuk4uFxOmFwytLVxDtfPZ4PE2sPs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654679511, "uuid": "4156b872-3a50-4f2b-bd27-01eaa7ac9e8c", "value": 270403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654679511, "uuid": "6353f8e3-84f2-43cf-b837-96bdb5901511", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679511, "uuid": "ee11a034-94e3-46b8-92ff-10e133ae28a8", "value": "bbab3bee3a636e83f38c252e28d2ce11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "093c2409-e75b-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654713872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654713872, "uuid": "c089b3ae-a626-455d-9c41-8c4a53406660", "comment": "Malware payload (AgentTesla)", "value": "9ee00ab8ef4b2f45abb0512efd848b67", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654713872, "uuid": "2a9d3493-f777-4ecd-8549-f219f357ce94", "comment": "Malware payload (AgentTesla)", "value": "0e3f86f3ad2e0856dee76ae1b4c7e2990f80927264d5cbd6b957a1208bd8fb91", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654713872, "uuid": "ba11d082-c523-494c-9303-a45877741aeb", "comment": "Malware payload (AgentTesla)", "value": "2eae0fc8971591cc83371f7c2b3175622b94f30f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654713872, "uuid": "0e9dadf1-0b7f-44a7-be4d-a4fe6dcc68d4", "comment": "Malware payload (AgentTesla)", "value": "739708f82a35658470d69a9e5210e177f8430fd4e64d6b8d03411278c63cd32253b24e0b2246cb40be6934bd18562a85", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654713872, "uuid": "2e582486-ce6e-40b1-8eac-d19ede7e9f97", "value": "T1C4A57C0173E4FE0BE1B773366B31E6B8057F7D96B922D25E407426DA29627406E123E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654713872, "uuid": "468e7a7d-5403-40c7-8b4c-7989a18addd1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654713872, "uuid": "639ab377-2043-4acd-a4ae-b49adc41340b", "value": "24576:gVXm4onY+ksWgzg50gxMT7xWLDS5fq+z5fq+sOT75fq+W5fq+tJX5fq+z0sz5fqt:J4PPsWL50gxMpfrOEIZJVXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654713872, "uuid": "473f1049-2169-421d-af8a-b21f0869a471", "value": 2196480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654713872, "uuid": "b613edcd-010d-427a-ae3f-cb771715a728", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654713872, "uuid": "c98203a5-f8d9-4618-a1b5-d3b72ab9eaa5", "value": "SecuriteInfo.com.Trojan.PackedNET.1372.14110.11651", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e74a140-e705-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654677105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677105, "uuid": "53fe9aef-4969-44eb-a5d0-7ace938c3d6a", "comment": "Malware payload (Heodo)", "value": "d16d97b823fdfb4d0893e8a953e67aca", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677105, "uuid": "c2157e7f-bbdf-4a48-af36-91ef30e3aaa2", "comment": "Malware payload (Heodo)", "value": "0ef69a862bc4438e4dfc3efeecda317944ca3c0607350d7453110b24946618af", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677105, "uuid": "dbc84c99-7e43-400c-a52e-a678b686cf2f", "comment": "Malware payload (Heodo)", "value": "0abb8a531316cb96849f0fd43ff1742e79a75124", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677105, "uuid": "d46a9735-f99f-426e-81ea-e936e8bf1e34", "comment": "Malware payload (Heodo)", "value": "52e1eec8ad7c606e1a7e10f075eb112fa2f2d8c3f88fc67c33bcbb5bcad84def468e60abbcc72d8a2b36dbc81f55ed8d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677105, "uuid": "dd96f99b-ec52-4df2-96c8-84301f489c8a", "value": "T19844C089ABE1ADDBD51407798DD6D324333EF2814B838B076B2598390F23BA4BFC5645", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677105, "uuid": "34b395c1-7c10-484e-ba3b-a38e217c20e5", "value": "963f2e88a5b03877d0583808b2526c1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677105, "uuid": "52086aa4-bc05-4fb9-90ed-6cc73b1013cb", "value": "3072:7R7He82w+Oh+UjuFJrfr7CS/FmikytkqroMdjaWtHCqPZ4PEx2ES2vZg3f4L5ZJi:7l+Juk4uFxOmFwytLVxDtfPZ4PE2sPs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677105, "uuid": "a599ba83-41b4-4db9-9bf7-4258f7932335", "value": 270403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677105, "uuid": "71e0a450-f3f1-48c9-82bf-ba8b1e7f6912", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677105, "uuid": "6356afc9-bb55-4813-940f-17debb7f7cba", "value": "d16d97b823fdfb4d0893e8a953e67aca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbd7c897-e6fc-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654673477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673477, "uuid": "24e6ca1c-b7c4-4824-aec3-b9ed8dd6b65e", "comment": "Malware payload (RedLineStealer)", "value": "079504fc0f862bd423da6035a05d3051", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673477, "uuid": "baf4047a-2883-411a-a0f8-5ac412f1bfd9", "comment": "Malware payload (RedLineStealer)", "value": "0f6cb98819c06ce96011dfe482b4f5ebd91351d476bee0d58ab9ba85165b0710", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673477, "uuid": "a26b1b5e-b519-49f3-b00a-42d7ad54a371", "comment": "Malware payload (RedLineStealer)", "value": "886197dab44fe9b28488f8f1ebaea281995066db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673477, "uuid": "ce303772-5025-4b0b-8e70-bc55c48aecc2", "comment": "Malware payload (RedLineStealer)", "value": "62a368322c5a2bde36a0dc59a1aed985799af73e143a5d9503a5207082a2b0cbd9b2464922ea0d4fb493604f5c7b391a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673477, "uuid": "0480612f-2d56-41b4-b1b1-1bfb7fa101e3", "value": "T154C4012433ED07B2CA7D1BF984A8014147B1AA37A51BF34D5E8176EE8E67BC0CA56713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673477, "uuid": "84341b74-3f6d-4ae1-b8c1-19db14ebf4d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673477, "uuid": "1eaa4852-13cd-41aa-9c9b-e49edd71f4dd", "value": "12288:sqdJVKTFwPy5OXYkArMibLkwO8qaeEqbYoo7OvrCvbo9q:BPy0XY8EkkeEqho7OvrCvbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654673477, "uuid": "996a8434-3857-48c2-a199-145e0434fb0f", "value": 548352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654673477, "uuid": "40faa652-3662-4662-a937-c2bf2aa314d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673477, "uuid": "b706450e-c505-4fd7-a367-43e299180029", "value": "PurchaseOrder260134.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54cd43fd-e712-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654682645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654682645, "uuid": "9387d71e-87ed-4fab-addf-911386fc444c", "comment": "Malware payload (Formbook)", "value": "690355e671ff1ee2636494cdfadf4b72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654682645, "uuid": "e67fac1a-4096-4c3b-8958-be52d1019c6e", "comment": "Malware payload (Formbook)", "value": "0fca467e7dc282fbf64d224e87b1ca73bffd285dec6e4b75dfce37cb07f7d14e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654682645, "uuid": "0dbee2ad-db92-4c4d-af9f-fc97a0e3499b", "comment": "Malware payload (Formbook)", "value": "8ed3551ad5a2096d932a996c505496346160911a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654682645, "uuid": "acf14678-7128-466e-bc15-39f0adb5093d", "comment": "Malware payload (Formbook)", "value": "27d2ad57c563e44f13db447bf9daf4144077766a33db0f4b4258a28692e59ef2be9fc931ef631d13029fd0b9a4dede2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654682645, "uuid": "6b344b05-6811-4ba3-b327-4adf2358a401", "value": "T145942C2D6B010662FC1F913069110A04FB660FF33690A99577EB2DEAD7EFC669F45C88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654682645, "uuid": "94ecca53-e368-4230-ad85-6b1455ec65f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654682645, "uuid": "e0116506-380a-4014-afe6-15bb80efbe0c", "value": "6144:lVI7G2niJymc89gAnXtp1erW26FzPEiMv6NyYE0IleMiLETLX:PI7XniJG89gAn7s1WrEeETWSLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654682645, "uuid": "5c792ef4-6ec6-49b8-afc0-eefe922ba381", "value": 445952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654682645, "uuid": "f26b75a8-a42e-4308-8142-1425291f45fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654682645, "uuid": "41631294-dfca-4b04-85ab-3ae45be89903", "value": "SecuriteInfo.com.W32.AIDetectNet.01.8396.5567", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b863002b-e742-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1654703428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703428, "uuid": "3a32bea6-b53a-40e8-bd06-5c79d8fb160d", "comment": "Malware payload (RemcosRAT)", "value": "ae4488ff40e4eced13785e46c4548e3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703428, "uuid": "cc3d67c1-9501-4e4c-90c5-be9a71e26877", "comment": "Malware payload (RemcosRAT)", "value": "1015aaf219bd6c756e9e5224d219ed551795585e383fb4a6d2a566e7c8dabad5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703428, "uuid": "8cad668f-83d6-4ed4-a438-c0d4b0f5b62a", "comment": "Malware payload (RemcosRAT)", "value": "25159161602923932fa23db8d052bfb502e9a33a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703428, "uuid": "d00e046b-0ca1-498a-82b6-60f9743b6805", "comment": "Malware payload (RemcosRAT)", "value": "5d90da26db429b38f07c1ab233c158cfb45ae24a834d1e2431ca1a074ab0355388aa68c5b0d5e1b8ebda550143357c48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703428, "uuid": "651c7a70-747a-4bb3-9126-f5e57f286cba", "value": "T1F325BE22B2D10433D1363A395E0B7B69E966BE512D28B8862FF93D4CDF743817939193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703428, "uuid": "6c5ca372-406b-4665-a168-956fa9321a79", "value": "c2e2698247bc76cf8ea24c335c2f1e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703428, "uuid": "64ebc85f-7729-461c-ba78-1e66140f8745", "value": "12288:mUdrBgUSaYsGytw7zQKKV0FlnOcf/GkMTgIGuURWCXCEUaW+6LHc4dQ:mceazGytwXmWPn/fekMsTW+WdQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654703428, "uuid": "12afb800-06d1-4a9a-b4b2-21fc0b387e42", "value": 990720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654703428, "uuid": "a7579a2f-4373-45d0-ae8f-7b3c7ad3b506", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703428, "uuid": "15e71c23-851b-4661-9b1d-5788e59baf1d", "value": "SecuriteInfo.com.Fareit-FDBIAE4488FF40E4.19282.30704", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "186eacb7-e70c-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654679967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679967, "uuid": "5c3a1545-1267-4190-aa58-ecbf500d7456", "comment": "Malware payload (RedLineStealer)", "value": "b7e68afbd9a08a94d754a975e07dd92c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679967, "uuid": "0e43a391-cdd0-4289-b995-d921e27baf3c", "comment": "Malware payload (RedLineStealer)", "value": "10e332120a3ae6770fd4941da3e87dd2b9dde98cb7a6ffc1c04d5ef5018aa0b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679967, "uuid": "b3b793c5-be28-4d04-aa87-cf0c3c26f5d2", "comment": "Malware payload (RedLineStealer)", "value": "16b231fc28c7981d2b42a882c10d0462a5352a87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679967, "uuid": "e6cc747c-5cb6-4bad-baf7-3779f300e906", "comment": "Malware payload (RedLineStealer)", "value": "8eb31e21106aced717f058973967ffaa227fd2254bc77410a048b0d3ef89ac24ec7d5b8e36b4087546c59b45979fc689", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679967, "uuid": "e419d494-6374-46d1-a755-ac82bd9b84ad", "value": "T14884BE10B790C035F5B715F44ABAC3A8AA3FB9A15B3496CB62D516EE07356E1EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679967, "uuid": "4d60db9f-fefc-4696-9e52-0842dbde3db4", "value": "28f9b27e782bb155192c1d4fb9991cf2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679967, "uuid": "45d60abd-45f5-4f01-8eff-e0ea9732f962", "value": "6144:LpG4lE302NYRHxSch0gkwfAXtTY8ky+KXmhauWmm7eEEMI4sK5p8ey0lHk:Lp7g03RHgY0gZAJYpsW0u58/k1yq0Rk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654679967, "uuid": "11ee5442-05ee-4bd6-bb60-96fb65f69e7c", "value": 372736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654679967, "uuid": "1e756739-e1d1-443a-8e32-de7a322be80d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679967, "uuid": "f583cf1b-785d-4155-ac75-ea6b363650f9", "value": "b7e68afbd9a08a94d754a975e07dd92c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc5f803-e6dc-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654659632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659632, "uuid": "5777c465-4132-48d3-8830-000ff659048a", "comment": "Malware payload (Formbook)", "value": "bbc8bc39248450867d753827a789f89e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659632, "uuid": "5cfff3f8-e704-4ee6-930f-cd5b2173c48b", "comment": "Malware payload (Formbook)", "value": "10fd06a398a69a6ed619974bbde91c9868e0abc9cf0bad3b38ce1dc7d3dc1ae6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659632, "uuid": "73e05def-358f-43d9-acf2-8a3b1a3e18bd", "comment": "Malware payload (Formbook)", "value": "b0b8fc75ee27972d1dbc07b60bf4f246b1f16aba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659632, "uuid": "0bfe0c40-5962-4417-8c24-91a924844a52", "comment": "Malware payload (Formbook)", "value": "b90284492216a8d8f7b56c13ac995bda18d9573e22615768c76a4e606de353285a4d8ae9c6d36d58058298adc1925b1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654659632, "uuid": "35c31314-b433-4205-8089-f547fbce9cf1", "value": "T167D4123076DC0BB2C67D27FE5892004147B5AA5A142BF34E5EC570EF4E6BBC0C66AA17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654659632, "uuid": "e5b16ecd-321d-4e54-ab87-296ca1eeca9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654659632, "uuid": "9433cf50-2837-4829-b7f2-0c9c3fcb6ddf", "value": "12288:uS33zjS3KJHEAJtjR1MOwnrT9PoUywn06w6TG+9HuaofFlGrbo9q:D3zO3KJHEAJtjXV4T9PopSpTRHuaKarM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654659632, "uuid": "7cd482fe-d9fe-4a7c-94c8-99a39cfd4438", "value": 650240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654659632, "uuid": "ae0b7d0c-6627-4182-89df-8c57723f6251", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654659632, "uuid": "2c57736c-675d-47f0-bcab-d4364ebe207b", "value": "SecuriteInfo.com.W32.AIDetectNet.01.17796.820", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c3ca9d-e76e-11ec-93bb-42010a9c0043", "comment": "Malware payload (Amadey)", "timestamp": 1654722136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722136, "uuid": "6f303d06-efe7-4dd0-a0e3-47414f38a4df", "comment": "Malware payload (Amadey)", "value": "9e83f486fd91274ff18a24646f1d4717", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722136, "uuid": "a339cb4a-2a9d-406a-ba75-52a42e3ed338", "comment": "Malware payload (Amadey)", "value": "12011e7abf1ae84f14c158817f7c8b888ccf45a3103eed8367463c97d9fc8d46", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722136, "uuid": "7e1a5657-201d-4e5b-b609-3b168effc37f", "comment": "Malware payload (Amadey)", "value": "075620833dac883cfb2ca5d56b40964afe9981e5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722136, "uuid": "e1edb275-f84e-4c53-a899-6b55b9780a2a", "comment": "Malware payload (Amadey)", "value": "4e36691e60255f3181ccb4e6b2a7710fb1cf163a88e1d124800ebee1e5cb7d8baa62da430613996e6f078bcc6f0ba17f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722136, "uuid": "fdfc0016-821a-4e89-a614-63b0e95c99ee", "value": "T10B84BF20BB90C035F5B756F449BA83A8B63E7AB05B2491CB92D51AED0735BE4EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722136, "uuid": "97a149d8-2c90-42b2-ae39-6bf23277c833", "value": "6c3ec6ef64d2f3ae88c6a4c2d436253e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722136, "uuid": "f4531763-694a-4174-b196-558b3e67b4b7", "value": "6144:eHvFuLxgELfG7k+LbJLUgJZsV1rGmFuFuOoZR7d3OfpsbP95RA/a:eHMVLSk+PtUgEVUquFuOOR7Zbl5RA/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654722136, "uuid": "7d0d8a89-2b69-4725-9e30-338733a68667", "value": 379392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654722136, "uuid": "64b26344-0f3f-482e-a58e-5b209c098585", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722136, "uuid": "1f079629-e1e8-4f40-8fbd-364902577600", "value": "12011e7abf1ae84f14c158817f7c8b888ccf45a3103ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98778cd1-e72f-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654695214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654695214, "uuid": "44515923-141a-402d-abae-d3a34603e1f8", "comment": "Malware payload", "value": "015c73eea1df8834f5d1105d09bee622", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654695214, "uuid": "0cdda58a-435d-45ae-ac40-7b253ba75598", "comment": "Malware payload", "value": "124b3c33834b1eba4b00e5bf084baddfa2204621bb0b745b7e4132865e442916", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654695214, "uuid": "7b2ccf03-8d99-491f-b0ba-72e99dd58ddd", "comment": "Malware payload", "value": "1c423f76f81ac0bd9cac4dfb43e88d52ee64deb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654695214, "uuid": "cc6208b9-2d63-4d8b-9c5c-0fa0115a93c7", "comment": "Malware payload", "value": "e5fbbb7ba3cb24fef859f8f3887f379a56acd5fc005982ac9b51636af296ba4dffc41aa2295739fe3e6931e6481b00c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654695214, "uuid": "3721a370-13b4-4aa4-8808-345cd4402b82", "value": "T1E8A402247BEC07A1C5BE07FA9858464083B0A33A6467F70E5E8174DF1E7AB91C623B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654695214, "uuid": "18ef49eb-4367-488e-a37a-dadab70ce4f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654695214, "uuid": "cae2a1fa-bda1-4920-9062-188e65cea23c", "value": "6144:rxgV4rQ0W5PEA17IB/HrljvlltvhZdZlBTfbRcZ+UDicd6QP5+RmIbKbo9q:1fQIA1kB/HrPvPdZ77bRcE2+Cbo9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654695214, "uuid": "33726e56-3c6c-446a-8c91-3821789227e7", "value": 468480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654695214, "uuid": "4e18308d-a007-46c4-b4ac-4a44b21b342a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654695214, "uuid": "d5e7084c-0cb5-4760-9d27-634575596181", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0575224a-e763-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654717302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717302, "uuid": "6ad2b394-964b-4bc3-ae1b-419b3cdc801c", "comment": "Malware payload", "value": "c38d97f68cfbf64fcbebea44a5aca68b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717302, "uuid": "1c82e295-ece9-49eb-94cb-36365e5b10be", "comment": "Malware payload", "value": "130747645b1962949b5e3230538a1d8db089f546bf52e3a2c5ace59d991e4745", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717302, "uuid": "6bb6026b-95c4-4f2a-b7b4-57148c9115cb", "comment": "Malware payload", "value": "492ca707adbab6ffe51bf6afeec66c20788230e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717302, "uuid": "7a117037-c82c-473d-a077-1be8896101e2", "comment": "Malware payload", "value": "029450d48609610e485c7d5e48c81e4a312fa90be460102ca5f52944b76c355a1f38c867c99a0e0900edc314b274b655", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717302, "uuid": "55313b9e-5842-4cba-80f0-224374757f26", "value": "T1B803E11DE0B00DC1CD7C9632912D2735EE64689C728FC3DEE351E69DE0ABE07B54A166", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717302, "uuid": "ac5c27fc-5d77-47ec-b089-49a0c2590b23", "value": "768:2u+dhF07mTlV27W63RxxMB7PNXU/d4ZrGMhVchbAjiz007vysXEWR3:21jZlV2lBAd9KurDchsjig0esv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654717302, "uuid": "5798b566-0639-4a3b-a127-839db876647f", "value": 39588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654717302, "uuid": "425837c9-73f6-47de-9b27-f58da7643d67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717302, "uuid": "f7380c3c-144c-4318-a00c-8ecfdda67206", "value": "c38d97f68cfbf64fcbebea44a5aca68b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a31c18-e718-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654685276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654685276, "uuid": "b379cc58-b6a6-4778-99a9-3702deef5262", "comment": "Malware payload (AgentTesla)", "value": "c30fafe3cdac6dd20fe3b6a1892c39f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654685276, "uuid": "d4e979a8-6a5f-4d09-8ca6-b21292e3a768", "comment": "Malware payload (AgentTesla)", "value": "1313cca58fdf2c3ce14ce98378ac7066eec82c17232c81a6d13bb08133e1a8ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654685276, "uuid": "12613a28-da46-499b-92d8-d9a74502ebc4", "comment": "Malware payload (AgentTesla)", "value": "463e653b44de869b244a83755d113f1d7edcfd1a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654685276, "uuid": "988f2f57-3a7b-4cda-9517-2a1902766044", "comment": "Malware payload (AgentTesla)", "value": "e0e7d6848711ab7f9ee0b8b4b3661b2c11abfecd4b0469538ed4118735fbc520998acace98c888889bada0f1aefac615", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654685276, "uuid": "1bc8451c-7bd3-4926-933b-5f27a093f35a", "value": "T170C2F600D7E5C632D9941EF5ED6222C04B786D079982EA1FEA46731E78F324CD8A87F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654685276, "uuid": "f2bbcaab-60f3-4280-b3f6-a0ee394cc6cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654685276, "uuid": "661eacbc-e854-4cbb-8f2b-fe914a3f208b", "value": "384:1JY+RoZO06PWIoH4bV99O7a/7GAH1zORXEWkc/W:306P04bpPnH1id", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654685276, "uuid": "fdf76e48-077e-41c2-91dc-a8999a89b085", "value": 26112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654685276, "uuid": "5bb51bb5-f06f-40e7-a47a-229a2d7532a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654685276, "uuid": "fdaaefd0-5913-4f90-a613-3fb14513b87f", "value": "c30fafe3cdac6dd20fe3b6a1892c39f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5586928d-e77d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654728603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728603, "uuid": "cfec16c4-04a5-4132-8f50-4cb802df87e7", "comment": "Malware payload (Mirai)", "value": "c224f33b13f11acfe0b2d46e4ef44670", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728603, "uuid": "ddf1b043-5b89-4be9-ab5c-1a5377b6bdd3", "comment": "Malware payload (Mirai)", "value": "1362eff86f8a1e2636ff21294c2a74eec65a2b70ea855a8610531e847485db35", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728603, "uuid": "cc8bd384-9ee1-4f23-90d8-b7475d7aa81f", "comment": "Malware payload (Mirai)", "value": "90e2d34a42d661f638e45c2bc6c68c9a9a6e386c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728603, "uuid": "986613d0-369c-4f38-ae05-b49cd469fef0", "comment": "Malware payload (Mirai)", "value": "1a1c47d76bdc573f7064e645a96c741ab07fbef7e16d5e7c335c14d517d6162ce13c25ce96e46717c87e721acc6ce65f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654728603, "uuid": "ab82cb40-fa4e-4923-aeed-0319ea574471", "value": "T10F33027CE28A25B2E653797998408A09168E87BA833CC27BBD2CE3F4477301745E5F07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654728603, "uuid": "123ea3d1-4037-4ef8-b77e-622cff8032f5", "value": "768:hy9fcZySHypY1XQ46cxU33b3vfQXnJFl1zyw9q3UELN20qHdjyrINnX4egowfM:hy90shpYP6cK3L3nQXJFlw5L2Hd4qt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654728603, "uuid": "8d0eb136-ebd8-4772-b185-1ef701fe0359", "value": 52660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654728603, "uuid": "f1c73ced-fecc-4441-bf7d-8eeba29472f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654728603, "uuid": "a51c9e6d-255b-4f66-82b8-3cd4116bfb16", "value": "vailon.arm7-20220608-2250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "560add3e-e712-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654682648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654682648, "uuid": "96c3882d-1efb-4103-aefe-a91490fc14f2", "comment": "Malware payload (Formbook)", "value": "086b98f5a31f3d71f609733c7b476167", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654682648, "uuid": "414ef026-2c52-4dca-ae2a-1a2a27fb12be", "comment": "Malware payload (Formbook)", "value": "13a58c1f84b0749a1b3aa55e66f4630b3350a0510beaec8b8a5a1c4157167eea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654682648, "uuid": "2d195442-8309-43d6-97de-fe1c0f95368a", "comment": "Malware payload (Formbook)", "value": "aed5123d730f60781924448490e2b2b8c9d1053e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654682648, "uuid": "8355cbad-6270-4ce1-b82d-0bb026a5cb39", "comment": "Malware payload (Formbook)", "value": "b9c8912ca55c946814fab53738b9cc258d160dc4a50cf36c439e061d8f3eaba2582242e7d2ab0d172acc6dd066e1d563", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654682648, "uuid": "abc72beb-9914-4076-8d56-5241854affc5", "value": "T15515DFD6FA4016F1EC3E51B7B527849027B3AC7ED1FDE20629D1278618A1BB28937D07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654682648, "uuid": "1fa9dcc9-23ae-4f46-8e65-1b5e1e3ac262", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654682648, "uuid": "81d2421d-0876-4167-a146-5f9376f268ac", "value": "12288:y+Zu7DjhrvDr7FAdHk0hGzdEb+rfzArgMJZlBbo9qGqINShlqZSDmhAtx63dWECJ:9u1f7mdH1had4+rsrgMZ7boMINotxTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654682648, "uuid": "7e3c85fd-57db-4c2f-a176-b36b5c54b5b8", "value": 882176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654682648, "uuid": "4497b678-6c9a-474f-995a-62f65525046e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654682648, "uuid": "c384820b-9e76-43af-bc8b-cfa3e2533f03", "value": "SecuriteInfo.com.W32.AIDetectNet.01.29817.15543", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5f98dec-e6d6-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654657092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657092, "uuid": "c6e2f880-a5f3-472c-92ec-6f94e6d199fd", "comment": "Malware payload (Heodo)", "value": "3658ac19b57569c4eaefe6ece1e83bbc", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657092, "uuid": "d4f0684e-bbe0-4e49-941d-ebf919ba405d", "comment": "Malware payload (Heodo)", "value": "1585dfeb27c9ec360722fd3e4e1ebd0ec211f9b4e3a2aecb6a30012fc9d1ac1a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657092, "uuid": "4260712b-38f0-4ebe-b6a9-7f41fdab606f", "comment": "Malware payload (Heodo)", "value": "9ed8dd3326693e57b8f03108341f78afec7b3778", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657092, "uuid": "3368a692-7a66-4b75-aa7a-402a18287a13", "comment": "Malware payload (Heodo)", "value": "f8da35fb4e04e1fa29c2b3b4cdfafb1045ddcfee77e5741ec8f4511efc08bd3ddf0ac25a5dba32dd278ceb578574884b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657092, "uuid": "83a0fa44-016a-41ce-8622-cf39cda8cee7", "value": "T12204026DD14C06DDD611137CACE90F3392FCF980A0262B5BBB70A6774BA4B96DB5B900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657092, "uuid": "e6be3013-039e-4787-aed9-3d76269b2d34", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657092, "uuid": "ab8b5af3-634c-4bd4-8aa8-6f665eb3211c", "value": "3072:rpjfYFcO4J8FYMh1PAzu8GmeR8dk5pL/rRn/02QBgjVcoe5Uy5i6zNL4ZNgzPKcQ:rRwWW6u8QKkXzN/09gjV/eey5/NsAziz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654657092, "uuid": "dd968021-8259-418e-9041-70f0bacbf407", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654657092, "uuid": "e687357e-fb3c-4888-943a-f67e65f56645", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657092, "uuid": "c20c0851-9d0a-4734-a3ae-413e13fbc68d", "value": "3658ac19b57569c4eaefe6ece1e83bbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "608da92a-e725-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1654690826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654690826, "uuid": "60acbd5f-d738-4178-a582-a871eed4f6f9", "comment": "Malware payload (GuLoader)", "value": "b2f518249ff11042385af6c7bf228aa8", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654690826, "uuid": "d79c547e-1a4f-47f2-9e30-44690eed2236", "comment": "Malware payload (GuLoader)", "value": "1588a0dbe1a068c1b8786eeb8c6c8c4515472babd3eb4ee9f8e3aa804f612667", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654690826, "uuid": "f8632d62-3980-4e26-90db-57094b4bc8a5", "comment": "Malware payload (GuLoader)", "value": "2bae47bcd78503b49af768565211cfecfe12ee29", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654690826, "uuid": "816a78c9-9e63-4a2f-b67a-b3a8aa5a272d", "comment": "Malware payload (GuLoader)", "value": "cf21018baa54f6ca62f55122996d85c055bd1144a661748af1a639af85cf50575c5c031749bd10f080883c88f3acaeb1", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654690826, "uuid": "dacf7850-db3d-441f-a525-4a8b286e6c49", "value": "T1FF642B91331594450DBE652170AEC34A0F44A192A3E6D3760742EAF5CB466B3FB3BE8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654690826, "uuid": "59d2f850-73bc-4538-a1ce-147ebb306711", "value": "1536:olhX9JJPhfE+Z8/eMPgEIsKqnp/TydZrvDBMv6ao+wvc3ubyyWZGhcys6:QtpJQezyKaedZDAVd3oWKcyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654690826, "uuid": "4a5508d4-f360-4113-9f65-c8961d95d73b", "value": 334697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654690826, "uuid": "2026f9a5-d055-4dc9-a040-3215750507ce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654690826, "uuid": "348b692e-f6e6-4596-a796-471b8e7e8b3f", "value": "GEOSIDER SA OFERTA n944422.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "001b3f70-e6f0-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654667900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654667900, "uuid": "473d19f0-473e-4a5c-8aae-046d761999eb", "comment": "Malware payload", "value": "26ed0fe0f7c70df9e9f1f37d26f79c5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654667900, "uuid": "6042da1a-26ae-476b-b974-338e9599888d", "comment": "Malware payload", "value": "15e2f966937440c34a383f8a2df6fa8b380fbc858b7560e3129f563296e17fbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654667900, "uuid": "3af69688-ced4-433c-8e16-bc45fba54a4a", "comment": "Malware payload", "value": "fc8df7cb950034963d9f658d481c9ffb88bc9c75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654667900, "uuid": "8fb0920a-587d-40fc-ab9a-28429e18014d", "comment": "Malware payload", "value": "7af0388a588d99a22d2d08fea3279a7e41af07fe1da621a0ab62958992c57d5812a001b9e67030a8c5a91722808dc34b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654667900, "uuid": "2b36ee95-752c-41f0-938d-7e92592b1879", "value": "T154D31A2BA74B59D7C1A44638C4A7C3740262EE6219708D0B3FDC3E9FBD3A3442957A5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654667900, "uuid": "c26f0197-eaf1-4b52-a3aa-16b12b097e8b", "value": "768:2GL9IPDwsdPCLxmeLV0HLk8bgAp+hcx21NFBRgwS5wcReUe/saW4NECeeeedeeex:2Z9BuWYKpgj1HcixN1RtO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654667900, "uuid": "a3bfa92f-0fb2-42be-84a3-5d784a8b3ffa", "value": 136192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654667900, "uuid": "b3844e5b-e115-4f25-896e-4d329b8918bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654667900, "uuid": "26609641-af8c-42c3-b620-eb4f5488c4c5", "value": "26ed0fe0f7c70df9e9f1f37d26f79c5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ceb32a5-e763-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654717475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717475, "uuid": "78ed2402-d4cd-41fb-b140-865e000955b1", "comment": "Malware payload (Heodo)", "value": "82b2f75b6dd2eee68ec4f8973a72f628", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717475, "uuid": "fba9a3c0-0361-4aca-bac6-f84a9a04444a", "comment": "Malware payload (Heodo)", "value": "162106e5e326157da926e8cb87fcf9e6e19ea32c7c39929a8172fd191458ec92", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717475, "uuid": "c30365e7-58dc-45d6-bcfa-d8b58143dab8", "comment": "Malware payload (Heodo)", "value": "f15d0343da1eecd506ba28e639c9ad8f4a159e91", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717475, "uuid": "60143265-5b1a-425f-8f2f-8bf4ca08e432", "comment": "Malware payload (Heodo)", "value": "c296ecb12c0f77ad5a7f2d682e1d73adc4614ee8ba64fc5af5eefe1f07c9eba4e2c0a756fa684e2fdfc4e6c3e45abeba", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717475, "uuid": "22800014-b2e4-4789-8e2d-8c0d5221064a", "value": "T187051947E77345FCC96BC97482A6A732B930785841397E2E4F80DB226F65F20953EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717475, "uuid": "c5270525-53e1-4e75-8b38-5e73803e835f", "value": "733e4ccf9ef47c6e471d93270b5eb898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717475, "uuid": "7a18c22c-f521-48c6-8044-6a99f03f2534", "value": "6144:v7rc6Wk6SYnaKOai5uWLwrd0jSjc0vNPqBVzLFWyWUPV2m7hzS7583Tg7A+++ncE:vXcFk6SYna2Frd0jSjcc9SKmBZX0TMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654717475, "uuid": "2de9489b-9e04-4eab-adff-ccb655e6d23c", "value": 841728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654717475, "uuid": "8c61e7f3-15ad-4544-b495-933d2be024dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717475, "uuid": "83be56b3-0843-436d-98fa-55ace4507ded", "value": "82b2f75b6dd2eee68ec4f8973a72f628", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "512b9201-e70b-11ec-93bb-42010a9c0043", "comment": "Malware payload (000Stealer)", "timestamp": 1654679633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679633, "uuid": "0b094904-f693-48d5-a5ea-b3eac34140a5", "comment": "Malware payload (000Stealer)", "value": "aaffe258dc27f44b755f635b3f3ba323", "object_relation": "md5", "Tag": [ { "name": "000Stealer", "colour": "#1357DA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679633, "uuid": "0de6c490-3648-4048-b5eb-f9ef1ba76f17", "comment": "Malware payload (000Stealer)", "value": "178ba1dda37ef1afd2af92d81ad1ba99c4e3aa09bbc66f4d7cc43c0430189572", "object_relation": "sha256", "Tag": [ { "name": "000Stealer", "colour": "#1357DA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679633, "uuid": "e65ca334-3966-42e4-8169-29db51fb70ae", "comment": "Malware payload (000Stealer)", "value": "a519295c24c6c15e52714d11c99c1a1e64f68ade", "object_relation": "sha1", "Tag": [ { "name": "000Stealer", "colour": "#1357DA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679633, "uuid": "aaf02981-c57d-4a5e-aae7-6e99861bfde5", "comment": "Malware payload (000Stealer)", "value": "51f6f7aad6e243c86af62414a159619152f8823cce822b0a9e475ca5c8aecbf491f8c277221a8172c6b1ca0bcbf58e56", "object_relation": "sha3-384", "Tag": [ { "name": "000Stealer", "colour": "#1357DA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679633, "uuid": "6ecb16e5-c803-4435-9b0d-007eec04681a", "value": "T11986337353660186E5FAC83AC7273F9535F7136E4B424C38A5BEAECA74219E1F212583", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679633, "uuid": "a7292cbb-94ef-436e-ac75-90480b382c08", "value": "eb9ed998c9e692be5c3fa10c84f057e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679633, "uuid": "c3c55732-f5be-45c7-805c-f9c7beb5a821", "value": "196608:nf9pi4tmX75KWcKR/DmCeHxrf3wmvcYJjg:n1pi4tmX74WcKhmdHxroD0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654679633, "uuid": "1f1a7461-0ebd-4d1a-855a-6bb6ea5006d3", "value": 8227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654679633, "uuid": "b2ce2cd3-4338-492b-89c0-00dd317f74e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679633, "uuid": "fb19c85c-111b-4617-9282-662885573f7d", "value": "aaffe258dc27f44b755f635b3f3ba323.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b97af04-e748-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654705930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654705930, "uuid": "6087b8e9-3cb0-4680-a917-0deb6c75587c", "comment": "Malware payload (RedLineStealer)", "value": "9f45186ab1629c857cdb3dc6de736292", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654705930, "uuid": "a668cb3b-61ec-42ac-bb5c-79fae8077f08", "comment": "Malware payload (RedLineStealer)", "value": "1894ee1e31d02ce95f3fb5bfaaeade0718232866702e70bd19a70a0a15a3343c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654705930, "uuid": "cb5f3f71-0c04-4db6-bbbc-e0387558f0fe", "comment": "Malware payload (RedLineStealer)", "value": "77bf027d668ce5aae38fa50c04a24fcf7711f6c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654705930, "uuid": "1fe1f353-bb4f-4e94-9cc3-a817607ee016", "comment": "Malware payload (RedLineStealer)", "value": "93e7f81ccabbaa14ead59d48450d0e992ebbf28a3cd6641a61c951d73e2b94a227d0e0c8510ac60c5ceb771989e07fc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654705930, "uuid": "0c7b59bf-3543-458d-90f7-7ba518a1f97c", "value": "T1D1D3C58A63E49067F4B7A33048B34397EA31BC615B3456EF1289B57D1D332A07B39B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654705930, "uuid": "32c1e532-fed5-43df-837d-78fcad59f5fa", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654705930, "uuid": "d1cb8349-aa4b-4b88-816e-ba54e654dabc", "value": "1536:R9rae78zjORCDGwfdCSog01313I/s5gtW9xnQstSY3BF/5c:RTahKyd2n31j5aWPTBR5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654705930, "uuid": "41a1aa62-c17c-4889-869d-5ed67dab6880", "value": 132096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654705930, "uuid": "5f69cfba-42bf-4a48-8fc6-6052e085aa3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654705930, "uuid": "11857b8a-0d61-4cb3-96ec-50fe051af9e9", "value": "9f45186ab1629c857cdb3dc6de736292", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e64b014f-e747-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654705653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654705653, "uuid": "5744bfc5-972e-41ce-be0d-27cae0b43ef8", "comment": "Malware payload (AgentTesla)", "value": "9638dc0de911bd371e2601f5890ef176", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654705653, "uuid": "c7b01b12-ff9b-496d-a0d2-d6aa75a7d6ce", "comment": "Malware payload (AgentTesla)", "value": "189630c46096ddfb08a86df35783eeee5e71018867b40b8331aacb5d609d3b93", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654705653, "uuid": "7828f657-03f8-41e8-933c-a22eeed2c5ef", "comment": "Malware payload (AgentTesla)", "value": "c5f366249ddd274d5c837f220446d66d0833a233", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654705653, "uuid": "9b0dab1e-b172-466b-9a8d-52d66e7180e0", "comment": "Malware payload (AgentTesla)", "value": "9739431a7dae400bc2b24957f3cf4bed02334ff7fcb42bd725b2c0dd758a9ccd3b2452d04a39da26852a51f1dd226dc8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654705653, "uuid": "1f1316af-1f25-47c8-bb0a-0aa7f203e7ff", "value": "T1F8E423E1237F62E3D0EF7C5579B02FA3A1F19347AD31F66D62CE4A40A2580A51C90F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654705653, "uuid": "29a79eda-dffe-43a2-8c07-f9974f32b27f", "value": "12288:U0l3feZgpxQTka3aiYEM4wpzKJd++Z1QEbvNrSL3cKMKFb+7tFCXVF:RfqvTV/XABK++Z1QdcauFClF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654705653, "uuid": "c597e72b-b506-41dd-b140-7541d35afcf9", "value": 684223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654705653, "uuid": "41c12f2a-e8ed-46b0-9751-7bf5353dc7ff", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654705653, "uuid": "2d6029fe-5819-4f5c-8deb-005c1ff8c613", "value": "Payment Details.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8b44733-e742-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654703509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703509, "uuid": "579ca403-3748-4b65-837f-f365603f7a54", "comment": "Malware payload (Mirai)", "value": "d7815c47b4d8f257c442044435a18d9f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703509, "uuid": "07115b49-d4d5-4597-ab8b-768feda10e45", "comment": "Malware payload (Mirai)", "value": "1912ae181915a014f26bdebcb88887f4dceef601b8d1d362390bfbcf3cf5028f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703509, "uuid": "b814fd62-37f6-4597-95d8-e369fd425090", "comment": "Malware payload (Mirai)", "value": "f2174d186fc922c50d4d0a8747b022b2c0841c10", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703509, "uuid": "a4ac1f29-ea34-4de5-8a74-47d2dd5ad63b", "comment": "Malware payload (Mirai)", "value": "870aae0a481d88774a43955b8a47a3d9f8d10a073c7e62548bbd7d24b7f6f320d8a5cf325c8350a9ba5875fe1121155c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703509, "uuid": "d9900ea5-15c9-4c85-977a-38a8529e0e91", "value": "T114434CDBB402AD7DF99BE6BD80130D0DB93072205093072777A7FC93BD322A89956E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703509, "uuid": "06a6b19f-12ec-46d5-82f1-f9dda1c679a1", "value": "768:lKexZ0heQrB5z0UlJVWVsuZvPQQWO4gFHS6jkuE2SQmSYCrq5s9C3Vm8YO8y:0qqUVdWnuF5jtE2PYCrq29C3k8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654703509, "uuid": "2d953892-eebb-4859-a26a-4881c196a03f", "value": 55216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654703509, "uuid": "aa516051-8e24-4c75-8b23-ab7dcd9d9b0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703509, "uuid": "2355e81c-db1c-4313-a417-28ccbee09e8c", "value": "d7815c47b4d8f257c442044435a18d9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c41bab-e6fa-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1654672391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672391, "uuid": "f492d134-8873-45d8-b58b-6a423c57b952", "comment": "Malware payload (AveMariaRAT)", "value": "f745c922d737aaa68a8a9b435cbd254f", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672391, "uuid": "ab4405b3-3845-4f52-8f95-0fc02188fbc7", "comment": "Malware payload (AveMariaRAT)", "value": "191ab364797a4f3122b521aa2d5fea7095dcc4fbc823256d85d19b6927217fba", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672391, "uuid": "76b68d97-f819-42c6-9510-12879ce71c9a", "comment": "Malware payload (AveMariaRAT)", "value": "bac63e4cba64487214b5c705bd4116c636ee50c0", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672391, "uuid": "cd7e7683-3e6a-42b6-b72c-71aed78b12a3", "comment": "Malware payload (AveMariaRAT)", "value": "316f8979a4de2801002331cd13584fe91848c1963a48d5c219a4663999fcf0ed53f46bb182ea9a736436c27008f43152", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672391, "uuid": "ca567258-8abf-4198-bb39-d66ed837143d", "value": "T1CEF31204E1E85DA3E2C0754A8C1DCF1C3A81DEE50ED8B3579DCA452CE63BE5CB692E52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672391, "uuid": "0ac3d58b-5ae4-426f-9c34-227f0a91eef6", "value": "3072:4IL1UL89W08PIDllR/tlRqZX7gxGoLayb4Ojf48EjCj88mob4d4Ed:4I5i89X8P+RHS8xG2Hb4/Qj8rs4WEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654672391, "uuid": "8de4967d-9e52-47d6-9fd9-42a8e38dcbc0", "value": 169136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654672391, "uuid": "f86a9a6e-2aad-4d4b-87c5-b8af2a0b2c29", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672391, "uuid": "78b019a3-3fdb-4183-8294-a51feae9d4da", "value": "Invoicce june.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee1f61f4-e751-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654709961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709961, "uuid": "b69d4983-c388-41a6-9c95-db8fce39f053", "comment": "Malware payload", "value": "86ec26587378d1a1ff33ce1aa2680fba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709961, "uuid": "45f299cd-fd11-419c-8ae2-87c7452dda47", "comment": "Malware payload", "value": "192fba7e71f2f2e0d53c8ac2b9a0ce20c489b8d8306e44cd025fa0fd3bfc5229", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709961, "uuid": "572f03a1-1cc3-4fea-b5a5-32b18cec9e8f", "comment": "Malware payload", "value": "577ba29772044952e70cfab3f9c08c06a4272314", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709961, "uuid": "a9398703-9351-4808-8e0b-9065e2ed7496", "comment": "Malware payload", "value": "ddf123963b4d03c93d429ccefd9ff090345ac54110f459149f12555df68e689b9d8708deeac8be175f2a0189916ae4d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709961, "uuid": "13e50cab-e1f5-4ea2-9c00-25a846409c07", "value": "T1D4814407D9A848E3D94ECFB51AAF0A8D5EB814021576E8725A7BCCC9C2B8745701639E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709961, "uuid": "1e8fb2ed-8d35-4f87-9369-ac5bdc516292", "value": "5f8a1f2347e2d70603d8e0bbe442cf34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709961, "uuid": "ff935774-fb5f-4f0b-ba27-4e4a94c113c5", "value": "48:SoWgvYijVax65oludAehypweotY5ol7TzHpc8lzLelgt3YfKV67jIWM:kgE65oYLtY5o5vGSvelWoSQvr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654709961, "uuid": "4cc86e91-dcc4-4371-8c8b-e057ced2f8f7", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654709961, "uuid": "2f633737-276f-41ac-8a8e-8ca0fa602f0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709961, "uuid": "1adeb47b-f8e7-4bcb-9f96-200a78692ccb", "value": "SecuriteInfo.com.W32.AIDetect.malware2.2461.25286", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5a20459-e774-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654725006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725006, "uuid": "93104158-884a-4b97-8a4b-b9099be003a0", "comment": "Malware payload (Mirai)", "value": "357b3c605deb36049c29738b0b034f18", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725006, "uuid": "e0f9101b-76a8-4dd0-ae2b-d9ccc1c28bd9", "comment": "Malware payload (Mirai)", "value": "19988004a5aa07698a8edab56fb33bf1c5f8faefcf1de1f095c350020ffaec22", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725006, "uuid": "8b857fa9-033c-4905-804e-5fb025af2d33", "comment": "Malware payload (Mirai)", "value": "e7a38a28e4959ada817abf456dd1afdae028cfbd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725006, "uuid": "3b3d758c-2a56-4a02-beb1-8fb94f330140", "comment": "Malware payload (Mirai)", "value": "a00da66085451d97929c7a6a0517a2e5f46970aba1c1d8f96d26cdd565892af79043e23e40871e8f12ba31ed1e19302e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654725006, "uuid": "99add946-83d4-4702-b9b5-c4d4f0839dec", "value": "T1EC534AC0A5C3E8F3DC00257D349BAB728D73E4BB6176ED9AE3D99827A545502A1033AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654725006, "uuid": "055ac410-5570-49a4-a1c8-913065914429", "value": "1536:kJsCq2O/dOc5h4Fq3y2oYp8xaRxLpgzlYpMgh:L2O/dO2uLdYp8xaRxtgxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654725006, "uuid": "101dcd87-4653-4732-aa38-f45ed6828b73", "value": 62320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654725006, "uuid": "856eab68-119d-4cf2-9408-57c109b8ec53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654725006, "uuid": "95d1dedf-bc6a-4e4d-b58f-85ef42a8e879", "value": "rift.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "005d7796-e733-11ec-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1654696677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696677, "uuid": "3015ae05-5d41-4c52-b879-0cd3f030618f", "comment": "Malware payload (Gafgyt)", "value": "ffbd8238685ed693ee01b0f8f05969d2", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696677, "uuid": "b5621eb0-d93e-4f77-ad9d-420f8250cfa6", "comment": "Malware payload (Gafgyt)", "value": "1a20c53a6802ac73e8ceeed8a6d8ac9abcf7a8a47ce582786aff24fb3e769ebb", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696677, "uuid": "c1c403bf-9536-4b8c-9622-f4d568d133a1", "comment": "Malware payload (Gafgyt)", "value": "582013b7dd8b17323529788bd86b99e37b26f7be", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696677, "uuid": "9f6d65b7-3b2a-48d6-aa24-0fede907e88f", "comment": "Malware payload (Gafgyt)", "value": "eadf604099bdae3d41846651cde0234fee7206a00a89c4ac6e029cc5c10d41aca79f783b2498ee51f173d05f80097fe7", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654696677, "uuid": "9952701a-3286-4736-92e6-a6a7ee61a5b7", "value": "T1D813E0F8D222469CE15F86765DE67E8F0430362EC9049697BEC20437BD51F222AFC6A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654696677, "uuid": "cbf6e7f9-1585-4e51-bbf4-b041b8d5ec88", "value": "768:XGixvRaId11lvafDm1fEMTa+pDfhPTuvpKikTnbcuyD7UWyqfBZcX+uH4fv:hN12fDmNakDJyfkTnouy8NqfBZcXpYfv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654696677, "uuid": "abf49e59-0a31-426a-8faf-27bf995f4cd5", "value": 41844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654696677, "uuid": "9eba4f38-a072-48f9-9645-8d9dea9e3435", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654696677, "uuid": "28140080-78d9-4434-9e6d-2aa097945d48", "value": "gummy.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba3d909-e6ec-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654666363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654666363, "uuid": "d6251835-328d-44de-b120-1dc68eaf3324", "comment": "Malware payload", "value": "3a719e015a77b37681feb160fa2ed0ab", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654666363, "uuid": "b6e21f1c-2a47-423f-82a2-b2342449c2a2", "comment": "Malware payload", "value": "1a69c8c18f6a66c5c9fd552323dc7991f8d950ff0567d2019290e230cc05fa40", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654666363, "uuid": "3c4006ce-df5e-4266-8a49-647d4fb015fd", "comment": "Malware payload", "value": "8e6f9cd9e851f8e76de55b2d68c828c7e7919e14", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654666363, "uuid": "6ca9fff3-15ff-4dc0-9e10-e067b27e722f", "comment": "Malware payload", "value": "511d94bcee40e6fcdf316438c29c227a832badb8494f62840536f165f7715aa85496c63d410e0cc5fce17e6ce096439c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654666363, "uuid": "1c993ee7-7679-4e54-ac64-caa5917fe56c", "value": "T1AF853341ED460FE9C72D0E78171B862D116A7E8DEB28E4FABB5E378D34396A50443B0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654666363, "uuid": "ce705614-876b-440d-b8d5-7f817646597d", "value": "24576:y8FMVzr+I2wtGv7yMGDaj+YT7zMpD9qR3JjLLk9iFySeLMu/lUHGguNaUgjg+NkN:Er/ttGzhWaj+4YpyJXLkPR1Kmg6RsO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654666363, "uuid": "b8d9d9cf-6450-4627-a0b1-e4fa1d7f7537", "value": 1849344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654666363, "uuid": "2e9e786b-c9f3-4fc4-8578-3423e0767114", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654666363, "uuid": "77e397ad-123c-46bf-b1a4-ec87568f11fa", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.11089.1763", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66229214-e6cb-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654652180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652180, "uuid": "0426431a-584f-4880-9f6f-1e1c14974a4b", "comment": "Malware payload (AgentTesla)", "value": "3ed5896f1b10e5b4df8df4cf45310185", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652180, "uuid": "722fe9b9-9de4-4a1e-af43-989231e81ada", "comment": "Malware payload (AgentTesla)", "value": "1c6c2bb7a17ceebc8194c27371feebd6a986346640fa1e178b0d41866d318046", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652180, "uuid": "d2dd4402-1173-4ffe-ae4f-39c1406857cf", "comment": "Malware payload (AgentTesla)", "value": "d275f97e6eef43ed2f2814d6f9783b997d075d9e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652180, "uuid": "d6cf042e-1ab2-4cd3-9ab3-3eb6882dc42b", "comment": "Malware payload (AgentTesla)", "value": "cfbc50162b811403fe533bf4e13d2fb617143a224a077012aa378168b8d2ebac3db86e4463bcb856010c0b2148930697", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652180, "uuid": "f7c087d2-1f58-48fa-816b-73713e51c2b4", "value": "T169241C7E13855D61C6EE41BDD092815811F1E603C326B38F6EE348EE1B1B1CEFA2A9D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652180, "uuid": "e4bf221d-048e-4b72-a5fb-79be5def91c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652180, "uuid": "85e386c7-7e41-4fcc-a8d3-b1ae06e6af9f", "value": "3072:Tc92ZB9r8lluBS4w+JX6blAHgU/L9XY2XqpmcXSk2x0GDIA+Pu/623PBP6aaUkx:I9O3w+UtU/L9XYIcCk2lkuNpia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654652180, "uuid": "68bffc93-fd83-44f0-861a-a35f739b2fd2", "value": 214016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654652180, "uuid": "5d27693b-566a-4570-8185-80febb5f7689", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652180, "uuid": "d5fb21ae-06bc-4a8d-8ed6-070e41360270", "value": "jxemsTomSNKFpSofwJIaXgYFwdr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcedc6e7-e732-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654696671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696671, "uuid": "2dfb6caa-2468-4947-b1b9-85d1d1e6c7b1", "comment": "Malware payload", "value": "15e72cdd707219443a53adc22ea5fdbc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696671, "uuid": "f0e99757-d350-4e06-88dc-b9e5933284e7", "comment": "Malware payload", "value": "1ce62495dcaf68560e4b408499ad281fd116acfd5defd5cc99857e60d7938528", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696671, "uuid": "a956918d-f6b6-42c2-9037-36724879ba5b", "comment": "Malware payload", "value": "8c550d27abed1afdfb3a70ff30b21ad1401a2f44", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696671, "uuid": "022c41dc-dd11-4ef4-867f-7439f97894ea", "comment": "Malware payload", "value": "186d32a0ac78c5dd39809838dc2dfdd81c30b014eb061eae917588de0428ea9511766cc92ceb93a04d83d44f18b3d82e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654696671, "uuid": "b97a0bc8-73b7-4e65-84ea-eb29a2cf2404", "value": "T15513F1F5DAC5C562545B3633BF7D428F399E45F901B636FA7D088A68E0E3C98A12F108", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654696671, "uuid": "08afbaa5-267e-4b8c-beae-096c84a86f94", "value": "768:RisscYbXbX3978uy2HnaLgzuqwjkIUl73U37xcUdxoydwtp:+cYTz3Ouy26L3qwjXUlsdyvtp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654696671, "uuid": "3b526ccb-0b5d-4c63-aead-07e9f657c920", "value": 42292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654696671, "uuid": "cbdd73fe-be93-4faa-96be-e1a01906c889", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654696671, "uuid": "773d5e91-16a8-450a-a0a7-be223eaea6d5", "value": "gummy.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1675d56a-e75f-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654715612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654715612, "uuid": "bbf5ea90-1808-408a-88ab-9d0ac315ab9c", "comment": "Malware payload", "value": "c953ad13b16b3896f522994a62a4d253", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654715612, "uuid": "84449451-1c09-417a-949a-286eafaa009b", "comment": "Malware payload", "value": "1d2994e0bd7e873a5b8191172a940a370c2db5efb4485e0e6d7a30a5abf19761", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654715612, "uuid": "fbe3f899-db81-47f5-ac46-a3ef6196c1a6", "comment": "Malware payload", "value": "883de29befa5862faf39f90be11f9b2316b49d18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654715612, "uuid": "036292fe-7a3b-4489-9799-52742a6320f9", "comment": "Malware payload", "value": "978f6c8c82512ec8976d80ff19c3c29401ca78669493f2d6d380f14db479c8a2f771c06dca14bdeb2463192a434d448e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654715612, "uuid": "c29e7b5e-302c-4508-ab59-a937a32a34ec", "value": "T1147328195AB4C131CDF415FCC5B252F021AF9E8ADA32BDCB3A543D983B34986BF61A44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654715612, "uuid": "81a4c53a-7d7d-47f6-8389-4534b5ba7b23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654715612, "uuid": "d87f249f-26e4-4a38-9d78-0a2df4fe7baf", "value": "1536:Qgr3jjiZEUCj1xtHp3+4D9235h1EIgufDHEz68S:T3jjiPCFHImSh1jgubEz68S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654715612, "uuid": "7941e80e-1d21-40aa-a570-d503aa859884", "value": 78336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654715612, "uuid": "c1171aeb-e187-471e-84c8-4f68ededbd56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654715612, "uuid": "c24273d0-0f04-41d2-934f-609db7808388", "value": "Lwmjb42222022ssxlx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07326455-e6d7-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654657175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657175, "uuid": "9dcb736e-3008-4186-9632-868279cc9b74", "comment": "Malware payload (Heodo)", "value": "b8df5895900d0945cf5726e2ca29a037", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657175, "uuid": "1d748978-ff15-4751-b89f-b7648fca56e9", "comment": "Malware payload (Heodo)", "value": "1d3309f6a4adac5abf59167bf143811eb1496832f877b6965a5393c1da4ffa98", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657175, "uuid": "0124044a-dd17-4456-9c2e-5aa0c4d00a17", "comment": "Malware payload (Heodo)", "value": "0ba8723b8d325839ca6147fe2bd369d557e61092", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657175, "uuid": "c50ecfcf-abd9-4a67-86b8-4d979c2f04d1", "comment": "Malware payload (Heodo)", "value": "6a007bc901df9a4f161f0bbda93274d587e1136efd14079745e26e694a7cb7892d4f0a5f12e39c1b7e38a009057480bb", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657175, "uuid": "0910a35f-03cf-49db-820c-51e5853c878d", "value": "T18304023EE5031A98C22ED8FC58EE6DF9D5F634006268063A1BA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657175, "uuid": "5327cb56-39c6-46f3-a665-4dd4a7b0ea67", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657175, "uuid": "7c3f09fb-c832-42c2-addf-f49615cb676b", "value": "3072:VpjftgFs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VRyi1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654657175, "uuid": "15c9a3cd-a1f5-4558-9c5a-1c7494ee4115", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654657175, "uuid": "beb79963-fc17-4b02-bdc8-e7773b48c187", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657175, "uuid": "ed3c8d20-2b00-42e4-8287-8dd219824850", "value": "b8df5895900d0945cf5726e2ca29a037", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb6b4473-e722-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654689797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689797, "uuid": "f289df4d-83e6-4daf-b232-8cc4c004c1df", "comment": "Malware payload (Heodo)", "value": "924963661db33959ebd2b4082295f42c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689797, "uuid": "2d159801-92f6-49dd-8a1b-9230d8c37d6d", "comment": "Malware payload (Heodo)", "value": "1e72bdc2da53efdffc812867c11ee3a1efcb8b16cc1ebc1aafb012b971937f37", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689797, "uuid": "dddf8a1a-1222-486c-8bb8-26e9768a840e", "comment": "Malware payload (Heodo)", "value": "59a839af499d4021a2bd61477399f31134773803", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689797, "uuid": "684d41aa-72d9-41dc-9446-fab81442fe6d", "comment": "Malware payload (Heodo)", "value": "d5524dbf3e90e96a0a796d5c4edceba2170117bfff8f56d6643e929b6711011c16f5b457986ad0371ec36e83e106e150", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689797, "uuid": "029260be-8296-4988-b56f-5488e540a480", "value": "T1CB23A446BB5AC85DF914873448E747AA7323EC314F6B0B433669B3256FF89A05B0315B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689797, "uuid": "dbdcdcdb-a024-4d53-a04c-f84449e59d5c", "value": "768:pDMPKpb8rGYrMPe3q7Q0XV5xtezE8vpI8UM+VQTUs77quK7KtGu6U:pYKpb8rGYrMPe3q7Q0XV5xtezE8vG8U6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654689797, "uuid": "6bca48a7-bb4d-4ed4-8da2-6882a7e924da", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654689797, "uuid": "8b21cf9a-2103-4dd2-89a0-c86048d4b2c6", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689797, "uuid": "213165bf-d704-41e5-bc27-b8ee30c3fe5f", "value": "New payment details and address update.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "074abe54-e72c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654693682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654693682, "uuid": "4bcad487-52a1-48b1-bde5-938ff881d902", "comment": "Malware payload (Mirai)", "value": "061121a651c6aadb30291f2277a9f536", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654693682, "uuid": "7bc610c2-e09d-48a3-a859-c6a7b97ca85d", "comment": "Malware payload (Mirai)", "value": "1e964c37422979e8ec3ac6847a418a64dcc803f842e9a1dbcbe5d411c1b8e993", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654693682, "uuid": "a16da5f0-e460-400f-8ea2-bd952946b7fc", "comment": "Malware payload (Mirai)", "value": "9dd1e5957b30ca907cda64888e975d07b5c078a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654693682, "uuid": "35fc0886-04c1-42ba-8f98-decbcbeb7aad", "comment": "Malware payload (Mirai)", "value": "47226e16e41097e4284f23bf3b809365dbd55e09ac997dc7eebc45b19f7e864cc7b2d1c539635c813782c5be94d73cd6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654693682, "uuid": "a1a4462f-ab9b-4472-981a-492fa5857e6d", "value": "T1D583850A2E359F7CFB9D863587F78E21964833D626E1C585E15CEA011EB034E342FB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654693682, "uuid": "d6afc06e-75a0-4b17-866b-01c69af64be7", "value": "1536:5Wl06FFBKJtwitY2X+mKVTEywBYaxsC7qnzdz6aWGn:K00nKTu2X0TqBYaxsC7qnzd2aPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654693682, "uuid": "cb86af3f-69af-4919-a0ac-02843e42aecb", "value": 88272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654693682, "uuid": "37048bd5-590d-4e96-8618-d2223d0bd4b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654693682, "uuid": "a9c68e58-85f5-4122-8e59-b5e0ba73e5a3", "value": "061121a651c6aadb30291f2277a9f536", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b54b3c71-e705-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654677224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677224, "uuid": "ec60ef08-aaaf-4e4d-a0c7-c921c00ea2f8", "comment": "Malware payload (Heodo)", "value": "6c24f6931043cadc41b557753f901a61", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677224, "uuid": "395cce7a-de1a-4902-a903-8f013f6fafb8", "comment": "Malware payload (Heodo)", "value": "1ea45abd55358dfe9c7dc1d4bf3c9124b739c612985350072a0f1a2486fbc583", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677224, "uuid": "79656845-9dc8-44e1-9a39-7001236ee821", "comment": "Malware payload (Heodo)", "value": "570627808968b291bfb548d17f1c60b257f51386", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677224, "uuid": "30f0c943-f0bc-4a72-85bc-00d3558a1b26", "comment": "Malware payload (Heodo)", "value": "a91ce626f019bd84693e12d8fe3713f595220f4eb24aae0f5ce2ba8dd6489eca2c781434e3bc8f59260be93c54f5a301", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677224, "uuid": "1ee32a78-a6c5-40be-8df8-411f59de2833", "value": "T15444C0C5A791ECDBD92503790DE68364233DF2806BC74B033AB59A360E73B646FD5688", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677224, "uuid": "fa2931fd-10a1-4283-8bf3-b07d0172f2c5", "value": "963f2e88a5b03877d0583808b2526c1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677224, "uuid": "61c0732c-c804-4020-9e6e-c780ddccdc24", "value": "6144:M1AyqUcchr3fdAdmG9rjcOLDNffPwz3GzMc5:MVccxfzGBcOxfHQ3GzP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677224, "uuid": "9cacf835-004d-40c6-b361-4df24818c325", "value": 274499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677224, "uuid": "26a76eb6-1e05-4120-83ac-19e8127618d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677224, "uuid": "df0c5035-4204-4b54-a9fe-ed5de5c19ce0", "value": "6c24f6931043cadc41b557753f901a61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd072f8d-e6fe-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1654674284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674284, "uuid": "bc949215-434b-4c7c-b51c-00350d987bd8", "comment": "Malware payload (GuLoader)", "value": "5febeafdadaabdaf8b15a8d711a434f8", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674284, "uuid": "c15c3aa1-41a8-44d4-b123-e075519a26fd", "comment": "Malware payload (GuLoader)", "value": "1eac463a43d3582423f777e7d916ad38db5d6ca652f8c52db1705ad5b699ba32", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674284, "uuid": "4943e2e9-06b8-4533-bd94-f7784d1ae814", "comment": "Malware payload (GuLoader)", "value": "7211f6ba9d8b5c050faba54b108503b0d0cd4ea7", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674284, "uuid": "fc2b507b-87fa-49a8-8a81-a7d365e717e9", "comment": "Malware payload (GuLoader)", "value": "5825f8b48605118af6babdf10fa692fcce378849cd91df7046eed852fe4ccca76d0d03a7f340a171cfee9c335aa80328", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674284, "uuid": "2bb01830-fc4e-45de-bf3f-a28a34323161", "value": "T1A5F433181B7D752AEFA2360B1333A3A6DC6C916295FB87BBB7FC7042379861085CD149", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674284, "uuid": "5af7fb63-655e-4132-a125-37db57a8d3b9", "value": "12288:6AgGMHyiifmG5tJubYL6VSIcxndWFBVLC4Ra9q9+5/cixyB+8EL+EZe3MEd4zm:6AlMHsfmW6tVSbdWU0zi/cSp8EqAeQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654674284, "uuid": "517f5f09-e52c-47b7-8e2f-3f0399a501ff", "value": 769403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654674284, "uuid": "46627aa4-1a62-4668-89ab-d7d1d4c09d7b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674284, "uuid": "43b02dbb-e264-423a-8371-af9cb6356c8d", "value": "factura.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "800cc7ac-e73b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654700327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700327, "uuid": "50ee6254-7e79-4f0f-ae21-e273bd5d6761", "comment": "Malware payload (Mirai)", "value": "b62c15f00c1dc99f1896eb4c7cfaffa7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700327, "uuid": "e13d1379-543d-4f41-a8a0-2f86e1c8b5b3", "comment": "Malware payload (Mirai)", "value": "1f726a2c37a23ef76e1ac383f6255a919c331ddff2fdc0bcb088867d083bdcae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700327, "uuid": "635929de-b482-4ae6-8e20-d990b80b8a06", "comment": "Malware payload (Mirai)", "value": "6f795f9bf1558dea74b5ab20e210e8c902ddf615", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700327, "uuid": "c20ed75c-abd0-4725-a622-5b643dbd95db", "comment": "Malware payload (Mirai)", "value": "decaa852ac98a99deea099aef59d260e48c93885abec866accd59c291bdd30379ee3ca91a01353abf77b6e4529baf4d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700327, "uuid": "b938a2a1-2cd3-4923-a9e1-6b12afd4695b", "value": "T1DB834BD5F8029D7CF84BD6BA40274E09B930638457A31F3BA6A6FCE77CB21585E12D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700327, "uuid": "caf679dc-eb47-4206-adcf-28810c94053d", "value": "1536:x9zxVwyPAPPMgGwICnf876TAbSOy40AyWEE:vxiyiUHwIMRyyf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654700327, "uuid": "8d7e2a39-54b6-4257-bdcf-96f24d994ba6", "value": 80724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654700327, "uuid": "499c1a6b-1f35-4f8d-be24-f7d3c4fdf052", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700327, "uuid": "9d626cd7-5327-4d11-86ad-fe5179a741f0", "value": "b62c15f00c1dc99f1896eb4c7cfaffa7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "943fe2ef-e6d1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654654835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654835, "uuid": "6eb18426-52aa-42e0-8e17-5f18d070866e", "comment": "Malware payload (Heodo)", "value": "8359029603330bb572e9593f07584d7a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654835, "uuid": "fa846104-7d9f-4dd4-be34-c5f658928141", "comment": "Malware payload (Heodo)", "value": "213da2c511f8776cb604e3a04395cbc331165e22c75f08e532fce5964523975a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654835, "uuid": "785b7a02-4f39-44be-8d0b-f125d1b0d74b", "comment": "Malware payload (Heodo)", "value": "7ce62bd90009473ee1c88f4be3892d2d74461e73", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654835, "uuid": "87df1bfd-ce73-40f7-820d-ba8a0d43d33f", "comment": "Malware payload (Heodo)", "value": "24b5e780842bb67120885c65475ddcf98225997dac8488cc252ccd476d88bc14ecae056659111d6ddc1bb0189fc14854", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654835, "uuid": "83898b46-32ea-415c-a214-77882426ab6f", "value": "T1A404023EE5031A98C22ED8FC58EE6DF9D5F634006268063A1BA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654835, "uuid": "de30712c-cadb-465b-8bce-b762f921c720", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654835, "uuid": "7ede4ad4-c588-4ef1-8b30-4e5575fb5f24", "value": "3072:Vpjft5Fs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VRzi1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654654835, "uuid": "deacf645-643b-4b0d-8d2f-1d07c1deb750", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654654835, "uuid": "91b98454-34d0-4dec-9ca5-7de6b86c735a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654835, "uuid": "70215c32-52ec-49c4-ab44-20d4c74343e4", "value": "8359029603330bb572e9593f07584d7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d6598a8-e705-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654677184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677184, "uuid": "a80f29b4-a45c-4fcc-bf9f-0f28c94f84a0", "comment": "Malware payload (Heodo)", "value": "027a8e121fe51595afc97f05a25d79f6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677184, "uuid": "f1c31a30-2c05-4375-9750-a2da637e25ef", "comment": "Malware payload (Heodo)", "value": "21ad01792b7939407a4097f76f4913d83f1071f5b96244790ec0f1594ab7d2c8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677184, "uuid": "1e5f42ff-375f-4660-93b5-173fba0ab38e", "comment": "Malware payload (Heodo)", "value": "5d80fadd9caf557e91f819f65b673ffe40d10726", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677184, "uuid": "7420b691-9894-4ccc-829a-3eef7b0f7109", "comment": "Malware payload (Heodo)", "value": "cae39d49989aafa6cc9a222e0e415ba8f17481e8227e534a77033a4875da7fd0516338f919ad6b692a9b12255f1d28b8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677184, "uuid": "ad2d0e92-25f5-4c85-87ea-f72c0316d712", "value": "T12544C0C5A791ECDBD92503790DE68364233DF2806BC74B033AB59A360E73B646FD5688", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677184, "uuid": "2b9a25c8-0de0-4a59-b473-26a11b4b283b", "value": "963f2e88a5b03877d0583808b2526c1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677184, "uuid": "86f184f1-42be-4d70-8c16-c843c8c37dfe", "value": "6144:M1wyqUcchr3fdAdmG9rjcOLDNffPwz3GzMc5:MFccxfzGBcOxfHQ3GzP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677184, "uuid": "58ceec76-7ae8-488a-9a31-f41f27f76c82", "value": 274499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677184, "uuid": "a0c222a2-28cb-4e3c-b44b-a838492c6528", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677184, "uuid": "6ac4697b-cd8f-4121-9330-7a93742599a8", "value": "027a8e121fe51595afc97f05a25d79f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba12a6c3-e723-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654690117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654690117, "uuid": "474a72ae-eb23-4190-be89-36c7e9ce6edb", "comment": "Malware payload (Formbook)", "value": "5325afcad379b1fcab62f69159f335e4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654690117, "uuid": "4b5bd7dd-f7f0-4f40-a962-fc16a26315e8", "comment": "Malware payload (Formbook)", "value": "227ca876e8e40844bece2a0fb659b1891060d85be1aaf609fe85f616c81c896d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654690117, "uuid": "0c2c97b1-e0b6-4e20-a901-053017d1ef22", "comment": "Malware payload (Formbook)", "value": "8997730624c465db80e002a810bb41e889cb482a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654690117, "uuid": "7af2725c-0ba6-4ab1-973a-b9af2d4c8efc", "comment": "Malware payload (Formbook)", "value": "7b2782628a9c377c4ec8d3ececa76908e38a6d3560f7f50b509bae48a43ae2b4a663a78863cb9fe3534ff8f20b70feca", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654690117, "uuid": "22d62357-e362-469f-83c0-75fea18d0acb", "value": "T1A48422987342DF83D99B567F48C4969862F7CE001A1D86F2A54072BB227CFF1690DB93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654690117, "uuid": "a6fdb841-c180-400b-9d73-f7f972017c35", "value": "6144:phwUIJBUrOryZNcjOzRCjTdrnkNjUO/PRapHTm3lMHWkI56USQfvLI7XwZuO/Q:jvcUrO2ZNcUAqRnRYm36HDIhScvLI7Eq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654690117, "uuid": "f0baf294-fcd0-4fa8-ba9c-0f418c7400cd", "value": 388744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654690117, "uuid": "cce8fea2-3200-4a19-9de9-6ca289876182", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654690117, "uuid": "d3c52a99-d213-4955-816f-1f616a54d5e7", "value": "DHL CUSTOM CLEARANCE FORM.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72b0af16-e747-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654705459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654705459, "uuid": "1b695c41-ac86-43f5-9a71-6cb3eb3b1b0e", "comment": "Malware payload (AgentTesla)", "value": "acbb93273e9eb24b6982c51b038a90cb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654705459, "uuid": "cc017152-e5f4-48fc-9bb7-164759b6f760", "comment": "Malware payload (AgentTesla)", "value": "22ad1cf85cf71eac95fccd0564f47b3203a31399097c1e95bc2a6c0089a78ccd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654705459, "uuid": "f36719db-d3a8-4916-899d-562389ce63da", "comment": "Malware payload (AgentTesla)", "value": "d38fd197dd535da5f62b23f9d35a16e02d559463", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654705459, "uuid": "b70cf118-54e4-42e1-99e1-811625859b7b", "comment": "Malware payload (AgentTesla)", "value": "8c7b6ff7a395f38f57901ffeba4c9557403b490c17c2e8a917659aea15ada59367119254bf8fb89e79b501ab4297be41", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654705459, "uuid": "0bb0d6fa-18df-4abb-92d6-7cd8651df4d5", "value": "T1C3E4230B9E27AFBF1BB095EF0159FD33A0968A42479971DC34E8409297E05CC89779F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654705459, "uuid": "847eb7a3-1051-427f-89ef-bb5c443759e0", "value": "12288:lqR8h14zDdrXKFClTPi5Wp0HIU07FqkXowm8yE7OAZ5wUVBAhYoN4wJ:E2hSzhXKFCVPi5P6YwmFPAZSUchF+wJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654705459, "uuid": "338a3990-8ac4-4aac-8582-b73b74e943f7", "value": 680527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654705459, "uuid": "c1080d93-006a-4229-98b0-4442763ac849", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654705459, "uuid": "dd7673af-08d6-4c89-a984-906bb2202393", "value": "PRE ALERT DOCUMENTS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd05dee-e735-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654697770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654697770, "uuid": "fdfdb05c-3da4-4496-a285-5274031af3db", "comment": "Malware payload (RedLineStealer)", "value": "79483cfb7d7ca0234b83e81be8c95fb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654697770, "uuid": "a4a1e432-e18d-4505-9c90-176d97089803", "comment": "Malware payload (RedLineStealer)", "value": "22ce4c87dc804c7e22dfcc6529b24817eb83aeb80d6c007ab89dbd927bca9439", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654697770, "uuid": "67576375-702c-488d-ac97-446549481f6f", "comment": "Malware payload (RedLineStealer)", "value": "9ea3f12a813f4251d67b57d795f449be237c1af0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654697770, "uuid": "791e5a97-5e27-47c0-9df4-626b2b35306f", "comment": "Malware payload (RedLineStealer)", "value": "cc4d14539da977d906b0219033caf37e706175aa77ab8bf7479b2183a69356243fef215c526f31f8d34b08bf914bf488", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654697770, "uuid": "33d62544-c8b9-4a51-8a7f-85a48270e5f7", "value": "T147448E10BB90C034F5B792F449B9936C7A3EBEB15B2591CB92D41AEE56346E0EC3035B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654697770, "uuid": "6ae372cb-7b61-4712-8513-debfb9069a4e", "value": "f3934bb0048d44387137e6b580143d69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654697770, "uuid": "888ac726-82e2-44e4-bcfd-7e06bc208c07", "value": "6144:Raiz4BVvpDdKsuDP31MSuDr8RmeeNAaASWQk9TOrr:RarnYsC/1MtDGh0bxWDZ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654697770, "uuid": "b211e783-0502-4b08-8007-cda6d202cccf", "value": 272384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654697770, "uuid": "75cea8b8-5a21-41bb-9dde-cd926e4ba34d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654697770, "uuid": "cb203fcd-e30c-4f51-b18b-fa877f0b430b", "value": "79483cfb7d7ca0234b83e81be8c95fb0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "924e9c81-e76c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654721403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654721403, "uuid": "4991bdc8-6706-4644-80d5-994c430851b2", "comment": "Malware payload (Mirai)", "value": "63cb069d58c2e3b61c3cc30e7d5d6b87", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654721403, "uuid": "868e8cf1-8792-4533-b4fb-af8e93a038ab", "comment": "Malware payload (Mirai)", "value": "2317b1657ddfab3a19e9b2a73d973ba48a18b4e12e93e4fe17ae247c82a475be", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654721403, "uuid": "e6f42637-4128-4d77-83c8-75955b1aa316", "comment": "Malware payload (Mirai)", "value": "2fff7c80756eb1521bdda9a469306093e375ac8a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654721403, "uuid": "28833e3b-4d60-4980-a834-e0cee486ed89", "comment": "Malware payload (Mirai)", "value": "8e3fefa59a31e7edbe951ef5aad6ad712732f0ce0187da55debf3de74e8b85dba258c527ab7aa074cfa33cdda03e2dc4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654721403, "uuid": "1b12a00e-7ea3-4cc3-aac1-1ad81b00f619", "value": "T13A534AC5E5C3E4F6EC050839206BAB73AE73F57A6175DE9AD3D85133AC12702E21625C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654721403, "uuid": "364179c7-052d-4059-9eed-aaeddfa85dd1", "value": "1536:e09VpBkbNo1MB0oOHItvjmiE0B5Wgh7xdvfzYTaFJSTi+bZ:e09VpBT3ok4vjmi3rbhFdDYmFjaZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654721403, "uuid": "bdc3c848-9489-4a90-aace-0bc7d9bc9118", "value": 62544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654721403, "uuid": "d0d98f82-e171-4475-8c12-10cf6b252a76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654721403, "uuid": "6bb2c147-2dce-4a5e-809d-feed79c6c104", "value": "gatox86-20220608-2050", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37d96d4e-e738-11ec-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1654698918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654698918, "uuid": "80228b4f-4015-49ef-836b-5007958de28b", "comment": "Malware payload (AsyncRAT)", "value": "3776d8806bf718b55061f24aa5692408", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654698918, "uuid": "7359c9a5-fdfc-4cf8-8211-ed9db4e55877", "comment": "Malware payload (AsyncRAT)", "value": "234f42279e4494e1fe592d5b7ee4b2722fc885d18b6d7878f079e01bb0e123fe", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654698918, "uuid": "6bb3443d-356e-4644-a32e-2864bb8ef5e2", "comment": "Malware payload (AsyncRAT)", "value": "fe9a98acfce5d81c301ecc86f536eb6401c78d02", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654698918, "uuid": "69162cdc-85e3-46a0-9195-c0d21d45caca", "comment": "Malware payload (AsyncRAT)", "value": "d3701e261954aa73dc9c61eeaf87aa66fcc723b5d829b0cc0a61a3ba8cf5f2ae9e5fc20685388c07df87ed02f397489b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654698918, "uuid": "8774509a-67b8-45d8-b4b6-e9f8ab00ad57", "value": "T1D7D4D01276A7CE73E2E60777C1DA4004D7BA9142D6DBE31B224813E59E4B3DECA06787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654698918, "uuid": "642917e2-0afc-47d2-a47d-c818f63a2609", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654698918, "uuid": "4b499ac7-f11b-4b50-a8db-aa58a89f58b7", "value": "12288:C632LqsAleLhc9qdWkIYOvNk+7OEGXerrFbEO+488q:jJshcIvH+OzOnFQOt8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654698918, "uuid": "c4af0ece-4de5-4079-89e6-3c4fa9c5c0b9", "value": 646144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654698918, "uuid": "95ad3ae0-56c9-44e1-8b7e-eae5e2bed949", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654698918, "uuid": "98e3da48-c5a7-4b07-9375-ab65b3e6133f", "value": "Factura de pago.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4390c9df-e728-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654692065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692065, "uuid": "3ec8b414-b424-4d2b-b6bb-b60448d35371", "comment": "Malware payload", "value": "4b5096399a2dbf6fd9b728d0940ce2c1", "object_relation": "md5", "Tag": [ { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692065, "uuid": "82ed2e2f-49c1-4697-aca5-efb3fa2f7c1d", "comment": "Malware payload", "value": "2384429e99d8b412fbe8c9ba00924c32f863acb5eac5c59d70a0ce89e9c350de", "object_relation": "sha256", "Tag": [ { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692065, "uuid": "7bf9b881-6c77-4cc5-a1f6-258c2db13000", "comment": "Malware payload", "value": "a66e21bfea8856bb7fc0e4e5c3bcbf75433a804d", "object_relation": "sha1", "Tag": [ { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692065, "uuid": "61e125aa-b510-47d9-9b39-ecef1656ff92", "comment": "Malware payload", "value": "e18f8144bc5d7e577bf3c6326f58c2042c29f75926e84d72690525f9a748bbf18a04d88cd985adc4f63b2dd167fc880c", "object_relation": "sha3-384", "Tag": [ { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692065, "uuid": "5fc82727-80fc-48cb-83ad-905ad4747122", "value": "T19A229E7A811F1D31E9AE9735F0906B56ED4CA887F64F3960B1166EB7C5E22CC9334A40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692065, "uuid": "6cf81a1e-ce72-4bec-a831-801d8c58c95e", "value": "192:gEhMZVfqUUm9264wprGheYb8j7Z/c+8poF1d3jvvtlv0qlrGxjPE3:gquVfqzm92hwBGAYbycfa7pr1lcyyxjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654692065, "uuid": "7ca399f9-e266-466f-8942-019662211c9b", "value": 10698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654692065, "uuid": "dc78ad18-2c81-4010-916d-b0601db03f75", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692065, "uuid": "d6888769-3e2e-4f9a-9dca-715f2360e51a", "value": "Doc1.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1faca63-e73a-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654700035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700035, "uuid": "0870098a-4804-4907-8519-831b1d79d262", "comment": "Malware payload (AgentTesla)", "value": "f8857a64b973b12cdc68985961cb980a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700035, "uuid": "7b808c48-dd69-441a-b01d-be8e032f6576", "comment": "Malware payload (AgentTesla)", "value": "23a47b24034f0fd10cd3d88e87ddf16eb5f656d42f748aea79506e232fd162e4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700035, "uuid": "3c702ca6-de5f-460d-a68d-f2c1a1ed4a73", "comment": "Malware payload (AgentTesla)", "value": "72791e9f39b2d4612f040577877b55d6434ea284", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700035, "uuid": "b042d72f-cc1f-4b81-a9c0-5ce82d5aa095", "comment": "Malware payload (AgentTesla)", "value": "5ea8d6fc18be17509e4e7853672347ed4d3c6ca550d72b769f5927c5fc32c525fb18e386621af6c66c2e3e5a63bb270f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700035, "uuid": "01736f35-4753-4ced-a307-77ec55a9e7de", "value": "T1A9E423512FEE0E51A06D9A3F8DF31A2513E3B21665D41895047BE2F3EA9560C2CE4FF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700035, "uuid": "50cbdc3c-1828-44bc-b049-04f7304524cc", "value": "12288:T+qXxe/pcwNQZC7aBGPKDhFiVfYlpywfy9PSSCeR4uhO+X1Xgr2A:T+Wxe/aCQBtfiV9RSSzR4uY+X1O2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654700035, "uuid": "2bb30e6c-cb39-499a-8980-de35ee4f3fb5", "value": 680253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654700035, "uuid": "d736d41c-f4f6-4f63-96f0-be9901f1afc8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700035, "uuid": "02774eae-c772-48b5-b3e2-dfd898fa18ea", "value": "photos of damaged goods.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb35bf1f-e72e-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654694870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654694870, "uuid": "ea0d947d-8d2f-4ada-bdb1-e09d6c28da18", "comment": "Malware payload (AgentTesla)", "value": "0110bcb6cb91f2dac6e4602bc94be350", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654694870, "uuid": "e0514b95-c204-4c44-98bc-0fc67425f1b5", "comment": "Malware payload (AgentTesla)", "value": "24096a8e15f5cc1c4f4c87c928fb0fb655bfb0acb798b299a00a217f2fdbab7a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654694870, "uuid": "3802a593-4820-4d08-860a-25302fd8cabc", "comment": "Malware payload (AgentTesla)", "value": "10bfdc828ef43435acb32a743af10d615f67aff9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654694870, "uuid": "97900b3c-c26b-4844-aa1e-c431e0073c63", "comment": "Malware payload (AgentTesla)", "value": "127d382c5079b605924a33878a6cb8816dd26512443a95fb023bf5f4151cb41b6b769c852aa20dc47a959b2c1ab2a8cd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654694870, "uuid": "dea7f3f0-7e3e-497b-b325-9f1df752a1d7", "value": "T14005E11675ABCE72E6AA0377C0C25410D3B68646A1DBE31F329813E59D437DFCA46B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654694870, "uuid": "d61d8a58-76ec-44c1-a97d-6a71cb8d403a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654694870, "uuid": "d29c0b5b-db03-46f1-b980-dd0382cad3c1", "value": "12288:gbpzPlXhc9qcWMAdyX3tTMzdY83Gqa8uVCydBGrFWDB:KhccMAq3tAYvqmVtvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654694870, "uuid": "b0a08dcf-955b-482b-aaf9-82201e0b9fa2", "value": 796160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654694870, "uuid": "5abfa0d9-ee4d-4b1f-b44c-ce418e6b7e78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654694870, "uuid": "f03917f5-ebb6-4c13-844c-141cb8583e95", "value": "Order enquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33351f97-e700-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654674858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674858, "uuid": "c6aa6ef1-f180-4656-a5a0-268a9a094fa5", "comment": "Malware payload (AgentTesla)", "value": "9b637272223f0c7cb6d043cd9267bf58", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674858, "uuid": "844019e6-6b57-49fe-b291-c6acbd34e59a", "comment": "Malware payload (AgentTesla)", "value": "246ef5f4b02d7f1a2c6806c68f405b2d2fcdda597f508ad9bfe354149ad5abdd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674858, "uuid": "89d93a14-b5c5-4ca1-9106-e6e779facf6b", "comment": "Malware payload (AgentTesla)", "value": "5e44a7bf0fbfbda2fa729ead107b1cce2ccea6e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674858, "uuid": "2540b6a2-4147-4015-acd3-959cbcf750fe", "comment": "Malware payload (AgentTesla)", "value": "867cc3fa20bc0f7d71b2acede70f9fc2450cecd783bc5fbaa25516a22beab93b08b866da7290f928abb28be056134ec8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674858, "uuid": "dbd51593-51c7-4689-ab94-621f2f7e4fa4", "value": "T10CB423808DC57717FADB01658B584AE8A341B26DD93F3ECD6DF0A117E94BB4A8C0BD09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674858, "uuid": "c2712dac-b878-43df-af40-eb02e9814bcc", "value": "12288:OuYUNLWSnuY9P2vFEpN8zN6WSB0Gu/fkxsp4kZ:NjWSnRP2iiGu/Mm4kZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654674858, "uuid": "6982a3e3-a837-4cda-85de-69665ca45a06", "value": 506267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654674858, "uuid": "f299c072-c941-4151-a3bc-a5a0d9ba4121", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674858, "uuid": "822b8a54-b1ed-47b5-9fc1-13f94a8014a2", "value": "swift copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3f2f98e-e6f8-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1654671611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654671611, "uuid": "4de1cb43-d21d-42d9-80be-70d91d4e0698", "comment": "Malware payload (AveMariaRAT)", "value": "b1718c776a1f8ed52bf65d4f9f6061fe", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654671611, "uuid": "b91fb5ab-0302-4630-8214-aaa8a5b5b1d5", "comment": "Malware payload (AveMariaRAT)", "value": "2474a617fc640542b91768bb951972d7cabb24e5b190e30b692bf832becbb9c1", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654671611, "uuid": "5d661780-9c46-40be-8168-7eb0f35b3b45", "comment": "Malware payload (AveMariaRAT)", "value": "a21ea191e278ac2bf04b2a6b7f8b7ed30908f505", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654671611, "uuid": "418b5333-ab10-4907-bd10-f96b7d6df238", "comment": "Malware payload (AveMariaRAT)", "value": "f8f64567ceddd77347990b8447d944fdddcbfcce811b87f3ec47b0f997a7c9abb8742142e66f9a5455dfbcd884a2b624", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654671611, "uuid": "3ae60a20-689b-4c8e-9d03-8608e0a655b0", "value": "T1D5255B2DB69097B3D3760A38DD47B594642ABED0AE146C8F3AEB1E5C0E3564C3C179C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654671611, "uuid": "226d1ca1-d741-4e43-aa07-e37c39ef9be6", "value": "d3bc99537672e52a7d488f94b36393f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654671611, "uuid": "d84d0740-0ba3-47ad-87de-3945d6140b87", "value": "12288:27VHnlAyEp2qnH6MVjvF5fxd45Ed/WZYJgH15lCaczZIkXe0oZL8CJ1jyo:EpS2qHlxd45E0OuH/h0f+Mo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654671611, "uuid": "52ebb92b-2b5e-4315-9411-a24574c75baf", "value": 1026048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654671611, "uuid": "8251fcd6-4656-4831-8cd8-64ce2b70a8bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654671611, "uuid": "f9b9ae9e-7042-4a87-b298-5517550229b3", "value": "Shipment Documents Copies (ETD May 22----ETA JUNE 29)]]].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e353ea61-e706-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1654677731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677731, "uuid": "f4a8b158-a67a-4f8f-abe1-dfd4d246041b", "comment": "Malware payload (SnakeKeylogger)", "value": "7828565f60f0073b50cdcb42caf728d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677731, "uuid": "4919f154-7a5e-4f9b-b8cd-c45683e1512b", "comment": "Malware payload (SnakeKeylogger)", "value": "253533ffcbf27534c3ce107dfd3b0013ead076560763d2de787bd2c13a977124", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677731, "uuid": "90cdbd95-6732-4500-a54b-04f330334382", "comment": "Malware payload (SnakeKeylogger)", "value": "a12ce3eb9e74946c492737e3549bd1c020eba3c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677731, "uuid": "f05e99f8-47c6-4ffe-902c-c7b4c29b5819", "comment": "Malware payload (SnakeKeylogger)", "value": "65ae53ba5fc6b6e2241043010b777436f32fe07bb4a93baee05352727504c913aa6e330564f9139a0df95983d7bd9b0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677731, "uuid": "a65d044d-cca5-431b-80f0-71c42d00fdd6", "value": "T156F4CF86B325ACBBF53446F26022C09513B81C6E89E4E2F64CDD70CE69F1F9254E69C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677731, "uuid": "1a80fecb-116e-4cda-97d9-b4f6b733c627", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677731, "uuid": "617d704f-0ea1-4be4-9dc6-926c08db5735", "value": "12288:Q0GxQy2iNqDdpbSNfYmxn0Sz2cBExEE6OtDPwTNqEh8EbYo/:QBxX1QHbsYSn0W2cCOfOpPwgEhj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677731, "uuid": "b9fb3293-c822-4f6d-a584-2c1e40a71828", "value": 746496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677731, "uuid": "e63d27e5-3d02-4641-9323-67924af0b012", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677731, "uuid": "ef34e30f-409d-425d-8a2e-c5afff1282c2", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc695574-e76f-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654722789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722789, "uuid": "82905ec0-afb4-496a-b184-c253f832cd70", "comment": "Malware payload (Mirai)", "value": "287dfd65ff7615b8375a52519631d7df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722789, "uuid": "8055bc85-c263-42c5-9247-f2f45951cb95", "comment": "Malware payload (Mirai)", "value": "25636891698c5624e6078060cab412ea8319b485f62f94b22407bd74052832d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722789, "uuid": "147f7000-58ac-4b7d-9626-58f4be8b0764", "comment": "Malware payload (Mirai)", "value": "29aaf1008fd9b8169747fbeeb7bf979257b097ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722789, "uuid": "6cd0b7a2-dc62-4b20-8377-c9862bc33265", "comment": "Malware payload (Mirai)", "value": "5884f5377c15a85e22bc4151280d7cb6c82443550f52e8184eb79077397efdb70740612454c52c11b74b3d64177a8dae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722789, "uuid": "8bce2dea-1ee1-4dff-8ec2-c671c3dab88b", "value": "T1EE33198D64112E2DEAD66CF950664F0ADD401220B5A3171FA3FEFDC33933368EE51A59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722789, "uuid": "533bbce5-1eb5-4103-8627-1a58d19bfa90", "value": "768:eOEBCyhD0jSsuEUuMK0yer1gRu7Y+YxZWCPE9V2jiJ7QIQm+f1prfLBj3PF0eT0I:FEBCKBsnUuMKFIYZRs7QIXg1pTR/wI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654722789, "uuid": "748eae43-77a6-4049-920f-d449bac1a9c0", "value": 52780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654722789, "uuid": "70fc4b51-272c-4861-88e2-e4c47abb4ebe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722789, "uuid": "b99e63f1-ba58-4488-9f25-e27ff23634c8", "value": "287dfd65ff7615b8375a52519631d7df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "769f59fd-e6d0-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654654355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654355, "uuid": "e573a1a9-c992-443f-ae6a-97ff9a57403e", "comment": "Malware payload (Heodo)", "value": "f6d889127e9c6b1de20223d5bd9da3c0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654355, "uuid": "0ad47e34-afed-4548-8fad-e10e2c2aebc7", "comment": "Malware payload (Heodo)", "value": "259a0ce40d51d5634de56cf89cbe7e6cec6742840b88811178e7ce5fa634e4e4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654355, "uuid": "125f0be7-d098-43f6-9fc3-fe5498e8eeee", "comment": "Malware payload (Heodo)", "value": "d54c7f86cc577a3252f69a003dd51ffdc67738b6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654355, "uuid": "b9ad933e-c287-4174-bf15-0d129ca897d6", "comment": "Malware payload (Heodo)", "value": "783a6c4b36f6dd25186063bc920ebef3860936d1abab3d18a6e7314b80f8b9838144410620fa4cf7fa9cee40fa49e2e5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654355, "uuid": "b1816404-2814-4593-ac54-9294d1188964", "value": "T1D904023EE5031A98C12ED8FC58EE6DF9D5F634006258063A1BA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654355, "uuid": "d18ce69d-cd10-44e7-a11c-45b94ac2e80e", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654355, "uuid": "b38581ec-888a-482e-9027-5960df4f26a3", "value": "3072:VpjftLFs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VRhi1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654654355, "uuid": "f7d40fdb-4e43-453c-a937-cd1d73c71d67", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654654355, "uuid": "b26efb61-83d2-49ec-aa04-7db09da09370", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654355, "uuid": "30162cd2-8e42-419e-a882-310c185bfd83", "value": "f6d889127e9c6b1de20223d5bd9da3c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "619c8a8d-e764-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1654717886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717886, "uuid": "c1edeb31-c653-43bb-8879-3f3f465280d1", "comment": "Malware payload (SnakeKeylogger)", "value": "150163ccd42cc43bf66142782689ad99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717886, "uuid": "3fbd2482-a97e-45f4-b779-2970e396dc7c", "comment": "Malware payload (SnakeKeylogger)", "value": "25d7b231849bbd3b41e602e3dece8db13b7d34f1dc07bd5267c9fb6b90c6e940", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717886, "uuid": "ebcee89f-4788-4cb3-9c4f-1e2aab1c356f", "comment": "Malware payload (SnakeKeylogger)", "value": "7f4a4d1a7cbdb0c397e942e5b2d369659710d9d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717886, "uuid": "98351a23-2046-45df-9133-7223440559d8", "comment": "Malware payload (SnakeKeylogger)", "value": "4fef96f061c9778dab9aa1598bfa5f522bb885a23f3f9b6ded1b700c37109fbc685cc6ab05df985fd325f31cf1aa025e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717886, "uuid": "ea5a8b74-a2c2-4361-9a91-8b4d75cdcbbb", "value": "T13E14ACF36BD8C8EEDB586234F3421E1707516DEC68D6A23C1FDE7A29C530A6960F8560", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717886, "uuid": "0467cfbe-babd-4d0a-bdeb-5114162f742e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717886, "uuid": "5e0fe429-1572-4a46-9674-15d8c97b105c", "value": "768:oEB34blBhp6kELfJSCChd7ntnR+iEiiiM8n8nsoGGTdjt+++Gvx/bb2exNEzAlgE:3d4bllWSjwTOfhhGo8r2PYBU4cIt5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654717886, "uuid": "796cefc5-91df-402d-8eef-e43494977b24", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654717886, "uuid": "18ee2e32-ed74-453e-a55e-91b3a9197d8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717886, "uuid": "4b010f57-392e-4c98-8745-5d660cb4777c", "value": "BOOKING 60112.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef71e32d-e6f5-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654670450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654670450, "uuid": "fae1ae39-30db-431e-80d2-f96a9e599b80", "comment": "Malware payload (AgentTesla)", "value": "db49a3be144b8f5d7c3e54082b4838f9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654670450, "uuid": "51e18117-3ff1-4f8b-8f75-e621e4242640", "comment": "Malware payload (AgentTesla)", "value": "26179d1a09bd8ba828aa47a001dfc66df53a6ec1138eae15ae067b19db45b2cf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654670450, "uuid": "25714037-0fdb-4b74-ad03-9851d2356504", "comment": "Malware payload (AgentTesla)", "value": "02039a4edf125362fc0043714382193b2f59df26", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654670450, "uuid": "f3d3e801-7740-4d5f-87e1-f5b8f8f9c147", "comment": "Malware payload (AgentTesla)", "value": "36707b5d21a13de3492e8e13103c0443da3b7040d34af49f695f726a9571928279b8dc5242a57558b1458b9f546cf0c6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654670450, "uuid": "a6eff174-bbfe-4b45-a1c6-ee1b8ef97546", "value": "T18AE4125532EC07B2CA7D1FFD98A4100287758663692BE30E5F84B5DF4D27F928622B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654670450, "uuid": "7c22bb24-afc1-4f93-9e60-67466142f7a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654670450, "uuid": "09f92f7e-5281-413b-b26a-8385c94a3868", "value": "12288:em/UyzAmFJ8Vu5hJZh4EDkopK08O1km3esi9fhb4albo9q:uyzAnVuPeqkDYDIzpbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654670450, "uuid": "0a8f10e0-7759-4d41-ae59-b13aca64b04e", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654670450, "uuid": "6514a646-be17-4c8b-b58f-2b975d6f7aef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654670450, "uuid": "9e23b446-ef0e-433e-b535-3548e4b8ec9a", "value": "S012374022186508_20220607.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c4c866-e724-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654690584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654690584, "uuid": "3263924e-22a3-4f3b-975f-a5c833175647", "comment": "Malware payload (RedLineStealer)", "value": "b61ee3da5ae36b9bb812f408c10f940d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654690584, "uuid": "90b40ede-0021-4a7e-be4f-13605e25eba0", "comment": "Malware payload (RedLineStealer)", "value": "279678416f1f3d731fef40b751d44f8032bf3727aa3ed863a1f228b0f1b5864b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654690584, "uuid": "98d5d081-90aa-4679-88b4-f9ef91d2c457", "comment": "Malware payload (RedLineStealer)", "value": "3a41a8db838a8401833b967156154f2b8b9a489f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654690584, "uuid": "241f4c86-1b60-4fd4-9611-be59b6c40a0d", "comment": "Malware payload (RedLineStealer)", "value": "5b797f9390063022d0bf134f4fb68f06e13f3f702089b39b56cbc612e079077bb691ecf46d69ef8fb7d2b8e943967b64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654690584, "uuid": "8d15ed11-92e9-4248-bb72-cc36926009bb", "value": "T11B74BF1175C3C472C9B21A3108BDEEBA4B3EE81509245AFF57D426BF4F35382EA315A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654690584, "uuid": "13afe2c8-c215-490c-9434-9e9f5f5e2375", "value": "96ad624e75ba0adfca01a7145def67e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654690584, "uuid": "31d6bd03-7b73-416b-af9a-6b85be380edf", "value": "6144:pnshPJsde7xwx+3kAOVjdvDrOSgsLOlOLq5FwVbJxUZKf:p4PJsd11k4LSwV4ZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654690584, "uuid": "332325c7-4e18-42fb-8629-41fb861a1654", "value": 347080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654690584, "uuid": "8e80bd61-82fd-4fbc-8fcb-574c273ad2f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654690584, "uuid": "a1ffa909-7d78-4727-bc31-0b3037c4cb61", "value": "b61ee3da5ae36b9bb812f408c10f940d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb527691-e70c-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654680241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680241, "uuid": "abace9a1-ee87-4f69-9753-346ce36fc757", "comment": "Malware payload", "value": "c1d331c071937b4a0cecdbcf45fb69b1", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680241, "uuid": "f8099097-838a-43fe-aa11-8849c206f1f3", "comment": "Malware payload", "value": "27a62ea574cbcbfa15a8df8313bb68a4cae0871b12669f48dd0ff2073eddd422", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680241, "uuid": "9e5807bf-db38-43e7-98c4-4ab2c685f1d2", "comment": "Malware payload", "value": "a011c823281819a4b54d365548d04cf84cc1762e", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680241, "uuid": "b550de76-8aec-4a02-b48f-f0e624ee9268", "comment": "Malware payload", "value": "64c362df4357c11d01bd63cf4913e08155290a0bedbfe5e32000a5e3a0797b7034148c8624f68ba601193fc836986ea3", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680241, "uuid": "e1cb355b-d66c-4148-95f6-94cbfb509069", "value": "T18C368D92B6C9A53EC02B1A3A493B9758983FBB7129128C1B57F40D4CCF355413E3AE5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680241, "uuid": "01be5392-3a3e-481a-acc4-37a76b06f1e2", "value": "98304:eOYMv/nSJQqkmnsh5aq5H/6vPWDrkVeA:eOSJQu85nH/6ve/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654680241, "uuid": "5ed6a9ed-0b03-4526-8695-5aa3fd5606c8", "value": 5117952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654680241, "uuid": "149e606c-1a81-4d6b-b4f2-a1a395496012", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680241, "uuid": "96983759-0074-4cf5-b1f1-e931c5c9a973", "value": "NTFS.Iplace.AppleProdutosliberados05062022219140.MSI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d358cbaf-e6d4-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654656229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656229, "uuid": "29e4a48c-2e19-4860-a7bb-603d1020bc5b", "comment": "Malware payload (Heodo)", "value": "78cb5697ed5ce6989b342340768e74d4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656229, "uuid": "4bc085b9-524a-4221-b273-3762804c9373", "comment": "Malware payload (Heodo)", "value": "27ea6fcab753c291e27214b4a7fccdc5650afd1f3e664df54f8a38e1b1747c7a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656229, "uuid": "b5a674ba-20bb-42b3-be13-788f75cd1bca", "comment": "Malware payload (Heodo)", "value": "244fd15a95e50e6005f35fe2839b15c48fde9e71", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656229, "uuid": "abbeac1c-4785-48ec-b580-87c10bcc694c", "comment": "Malware payload (Heodo)", "value": "ff3f9b404027db13215ef89bd0c01d240c596e96f684937bc7b13b857bca8a23332e2fced3499ba836f6cbe6f0ba7ad7", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656229, "uuid": "71e3f7a2-717f-46c9-8d3f-156b0d69f35d", "value": "T13804023EE5031A98C22ED8FC58EE6DF9D5F634006268063A1BA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656229, "uuid": "9d68baae-5e6c-49f1-aaf1-f1af2ed9e918", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656229, "uuid": "ab496e70-cf3f-4b76-b770-d5f6bdb2a5f4", "value": "3072:VpjftlFs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VRbi1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654656229, "uuid": "645e4402-3e3f-4917-839e-e21b680ff642", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654656229, "uuid": "24ec9ab5-53d5-448d-af33-e1505551dd9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656229, "uuid": "862400e5-8180-4992-b394-bbcd6f076d22", "value": "27EA6FCAB753C291E27214B4A7FCCDC5650AFD1F3E664DF54F8A38E1B1747C7A.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b32bedbe-e705-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1654677220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677220, "uuid": "29541f04-fa34-4334-b08f-72a4baccc998", "comment": "Malware payload (SnakeKeylogger)", "value": "8435519edf9363ec906b34669254380f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677220, "uuid": "d2a0dea5-8716-45f1-815b-a631787563a9", "comment": "Malware payload (SnakeKeylogger)", "value": "283a41c54fedb86ff07031dc3bcec3afb02ffadc78bdf0f0ed6a812e706effa2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677220, "uuid": "c3e8784e-dc72-4fbe-8443-729ea4d8c3cb", "comment": "Malware payload (SnakeKeylogger)", "value": "eda95950571624d583770ec2a3cb745926f6dc92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677220, "uuid": "d222fa9a-f3c0-49f7-9362-009802411d0e", "comment": "Malware payload (SnakeKeylogger)", "value": "7a52e77bf1263c6b26e8a1635cf0855bddcf66ebe00947963c77492b35572f657e925bb7d2d9ebedee4c2ee1bb47471b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677220, "uuid": "c055e202-0035-456c-8df1-b2670d2516bd", "value": "T135F4AF802DD88ADED1E746F65C92F300323E794E97D69E4BBF53260498613D1867A38F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677220, "uuid": "ab4e1467-c8e5-4ce9-b764-2987b906f5a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677220, "uuid": "f89e452f-69e7-43b9-8433-4367d54ab3ba", "value": "12288:FoGB5AaL7rA9/OCg/noMrOVymu/pgYXkp0uYw1CCUm:FoGBuA7rOqQxyxBjoljCBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677220, "uuid": "80eb03e0-642c-40e2-a0b4-e7d4f7390f52", "value": 757760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677220, "uuid": "140aef02-dd38-4f39-9967-02c3f5f233da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677220, "uuid": "24be39d3-8cc7-449a-8fcb-0c0a4bf68cc5", "value": "IiM0A1aHAiSbAAx (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "638a1f68-e6f5-11ec-93bb-42010a9c0043", "comment": "Malware payload (Gozi)", "timestamp": 1654670215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654670215, "uuid": "ad24cbac-b9b1-4f02-897d-f2d7aa29aefd", "comment": "Malware payload (Gozi)", "value": "ec06b44da0f00666c66e808d0484876b", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654670215, "uuid": "3a7b66b9-d2ea-4398-b17e-09c09994c4e7", "comment": "Malware payload (Gozi)", "value": "28f4375d936d86a58499f30c79813b9d30d6ecc9c4c2ce7824ab203986eea8bd", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654670215, "uuid": "b8376c28-7641-49e5-8974-367359179e3a", "comment": "Malware payload (Gozi)", "value": "3a6625c20b7825ceb9539bcb04b26a3a68a14a34", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654670215, "uuid": "cab9dbd6-d6ae-4853-a12e-be2652ecb1f3", "comment": "Malware payload (Gozi)", "value": "b73e26f63ee10acb5c1b6b7e35660042062ac0f8622533e85c83db0dbff019a6273d83ec142e0778c0c2bc2a441f0f21", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654670215, "uuid": "fabb9dc5-61d9-48ae-bbdb-4326d25f763f", "value": "T110D2E116C563D4EAC6935E3C563806F9B199718A81ABEC0F1C51F7382BA12C357AC3DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654670215, "uuid": "b87cdb10-acfe-4051-87d0-032d39737fa8", "value": "384:Y5rEjBf2eM1einVYCy30oc+s7Yg1RMvqXUJ0RC0BcMrnHBxMKOj0aHIf:YVEujEiVY0oCbR+qVRC0BfwK8Hk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654670215, "uuid": "fa46186d-5b45-4e00-8a02-1af389e80340", "value": 30813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654670215, "uuid": "12cbd796-64d0-455c-88c0-3e371976d88b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654670215, "uuid": "967a8d4c-321c-4050-a423-3988569e9ff4", "value": "MIL0002049970.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c5cdf96-e6d7-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654657184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657184, "uuid": "7d60f9d6-2e4d-4583-b5b7-5879848d7c39", "comment": "Malware payload (Heodo)", "value": "cac9bf3d2315fdd28836dae92ed1af7a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657184, "uuid": "2f97fb88-7122-4110-bfed-35b332ac39cc", "comment": "Malware payload (Heodo)", "value": "292f72bd709c6e0e876314b592f5627d724068fe97b3af6538c69c375c323e3d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657184, "uuid": "b5209936-f605-4527-ab28-bb8fa8522245", "comment": "Malware payload (Heodo)", "value": "a89ef1781fb9b6fd11a804c41a076a4a92185059", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657184, "uuid": "eed4f3b9-e897-420d-98d1-cca70048e116", "comment": "Malware payload (Heodo)", "value": "78fd8c918917f4cf58c6121b3a0f6098d81940878b11ac37eaa30d052fc73ff80d4e3611b6260d0967c210745d9f8e88", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657184, "uuid": "93499106-a634-4b9d-952d-eb977d548a56", "value": "T18A04023EE5031A98C22ED8FC58EE6DF9D5F634006268063A1BA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657184, "uuid": "ac551b2b-4809-4351-ade5-05486a38c8bd", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657184, "uuid": "0e319837-7d5f-452d-9758-1aae3c4d73cc", "value": "3072:VpjftBFs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VR7i1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654657184, "uuid": "92fada5c-b86a-4742-a551-bdd09a6b6a36", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654657184, "uuid": "0757a67d-2c5c-4d5d-b21d-6a262863cefc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657184, "uuid": "4f95bb1d-34d1-4856-9b02-a22d97cfdd61", "value": "cac9bf3d2315fdd28836dae92ed1af7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb52d3f4-e6dc-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654659625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659625, "uuid": "35359757-13c4-45f6-81be-c1fccb02ff6b", "comment": "Malware payload", "value": "e619f1636622f960e9828ba663bf65b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659625, "uuid": "242613bf-7f47-4718-84bd-462ee2828c0e", "comment": "Malware payload", "value": "29961b55df26f6fd75ff86578301b26c729c60fbeefd24509b8dbbd1d14d5c7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659625, "uuid": "dede0c52-dca2-41d9-be47-4cff6313ebda", "comment": "Malware payload", "value": "72ad33327364ecd29e0c72e474060363207a0367", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659625, "uuid": "2a06da05-3e4c-4fcc-82cf-5210b97c4af1", "comment": "Malware payload", "value": "0e2f81590fb2256d6f1920961fbd31f73f1122f6b43c0fef551747b7cf239fef517a48c24cf36717d8033597d958f153", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654659625, "uuid": "0f0a0141-317c-4925-b2ae-41305b24ba47", "value": "T1BE913107A66888D3D80ACEFA5BEF8D9C5F750001152425760767CCCEC9F4B5AB01BB4D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654659625, "uuid": "29a5384e-6976-44af-998a-a6ab3c557c05", "value": "58d497d22fb5237cdbc2224c7e8dcbe7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654659625, "uuid": "e196da99-1039-4526-9dc6-eb97c6b52146", "value": "48:q7D0Wpy4cSmYThLZKde//JcSXaZnHHTKPv05fySgEf:Upy9i//uHZHWPMN3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654659625, "uuid": "6f08196c-78c1-45c2-a7fc-84deed265b07", "value": 4608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654659625, "uuid": "44619c59-20c1-4e44-be8f-80d86eb8a083", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654659625, "uuid": "b8aa31a6-082f-4c2b-9580-a0298c1deb79", "value": "SecuriteInfo.com.W32.Downloader-Sml-basedMaximu.2743.21821", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcba97a0-e6cb-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654652379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652379, "uuid": "38024699-afdf-4a1f-a500-292604d0d866", "comment": "Malware payload (Heodo)", "value": "0e31f6921037754980ce5cd639c28f10", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652379, "uuid": "c81b2912-72a7-49c2-a0c2-5bdb2e90cc4b", "comment": "Malware payload (Heodo)", "value": "29bf0f574f00d896718c00226d95f9fb17794f87db38a5b7e4f8e9c10630730c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652379, "uuid": "679fa9c1-8a18-4b78-a215-8d70c1dbf5b1", "comment": "Malware payload (Heodo)", "value": "cd1f9555c7c604e37ebc14b1b9644aa79dbafe88", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652379, "uuid": "0a8885dc-30d2-407f-8080-6a3cfe7e321f", "comment": "Malware payload (Heodo)", "value": "eb740b982615767029f2f6cf608e44e565700def683bff28904b67bd0689e53ca73cb4b6057724f971804a72b39b5ba6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652379, "uuid": "bce9b43c-8c3d-4718-9a2f-e60bf8da23d8", "value": "T1B004023EE5031A98C22ED8FC58EE6DF9D5F634006268063A1BA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652379, "uuid": "8f9a9ec6-aa61-46b3-b243-a53395af0dd2", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652379, "uuid": "c0b7a1f9-362d-400a-9e34-ff02702505de", "value": "3072:Vpjft0Fs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VRWi1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654652379, "uuid": "88b61567-3158-4bcf-8797-c7afc75959a7", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654652379, "uuid": "0e9d9e03-8a1f-461c-b8b4-94d4b68ab7f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652379, "uuid": "aa60e29f-7c8a-4474-be0e-a1849f926c91", "value": "0e31f6921037754980ce5cd639c28f10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6cdf40e-e6f0-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654668261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654668261, "uuid": "848d9831-02e6-4824-b3f9-fe48bfb78cb3", "comment": "Malware payload (AgentTesla)", "value": "565449e82e4ed028a92f91e3f8bdd9dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654668261, "uuid": "e055e6a7-4384-4f8e-9ab5-3b8aba07fb13", "comment": "Malware payload (AgentTesla)", "value": "2afbd7173a056a06cecc52797aa2aefc5dec3d3357bdd45b43c171be4dcbc8f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654668261, "uuid": "2801b08a-e401-4070-8187-1e359c2b2c0a", "comment": "Malware payload (AgentTesla)", "value": "dfee3804ab83da8a13921fdd89b44dcc63294c87", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654668261, "uuid": "d264f335-3908-4276-b68a-5ad067c2c4a7", "comment": "Malware payload (AgentTesla)", "value": "743835bd146ab8ae345fd14684287028cbc0cd64e8fd34ba0ced965f1c3becfbe81a7c33dd695d32cf491a0a6627fd6d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654668261, "uuid": "9a99e017-662e-4a0e-aadd-404e92946803", "value": "T12AA46B9C366C75DEC857C672CAA45C64EA6074BF771B9207A06309DEAD0CB97CF201B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654668261, "uuid": "27ea2909-1fa2-4ff5-9d21-4c8c6ad80c26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654668261, "uuid": "276ee3a1-d6e5-453c-bb12-f6f90cde7fc1", "value": "12288:1rW+jX8pSwnxf3G++GVPKM54ij9gQbLxnP1xo6j:RWFEof36G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654668261, "uuid": "a8f4db1b-79bd-4e60-8c4d-e7bb911cce14", "value": 477184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654668261, "uuid": "bab44a4d-6bf9-4815-959e-f3ddb08a59c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654668261, "uuid": "23ceb40d-76fb-4184-a10d-979bb8d0950f", "value": "Quote Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27b8bf61-e778-11ec-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1654726379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654726379, "uuid": "5f583d95-0371-40cb-8337-a11d4a409285", "comment": "Malware payload (AsyncRAT)", "value": "9162fca2d13beaa0806aba0006387fae", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654726379, "uuid": "c1cb10de-0ff5-4484-b9e8-b6097c671e5f", "comment": "Malware payload (AsyncRAT)", "value": "2b1d312ab2897c5508cb01be1252816ee15314ca3fa0b735d98ffb623779b73a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654726379, "uuid": "7e12501b-8dc4-4297-9165-d39249989f4a", "comment": "Malware payload (AsyncRAT)", "value": "1fc01a2bbd5e8c651d440b74d906cc42190c9dff", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654726379, "uuid": "9d5d89d3-8b16-4107-9ec2-3193196f8085", "comment": "Malware payload (AsyncRAT)", "value": "9a5e73fbef056d05d0f28c8f80575aab4054cd31dc4c3a50098610cd4280b9b4c1ca162b7db2b7799f0b1c0c8ea50e1d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654726379, "uuid": "00a99db3-df08-4472-93d6-5ab14d4a961b", "value": "T13E333A64B3DA6336C7DC00FA28B7E2805774C10F224AE74BEEC831977B567D662066D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654726379, "uuid": "729facf5-6189-4027-9284-9b6856dd51f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654726379, "uuid": "5afb2ae1-f303-41f8-b4c6-39f737152953", "value": "768:DvcR/pAUAfd33XwfsQe/etup+UabtVaA7IthhvQSHRAVc6KNzC/6ypmihC:D08pz/FabtVaAQGSHRAVclNml8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654726379, "uuid": "dd8452c9-92fa-4c39-9473-f78b408e7994", "value": 50896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654726379, "uuid": "67469028-7d69-43dc-8fb5-a7d6602e6e2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654726379, "uuid": "3bd1966f-aa69-4b8b-babd-5e01b0a5fca1", "value": "9162fca2d13beaa0806aba0006387fae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9936aa0-e705-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654677204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677204, "uuid": "95382928-c282-45c8-b11f-961bfc0f9e62", "comment": "Malware payload (Heodo)", "value": "0dae9fbaeee59987bd46ff90c469fc9d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677204, "uuid": "bccd03e3-70c4-4d48-95fa-b64826a21d8e", "comment": "Malware payload (Heodo)", "value": "2c2456f353f4d3aa01c9e3def4e22136c41765628ebce52d985be1072df0f8e9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677204, "uuid": "9a3b0792-fafa-4b29-bd38-617a05498016", "comment": "Malware payload (Heodo)", "value": "a8a7e2eb53dd9b52c1fda01650df9d0592996039", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677204, "uuid": "fffec9ba-30c5-492c-befc-79941d903944", "comment": "Malware payload (Heodo)", "value": "e181dede50949374ad63cfa953988dbef95071e06aef08086d6b95ba65d72e593bc1c8e25791a9e3fe0114c5e06e0fd3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677204, "uuid": "989e2470-c6b3-4542-8886-9c5927106f73", "value": "T16A44C089A7E1ADDBD51407798DD6D324333EF2814B8387076B2598390F23BA4BFC5A45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677204, "uuid": "d52799d7-d3e7-4ef0-9e70-42b240558087", "value": "963f2e88a5b03877d0583808b2526c1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677204, "uuid": "a279d78e-0183-42c8-be73-5c3bfa87393b", "value": "3072:7R7Xe82w+Oh+UjuFJrfr7CS/FmikytkqroMdjaWtHCqPZ4PEx2ES2vZg3f4L5ZJi:7lOJuk4uFxOmFwytLVxDtfPZ4PE2sPs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677204, "uuid": "0429ddef-7456-424c-8659-38a6ee53f21f", "value": 270403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677204, "uuid": "e79fed3e-f3cb-4718-9082-6b32c72a35bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677204, "uuid": "600cb61c-de75-49a8-8e47-91d5a75a4c91", "value": "0dae9fbaeee59987bd46ff90c469fc9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3597880a-e75d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654714805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714805, "uuid": "6145db22-849e-4c91-8172-f216e6c01739", "comment": "Malware payload (Mirai)", "value": "6a3e5c0636e5e6b2b523c7037d28904e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714805, "uuid": "012cafec-cf19-4f4f-b174-09a20bab3dd6", "comment": "Malware payload (Mirai)", "value": "2cb530ec35f0c381ccb03556d01f096d2bde22f64dfe00c81ce0aaf6302bd408", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714805, "uuid": "cf475de2-ddb7-47cc-a506-e4dfdcc07425", "comment": "Malware payload (Mirai)", "value": "acc76af347fbddd4795f2515e4c24adc2581694b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714805, "uuid": "a5048c2a-2331-44ac-9b4c-4d3f87ab0840", "comment": "Malware payload (Mirai)", "value": "cb94cfe6003943924d2f0df8798868b475c2b6f1b9f7c06e6e95c46652b624f2026fd9fac1197a16d97789211bef3449", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654714805, "uuid": "74e7166f-52ac-41de-b92e-fed4801b76a4", "value": "T1B9C209C6BA958A06D5C1D073FB0E86EE3B19678CF2DF334369163F10BA4746A0E27146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654714805, "uuid": "29c47160-97a9-4a7d-9d8a-aa3d15919ca4", "value": "384:6TYkHmkbPLA19pCpRgnxGTjyZsm9S7I44Ih71wlBCkXbxPvAsbxYK6Fl:6UEmOPc1+gngIhZ4400DXbxPvdxYKm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654714805, "uuid": "2eebe55e-ed5d-44a9-b7e1-fe00a77230a3", "value": 25948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654714805, "uuid": "a04a0c47-a0d5-46a9-8ff2-f771075be7c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654714805, "uuid": "749329bd-7868-4873-a0db-c3f67acd31c7", "value": "Boota.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6fc9c36-e70b-11ec-93bb-42010a9c0043", "comment": "Malware payload (NetWire)", "timestamp": 1654679804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679804, "uuid": "d5be109a-804d-49f2-99dc-358c0024db4a", "comment": "Malware payload (NetWire)", "value": "e06c869808e471cb079465e8209fd3fb", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679804, "uuid": "633e70b8-c360-497c-b478-3ded7453d09c", "comment": "Malware payload (NetWire)", "value": "2d237e43a52c24d4099491cb71ecd0c8941a94d5484bf3f4bdb16e495b7bb52e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679804, "uuid": "24e73185-466f-4b1f-a346-812ff86808d8", "comment": "Malware payload (NetWire)", "value": "1da52093905fba6a261730a2bd714d1357a35d08", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679804, "uuid": "8180df3d-c48c-404c-8045-a4e0d4598e6c", "comment": "Malware payload (NetWire)", "value": "acf50cb1a11735540e33252d81980ddaae7d011a5a7f113bd14ae6f5ee2ddafee636d15685903308218c2ec7fbaa318a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679804, "uuid": "5deb8a30-8e80-4589-b9aa-0dbbb6a01aa4", "value": "T1E934EDA0685F49B2E708DD1E25A4F6506EBAFEEB30C1147123AFE470CF55AF29EC8550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679804, "uuid": "a49d0a75-ce9f-4c4b-b663-4a09030984e0", "value": "1536:ieDDA2dfG7NP0UlAaSBodoHZa9BXbLZdzFz76mAg5eeVhMDw5wfLc:iD09ydzFtr5RDAw5wfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654679804, "uuid": "63549555-fe89-48d5-b8f8-da8170a0c7b1", "value": 241484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654679804, "uuid": "49e86fcc-4cd6-4c88-9b48-f622db51e81c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679804, "uuid": "83161c18-dada-46b5-a5e4-15250b594b5e", "value": "Proof of Payment.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80289b5b-e6fb-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654672840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672840, "uuid": "61e81f23-0af4-4a86-8f86-41c34e23c70b", "comment": "Malware payload", "value": "681dec001b347201ccecdc5a6429927d", "object_relation": "md5", "Tag": [ { "name": "2022-29464", "colour": "#352DE3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672840, "uuid": "ddeaed78-5587-43d4-ba97-fb3ea77c0914", "comment": "Malware payload", "value": "2e377087d0d2cb90b631ab0543f60d3d5d56db8af858cf625e7a9a26c8726585", "object_relation": "sha256", "Tag": [ { "name": "2022-29464", "colour": "#352DE3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672840, "uuid": "169b32d9-616a-4b24-9021-1e581cf236bd", "comment": "Malware payload", "value": "e84c7038dd92492e48b70ddbb26c12a9d77fd7bc", "object_relation": "sha1", "Tag": [ { "name": "2022-29464", "colour": "#352DE3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672840, "uuid": "60ba1c7e-339e-4dfe-b02c-1bb7e16fd87a", "comment": "Malware payload", "value": "9386a5a065738f77ad5d5666a952c3162743dec21015bb6b170917298ca223106b973cb656f4cac50a8c4dad98194321", "object_relation": "sha3-384", "Tag": [ { "name": "2022-29464", "colour": "#352DE3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672840, "uuid": "784d3812-06f7-4255-b95a-361d93e7713e", "value": "T122B6333FE0032FBBF3EBDB336B7189B9B6E540558521493E9400E734165AEB0E952939", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672840, "uuid": "1eb8bb16-841d-458d-84fc-32edd974b2b0", "value": "196608:XVeacQyAVmTTrJm4R6y4toiyTq0GjA62O2QRcVC/yGIlaX:XVYAOTNtROs2Xm/WcVC/xIla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654672840, "uuid": "cc43a022-0737-4ee9-9ffb-5d4a47eb5c73", "value": 10494704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654672840, "uuid": "c6ed25cf-a993-4c15-bda6-011d9adcf06f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672840, "uuid": "64c1f214-656c-4043-83da-69528d6eb734", "value": "2e377087d0d2cb90b631ab0543f60d3d5d56db8af858cf625e7a9a26c8726585", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "374a8f8b-e6e5-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654663269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654663269, "uuid": "be6b516e-356c-47fb-9dd6-360624119257", "comment": "Malware payload", "value": "a046337a7d2db8e33cd24864a722fea1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654663269, "uuid": "76bcb224-b6a7-4f6b-87a3-a04bac3b2346", "comment": "Malware payload", "value": "2f5eee96973999ed682afc18e031215916e182993de7210fa66db5f7d9854955", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654663269, "uuid": "1313983e-0fc6-4d49-8458-6bfe9e6bac2d", "comment": "Malware payload", "value": "9adf5d4dee5fb9c6d99a9ef16ddf349ccbbed7d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654663269, "uuid": "11f177fa-705e-47b3-8ae9-78b20d8b0d30", "comment": "Malware payload", "value": "ffc5f13d1e9ad1768c67a3246cceb23ebeeea3ded4fdc3734ba4dac3ee9f4370a56361841fe36e9da60dcc367857ecb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654663269, "uuid": "89d77a1e-0fc7-472e-80e1-9af4fc791dd1", "value": "T1E69120066AB448D3E90ECEFA1BAF4D9C5E750002552425760767CCCEC9F4B4AB01BB4D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654663269, "uuid": "62f93734-90a3-4c83-9b6b-eecd4c65f58c", "value": "58d497d22fb5237cdbc2224c7e8dcbe7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654663269, "uuid": "314b3542-9023-4da6-83fd-d88afca6fb48", "value": "48:q5Ls4yYcScYThLZKde//JcSXaZnHHTKPv05fySgEf:sydU//uHZHWPMN3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654663269, "uuid": "35e80ec3-2069-46cd-8d93-3029b56e6c3b", "value": 4608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654663269, "uuid": "8729e3d1-c985-406e-ba58-84905059d6e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654663269, "uuid": "5ae8f437-ee48-46fc-a4d7-bbc5a828c01d", "value": "SecuriteInfo.com.W32.Downloader-Sml-basedMaximu.31361.15733", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb93211-e729-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654692567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692567, "uuid": "8aa0ea45-1c5c-46b6-b303-6c1a040abffe", "comment": "Malware payload (AgentTesla)", "value": "024cfc511d1ec2e384486ce88440efcc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692567, "uuid": "d25b588c-10a3-4f3d-9398-63372bfab176", "comment": "Malware payload (AgentTesla)", "value": "3039ad46362f9218f4f600b50e3e7ad644e4b6fbf7309020c25fd2e1038eced9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692567, "uuid": "9cbe0bab-5373-4e3f-8c5f-f8b1addb10f7", "comment": "Malware payload (AgentTesla)", "value": "99b64f7de3c76b1ad8d119799fc7143ddf45fa2c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692567, "uuid": "b6823933-3921-4bfc-a0cb-4b8dd426d8e2", "comment": "Malware payload (AgentTesla)", "value": "167e16c6ad5055370ce900199f26e99c767895f89a35092aa42d6c2db3177e2a623567dfbc84ab32ce5f542ba4967486", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692567, "uuid": "3429a469-e458-45e6-8ada-746fbad8c51f", "value": "T15675CE15B310E74BC22AF33B5958F77512A60FD7BA12E7909578B6E338933818F616C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692567, "uuid": "c66c4855-a711-4d1a-9a2f-25090380ad07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692567, "uuid": "2f5d31b5-4183-4358-90e7-087f71e92c72", "value": "24576:EgzsGA7MLdzqmn7td18SvG+5UjpJ+Ie5fq+z5fq+sOT75fq+W5fq+tJX5fq+z0sY:1g0dPN82GFtwTrOEIZJVXG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654692567, "uuid": "b608de0d-2f3d-4e9a-bc8f-231258ad5cfb", "value": 1605120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654692567, "uuid": "bbbbeb6d-01c4-4975-b3fc-a8269f37ea3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692567, "uuid": "54661b48-1884-4a51-aa5d-c7a090ed5688", "value": "SecuriteInfo.com.Trojan.PackedNET.1372.5430.29807", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3198953b-e6ca-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654651663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654651663, "uuid": "768f509a-2be4-4338-9e19-1df52a302a24", "comment": "Malware payload (Heodo)", "value": "882146820cb47d0a7400aaf2f8a512d5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654651663, "uuid": "484d74e6-b51f-4db3-99fd-f1b58ca80b4f", "comment": "Malware payload (Heodo)", "value": "30db0242e740da9f54d92ace6115bd6d367e24f514430137e12e6ea94bffb5d0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654651663, "uuid": "0c3fe8f0-eb18-4908-8d8d-b03fcbc9f245", "comment": "Malware payload (Heodo)", "value": "b38497b256777e3221b58053e8df8d356f16436f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654651663, "uuid": "4cf8784a-2310-4662-8315-92013a0ffe4b", "comment": "Malware payload (Heodo)", "value": "3b99ec621131c50f8a7d5038e828674330dbf6bd01cd3a41b2dc6ecdef6e5a74de373836880b1824f2900e0d930aced0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654651663, "uuid": "b12c3bbf-15a0-45cb-b7b7-eaacc5a09cd9", "value": "T1FD04023EE5031A98C22ED8FC58EE6DF9D5F634006268063A1BA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654651663, "uuid": "d7d62c11-ac5a-418a-b964-0f20c0c160c7", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654651663, "uuid": "66ec82b9-6981-451d-aded-ef83a3e1f54e", "value": "3072:Vpjft8Fs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VRai1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654651663, "uuid": "2b49140d-f987-40d0-9a47-6dd4d21162f9", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654651663, "uuid": "c37d2c80-af14-4f83-bec7-e15f0ff60c6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654651663, "uuid": "0b0ed028-f948-4468-86e8-90f5a9818d8e", "value": "882146820cb47d0a7400aaf2f8a512d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29e7e4c3-e740-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654702330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702330, "uuid": "6e202d31-b5e5-4250-8417-92e0b7e0be57", "comment": "Malware payload (Heodo)", "value": "d328729be3f4d134de54ebaa3752e157", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702330, "uuid": "75d07611-2a3b-478e-8b0e-e0f6a982765d", "comment": "Malware payload (Heodo)", "value": "30f9d040a73df0f937a088de32e12b91ec4a1af8c053d19eff2722993e3aa06d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702330, "uuid": "ba3170dc-302d-486b-9f97-9534c02fa0be", "comment": "Malware payload (Heodo)", "value": "81de9758e40dc957fecc74b6615ec52d477eec85", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702330, "uuid": "6177df51-6fc9-4d34-98ce-6d7ea897f230", "comment": "Malware payload (Heodo)", "value": "6ca51bb266ac1980e2fb3c1f7d6057cb24ee7b990e61def9445cb55f54dbe647bf74eac40216c88455775a6e33c83e66", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702330, "uuid": "84f75a5b-ae36-49c3-a340-dc9b325b537e", "value": "T19D23A546BB5AC85DF914873448E747EA7323EC314F6B0B433669B3256FF89A05A0325B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702330, "uuid": "e8bfbc1c-613f-4f4f-90bb-9274026f77c4", "value": "768:hDMPKpb8rGYrMPe3q7Q0XV5xtezE8vpI8UM+VmQs7iqj/X20eu28:hYKpb8rGYrMPe3q7Q0XV5xtezE8vG8Uw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654702330, "uuid": "06ebbb2a-a032-4d3b-b705-3cb0492ef884", "value": 47634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654702330, "uuid": "5f1f8656-0260-4ed3-a6ee-b3f5ff95b307", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702330, "uuid": "5fde39f3-fa0b-4a50-ae79-0fadb8653552", "value": "Dokumente.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f55ca3-e77d-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654728525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728525, "uuid": "815b2ae4-3047-44b4-8f9a-787c59b52538", "comment": "Malware payload", "value": "d18d0d998d5ff18ae36434375d57e696", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728525, "uuid": "51e27206-35d0-4c21-80f1-8637a9ae63fc", "comment": "Malware payload", "value": "31a47a59019f3a334cc76f9d6ddec956714430a32dc9fcea701d2685462dd78c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728525, "uuid": "04d55e78-cd9c-4ede-8767-13b7af7b0060", "comment": "Malware payload", "value": "3c44ff200b23d6ca4302b2297b47e9529f577770", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728525, "uuid": "c8fc654f-08e2-489e-8184-9c527077efa1", "comment": "Malware payload", "value": "2c8ebca02671c8c7b7d17c5a5d6e46dbbd76c3e824f45585a271c6e7cbbcec88ac525faaaf208b89ee47bda33f46bf06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654728525, "uuid": "b4b7b226-f2d7-4e44-8132-5210f5250385", "value": "T13B051947E77345FCC96BC97482A6A732B930785841397E2E4F80DB226F65F20953EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654728525, "uuid": "2807e38e-5f12-4c4e-9cbb-9c26efe08673", "value": "733e4ccf9ef47c6e471d93270b5eb898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654728525, "uuid": "2b550938-5eb9-4045-988a-4826feb18841", "value": "6144:v7rc6Wk6SYnaKOai5uWLwrd0jSjc0vNPqBVzLFWFWUPV2m7hzS7583Tg7A+++ncE:vXcFk6SYna2Frd0jSjcc9SPmBZX0TMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654728525, "uuid": "5ada2618-27a1-451b-b9f4-9eb715620a69", "value": 841728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654728525, "uuid": "9c805a22-e975-45a7-8982-b526b3b40df3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654728525, "uuid": "eb74347c-c878-4252-81f3-9a141d6f5ec9", "value": "d18d0d998d5ff18ae36434375d57e696", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70bdf9b1-e6ec-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654666371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654666371, "uuid": "7dbe1661-18d5-48a1-b8c0-43e11c6d2ee5", "comment": "Malware payload (AgentTesla)", "value": "a085674bea6b4dda16cf9a8e45759d61", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654666371, "uuid": "69f5b4a8-7abc-4be3-a421-51bfae558e0d", "comment": "Malware payload (AgentTesla)", "value": "32252e51624f449f015636763feb4a6eaaea3f7ba436a217d9d1aae348529de7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654666371, "uuid": "5f791b50-cb9a-405d-8a4c-3110cb36864c", "comment": "Malware payload (AgentTesla)", "value": "291fd985fda8df18e6b4da2591cd2ab039e45318", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654666371, "uuid": "0071a594-c45d-4ca1-9361-cee94072b9a2", "comment": "Malware payload (AgentTesla)", "value": "50063a1a8b6fb446cdd15e3fc3abd09f9c2b1471b92bba0df8cb174f9adb9007ab891af19344422b28b9297a58088be9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654666371, "uuid": "19640d15-019c-4527-b2e2-f81a61ff5eca", "value": "T147E4122936ED0722DABD0FFE9874018087B0B627352BF31E8A8535DF1A767828975717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654666371, "uuid": "12186141-7742-4777-a3bf-faadcc68014b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654666371, "uuid": "309d6498-21c0-4876-bb42-94ec4bc4593e", "value": "12288:kvDzF7ZJcFnnyusTPZo5YnYrlHfOZh4yx7XpZfVcRcjbo9q:cJAybPOQYrh2ZDx7TfVcRubo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654666371, "uuid": "247f346c-cd1a-4bbc-8369-fd402ebe34db", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654666371, "uuid": "02425a0d-a2b8-4ba0-b934-806ffafba171", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654666371, "uuid": "2f419773-0aae-45cb-9667-5dcca05bca90", "value": "SecuriteInfo.com.W32.AIDetectNet.01.21463.13268", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a179f9-e740-11ec-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1654702407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702407, "uuid": "47d6a34f-195a-45ea-8f19-14409e4587f9", "comment": "Malware payload (SilentBuilder)", "value": "7b0861c5de55235e8e4efecde68f23ba", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702407, "uuid": "87979d89-511f-4497-8fb4-ae0c1ac27804", "comment": "Malware payload (SilentBuilder)", "value": "329c1c3b1d799550a827941cec64efe4e8d09e991faf76796da13917cc7a36d8", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702407, "uuid": "2f8cabee-8e02-48eb-a647-26bebc8fcf1f", "comment": "Malware payload (SilentBuilder)", "value": "0daf3854343b073eed91107621cd5a5e8811681e", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702407, "uuid": "eb58e0e3-631e-4e88-9171-0b609ad0813e", "comment": "Malware payload (SilentBuilder)", "value": "62afcc99bb4e6c3460e46bfeb7f924eb40de87c6604fb21e16461f8dd896c34100213c6a9d270da7f63ecddc5b8f54a0", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702407, "uuid": "d4087e7c-fd67-40e5-b37e-da513912ca0d", "value": "T1F323A446BB5AC85DF914873448E747EA7323EC314F6B0B433669B3256FF88A05A0325B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702407, "uuid": "886f686d-5045-482f-8a5c-f09b00971604", "value": "768:hDMPKpb8rGYrMPe3q7Q0XV5xtezE8vpI8UM+VmQs7iqj/X20eu2R:hYKpb8rGYrMPe3q7Q0XV5xtezE8vG8Ud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654702407, "uuid": "eb92a69a-3cce-4fc6-b670-0e8ee1ff07d9", "value": 47634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654702407, "uuid": "bfbbc0df-2e39-4c99-ab25-500685fbf9b2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702407, "uuid": "e7a4ab04-5e80-48fd-a13a-4de0a1a565ac", "value": "Fakturierung.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "721701ed-e722-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654689567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689567, "uuid": "77c721b3-b0e5-4cec-80fb-0b26fa6da0e8", "comment": "Malware payload", "value": "38dc401495e1f2d1e187f40a08dabed8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689567, "uuid": "72e75cd4-b04f-44a7-ac93-05702d7dd8b2", "comment": "Malware payload", "value": "336ee653c2fb9df7fa7b1c59b81e35bae42df07c0d8ee120367d9c23dcaf078d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689567, "uuid": "732c0574-2a32-470e-a1ae-d97e4553cd78", "comment": "Malware payload", "value": "415bb9eee8cdcc4408145948a2337acc351c520b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689567, "uuid": "a40805cb-5ea0-4b82-bf41-dcb313545d99", "comment": "Malware payload", "value": "9d5c021b47065aff8e9eb7e1f121d368341ea9793cfc44ffd8241a17d94014db86c66e0b345663e8c50fa744aaf8710a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689567, "uuid": "303f6226-74f9-441a-9ae0-858d879b5795", "value": "T1CA817503D9A848E3D80ECFF916AF0A8D5EB80402117AE8725E6BCCC8C2B874571163DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689567, "uuid": "93a6ae02-88ea-43b5-8eed-89ec18ff8f9e", "value": "5f8a1f2347e2d70603d8e0bbe442cf34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689567, "uuid": "8f1eb26a-5044-4963-844d-f03ae86443a2", "value": "48:SoWQvGifnLK5olOAehypweotY5ol7TzHpc8lzLelgt3YfKV67jIWM:kQhK5oYtY5o5vGSvelWoSQvr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654689567, "uuid": "a2460b12-21aa-4659-8585-39f7b16adc1b", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654689567, "uuid": "efa72dcc-2ff8-4261-80e0-40294037a377", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689567, "uuid": "117d1c92-5a8f-48f8-9172-2091cde7a1a0", "value": "SecuriteInfo.com.W32.AIDetect.malware2.15044.19479", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2305f96-e70c-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654680198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680198, "uuid": "15f6ea7b-f60f-4068-ad8d-1ebf8029caf6", "comment": "Malware payload", "value": "9e9848a4bb694d819bdc6da8071daad5", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680198, "uuid": "b5e4bc52-fa6e-4816-8745-57349535f229", "comment": "Malware payload", "value": "33926092f74b9d2b0f80ece958c969783c6a0c4bd6924fa9435e45852aabc42b", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680198, "uuid": "648c2a57-e655-4979-96b5-7b22f365b561", "comment": "Malware payload", "value": "7b65189512ac312a4530098f235c510e822f99ef", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680198, "uuid": "0cff238d-93a5-4acb-87f4-22c912615c10", "comment": "Malware payload", "value": "e8cae214f869915f5133c3c3176163a98b298a7384a6f2569ed99007695f8ab821479f19109e76fdb468f536207683bd", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680198, "uuid": "cc4c9119-94f3-4999-b72e-875b62a156dd", "value": "T12F167D13B284653EC56B1E3A493B9658993F7B703A2ACC5B57F4094C8F3A5403B3E687", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680198, "uuid": "08ba7b16-2560-45c7-979b-73153d357c67", "value": "98304:ZOYrcV1xOuSSFuFTLPCSFyThILq7P8fKA:ZRczxOuSDTLtFShILq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654680198, "uuid": "8806605f-53eb-45fb-a48f-25feac646ec4", "value": 4229632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654680198, "uuid": "c4750e61-117e-4d23-a598-055581c44852", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680198, "uuid": "596ee6ec-7ded-4629-b90e-2829bfe13eac", "value": "AdjuntoCarrefour-Archivo.Fact050640.MSI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af89042-e736-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1654698091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654698091, "uuid": "e0023b75-5013-4e8f-8c0a-224b49a1c19b", "comment": "Malware payload (Loki)", "value": "b038ec663bf275972572b3de16baf114", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654698091, "uuid": "15fd5727-f746-4d85-b860-2a3d8feda60d", "comment": "Malware payload (Loki)", "value": "33a7a8caf94cce1c24fdd52abe6c8d7708d7d937811ba936495c6f103e2457f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654698091, "uuid": "75fcbd2b-7215-4fae-825c-7b1c84103eb6", "comment": "Malware payload (Loki)", "value": "60d5417e89d9b1f1e70074bdeb1bc7a20dfc17c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654698091, "uuid": "cef6ebe8-17d8-46c4-b7f4-a1bb9c4501df", "comment": "Malware payload (Loki)", "value": "330ed27543296fff10cbf4977c4e972fe967fad6726b205c3e2d79d7a84e69229ff4c6a71071e18b9d1dfedfbaa298d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654698091, "uuid": "67307700-dcfe-41be-83a3-90c44494fa7e", "value": "T195C4F1F19EF879A4E21961727460A03C77E39D0DCC65A93AC68BF55F34A2AC250F1D07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654698091, "uuid": "fc37e596-c7e8-4a7e-9b4f-f66f4688f7f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654698091, "uuid": "8bf0ac0e-c940-4bd0-a262-27ba0141d018", "value": "12288:QNkQ2iN/I9qle+J3eSaE+SOdXfOXwoBaE/9k0EQqKgr:y1pIT1SD+SOdvOXFj/9k0sKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654698091, "uuid": "8b2d8080-3e0c-43d5-b913-f8fce8d8a14b", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654698091, "uuid": "4be2348f-b279-45cc-a480-8ab92c209916", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654698091, "uuid": "09c75ad5-cd5c-42f1-9083-9f66dc70aa11", "value": "Purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72d7a526-e750-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654709325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709325, "uuid": "e4c4ad64-a564-4810-b66b-91543ae5e692", "comment": "Malware payload (Mirai)", "value": "f040d142af9ffc67504b716c217c2b04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709325, "uuid": "1d8e076a-bce8-424d-b42e-c7c20ce7483a", "comment": "Malware payload (Mirai)", "value": "3541054358d2212aced943e0818572283b428fd240160be272ebdb10c032a17b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709325, "uuid": "8c5182b5-a167-4f90-a72d-2df11c9f8428", "comment": "Malware payload (Mirai)", "value": "7a9b5caf8449925ebb71d2b62f4a724d4fed896d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709325, "uuid": "df7f820a-0b77-4db2-a90d-f6706f61863e", "comment": "Malware payload (Mirai)", "value": "5955054180add0663663eed951bef2f257d651215306839e38578b4fc11329b80be8b7b02027b595fdb95b4834a612e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709325, "uuid": "a58c5b63-dbe8-4230-887e-762a4abbb228", "value": "T1A8635BD5B401AE7CFA5FEABE84214A0DF531B74051A30F3BA7A7FC936C721A49816D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709325, "uuid": "7c30f9ea-c176-4464-9213-f98cde13f61c", "value": "1536:8i0W0YSxyvvEZve6FwrYWNUuVMFyyQR3gggTqC8Ask:SxyvvEBeCLW2uaUPfg2nk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654709325, "uuid": "b7dc27bb-a7e6-43e0-a57b-0da3a9c5936b", "value": 67592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654709325, "uuid": "4ab5037f-f8a3-488a-913c-d959c299cd9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709325, "uuid": "b4f716da-be77-4e2e-8fa7-885a2662e7e1", "value": "f040d142af9ffc67504b716c217c2b04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9694616-e6db-11ec-93bb-42010a9c0043", "comment": "Malware payload (CobaltStrike)", "timestamp": 1654659299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659299, "uuid": "79096002-f474-499a-a032-fa08b0cd14e1", "comment": "Malware payload (CobaltStrike)", "value": "23da2d9e1d51b4a4cf8e9a4179e4b4e3", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659299, "uuid": "096a9e13-d429-4215-b1a1-79600ba5ed5d", "comment": "Malware payload (CobaltStrike)", "value": "356ed801fd17886006472a332bba1126976a4a14dbf378d59a01904fcea64b18", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659299, "uuid": "adf60da5-a725-48e1-930f-a5177f477aa9", "comment": "Malware payload (CobaltStrike)", "value": "1bd4300605a2e7c1db005220b9c1e3f1f1b71206", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659299, "uuid": "4a679beb-a3d1-44ea-8818-272a02747acc", "comment": "Malware payload (CobaltStrike)", "value": "a1d7c84c0f39f3290675ce57e90abee3ce9adf86fd08a132170a92d722069a0de76be65ff4081c37aba88eefaaac2ff9", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654659299, "uuid": "26ddf1fb-8f15-4495-af1e-9f2b88f9329a", "value": "T1C6553A0BB8D094BAD1AA923189A692D1BB31BC890F3113D33B51B7F92F767D45E35318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654659299, "uuid": "ec076331-b53d-4dd9-bfbd-3b14cbd52aa4", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654659299, "uuid": "5876bcae-634e-43d8-9a81-ed43fdafd1db", "value": "12288:2M8XzFMVd0Oe8k+MFc0T2vPz5tqKxIfKfWbgSEmWo1wo93tBQrJTlh1:civ0Oe8IaVtFfWbgSEmWi3tBwTD1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654659299, "uuid": "74361b9e-0ebc-4a17-9af8-6adf8aa891ef", "value": 1291264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654659299, "uuid": "51ea43e0-877d-4a51-ac1e-c93b445855fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654659299, "uuid": "8d12f282-d5a8-4354-a056-42f67d37fb91", "value": "356ed801fd17886006472a332bba1126976a4a14dbf378d59a01904fcea64b18.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb8542e0-e73c-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1654700857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700857, "uuid": "f228ac52-b272-4b1d-b900-b64665c01ef5", "comment": "Malware payload (RemcosRAT)", "value": "417f38c110291001fe1e57efa04d7a8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700857, "uuid": "05d8e5a1-7a72-4a7f-bebf-f5dec7f5a01d", "comment": "Malware payload (RemcosRAT)", "value": "356f4be2b2aa2369ad04046e1000166fe7abee45a95b6bb523855a69669e5b7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700857, "uuid": "0bb9daa7-5cda-46dc-988b-94fcea13043b", "comment": "Malware payload (RemcosRAT)", "value": "b3e593c4d3918fa9ba69da0ed467ff502a6a2531", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700857, "uuid": "32c943d1-1603-4152-8f0d-b4df30a592ab", "comment": "Malware payload (RemcosRAT)", "value": "8531bdaed07956ee8a465aac8ac5e7513b0258dd8e7ed94aa3c6f3fdbe4d197f2f68a2092d882de2bf1724df521e89c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700857, "uuid": "e8c0b225-dff2-4c93-90e7-a6dd3ec54bbc", "value": "T1CF8523D53F7CD922E5916CB4FB50D68634B0E613267DFEE7A6604E6C10E82A3681D0E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700857, "uuid": "b43eea86-0a08-4391-8458-711a91740a31", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700857, "uuid": "ceaab210-8417-4fd2-8613-81cacf62a079", "value": "49152:PeOCcd8/dkMG/OqCSpaXOF6vBtbhHslKcD:Pe1+8/+MG/xCeL6Ztbu3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654700857, "uuid": "99873a47-bcdc-49d1-89ed-4e4306c5f480", "value": 1790654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654700857, "uuid": "b0aeb17a-0c9f-4d65-87c4-c3bd82fbda7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700857, "uuid": "1abaac19-a16a-46aa-bbd9-bbd42a2b0080", "value": "RFQSample page&DICHIARAZIONI ART 80-DGUE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8df53736-e6fd-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654673722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673722, "uuid": "4372351c-ee51-47bd-a2ba-938f33b3fe25", "comment": "Malware payload (AgentTesla)", "value": "e9f314c9c302326cf9bc92c2e9e32c5a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673722, "uuid": "c7ae7bfb-4c18-4c76-965b-7ca959396f40", "comment": "Malware payload (AgentTesla)", "value": "357887b6c6951fd0987ebe46bfec1c0fd9af4bd611cc19850383cf4602a4f6d1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673722, "uuid": "8389b90f-8436-4eaa-9ea7-a5e7a1a81cf8", "comment": "Malware payload (AgentTesla)", "value": "6e9c432b8379fa346e48ea9c9692dd029724b959", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673722, "uuid": "c5cc512d-a2cb-4cdd-a9fa-52fedb106e76", "comment": "Malware payload (AgentTesla)", "value": "01e26408ac7048ac7634a5610cfae74ec9ea59f7e227d6eafb3398e8234dcfb84f789c3ea59b31678d3231ac6bb8943e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673722, "uuid": "d70b6108-1490-498c-aa56-9b38a3d0a499", "value": "T1679423EA8E232011B60A0B7E7813C95CD5959EFECF141E87844435BBBE658F98473C2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673722, "uuid": "11c38bcc-159e-486d-807c-a4cdf206377f", "value": "6144:rvtRj0eYMP4uwzp5HNJhH56Qso6DE9QTSRdyT/v4aVpg2Mfz7aAJUbt:rFKeYMQukJ5Ls9YQ+RdQfgjGAJat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654673722, "uuid": "523e0a79-f224-4aac-9908-07b240dbda47", "value": 414437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654673722, "uuid": "40b7be96-da89-4185-a9d9-f081be0aa9a5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673722, "uuid": "afb91be7-6001-48a5-b4ea-2f9d9f7a2268", "value": "OUTSTANDING PAYMENT.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82558a40-e6cd-11ec-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1654653087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654653087, "uuid": "7a26c218-58ae-4270-a552-f890f9a73db2", "comment": "Malware payload (NanoCore)", "value": "9da1991c6b5d73a98eb1e9622613c614", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654653087, "uuid": "285bb213-ef8a-4ddc-9b4f-17f629194e79", "comment": "Malware payload (NanoCore)", "value": "36ccab7aced638753e2ccf38501d8a5a8995a30e3b2ac323b6198a44b881159e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654653087, "uuid": "b0386209-c62e-4f2b-8f66-daa7ea702557", "comment": "Malware payload (NanoCore)", "value": "3daab237b42e869469e09cf773d17070d624e392", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654653087, "uuid": "a3b1e3ff-0c2c-477d-94b0-2f5d2166447b", "comment": "Malware payload (NanoCore)", "value": "ee08a188f67aa8bbb2ee34703a79a31e1157fcf0484915aa1941c75926688a7d67e99fdb8bd04fc47a43ea64d01aa65c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654653087, "uuid": "9281d223-105c-434b-a029-140a144ee1a6", "value": "T11ED4FA1D26060B62EC5D9071F8C10A47AFE20FD32642B9C25B9ABDC6D77BD99DFC1884", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654653087, "uuid": "e5fd84b8-6386-4058-8c09-bca9e21ce490", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654653087, "uuid": "d812e90d-2d25-4789-8ff3-20022046fb68", "value": "6144:bYtp15Fk0G4UO+QUVvhgNZP9KmHEQTUQKvVAGZtuTq43/QBRmwEBOP3ge:MtS4KQUdhgNBomHyQALbm/QiOPwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654653087, "uuid": "8ebcb893-de51-49e8-90dc-07e989aa316f", "value": 632320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654653087, "uuid": "a7faefb8-c165-42a5-9a67-398298d7080c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654653087, "uuid": "e7aac141-6205-4317-9575-4ff759aa407c", "value": "Form CS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ad0d013-e705-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654677072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677072, "uuid": "0270ca74-0619-47f9-a147-d1c6b384cbbb", "comment": "Malware payload (Heodo)", "value": "548cfd4c19e873fb3ba34102b11e1e5c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677072, "uuid": "05a941c8-a447-47cf-a48b-5158126acfb4", "comment": "Malware payload (Heodo)", "value": "370e1b61e996b1533d8a9a1e2b6c64b0260eb3a86714c989fbe8c29d14eac4f8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677072, "uuid": "e5e2b21e-4104-40ed-8d59-1966ec4e725b", "comment": "Malware payload (Heodo)", "value": "6ee933c1ad52731228a6369376aae57eef565980", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677072, "uuid": "2fedf29f-b05e-494b-bf6e-2200c5d078e2", "comment": "Malware payload (Heodo)", "value": "b2f453b3a56c240c3825f23c1cb90e6798706870ef2871168b1db94a044b8eda076b2f7940ed395940bd6f9e6af40b13", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677072, "uuid": "2ac6ea30-a408-469c-9dd0-af7424b2998e", "value": "T12944C089ABE1ADDBD51407798DD6D324333EF2814B8387076B2598390F23BA4BFC5A45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677072, "uuid": "768ac140-6dcc-41bf-b4e8-fa3f35918e56", "value": "963f2e88a5b03877d0583808b2526c1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677072, "uuid": "33ab9b55-f11e-4efd-8bec-38da7f33b3aa", "value": "3072:7R7te82w+Oh+UjuFJrfr7CS/FmikytkqroMdjaWtHCqPZ4PEx2ES2vZg3f4L5ZJi:7loJuk4uFxOmFwytLVxDtfPZ4PE2sPs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677072, "uuid": "c39d8cfb-1867-4853-976b-823284f86c2e", "value": 270403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677072, "uuid": "982c51aa-b64d-44f7-8fda-1368c668f790", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677072, "uuid": "b08de1ab-85b0-4f38-b655-4e50d947709f", "value": "548cfd4c19e873fb3ba34102b11e1e5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e05a57ed-e734-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654697482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654697482, "uuid": "64cfb7d0-2621-42db-ad65-9f4072c97864", "comment": "Malware payload (AgentTesla)", "value": "917e91ab2f27197a74db3ef58ff2b1c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654697482, "uuid": "39c7c68d-3037-47bf-80c1-b03df2761679", "comment": "Malware payload (AgentTesla)", "value": "3742a92e04e27323e8d48a360454e1e814beffb01b9018745ae8ff842c46f8e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654697482, "uuid": "bfa94f36-8586-4e34-9607-9b5cec86e27e", "comment": "Malware payload (AgentTesla)", "value": "f6bb64b9a5fc6b57ddacac4ca3610d53fd079cf9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654697482, "uuid": "5a3c17d9-38dd-4566-a4ae-ecd4b5221697", "comment": "Malware payload (AgentTesla)", "value": "c774f15239102d0677b98eeb4b3a1a6f0bfb5c7a94223a8abe108b9ee45dab8d158750628f1ab13a85268ff98f7fc7b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654697482, "uuid": "10c32982-1c8b-4150-969f-0ce360d39961", "value": "T1FC53F852B7048A95EA3B1B78482ADB900526AFBA7935D54940F47C337B33EC70C99CDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654697482, "uuid": "0951b80d-10b1-470c-b61b-f1330f99f006", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654697482, "uuid": "fe928a1a-8afa-4f01-b72a-de49613a7c4b", "value": "768:gW5i/1uFIZMYIIIIIIXllllllWvfIIQIWR1gRkg8Zg0kNK2Rpg3tNp1tnZDg/6:gqCzHgeGUvDgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654697482, "uuid": "5f00b755-b5aa-4f02-90e3-b3e8900d0940", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654697482, "uuid": "8e10012d-672b-4bff-9471-2a5912fbd676", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654697482, "uuid": "e554a2f8-3937-4ef9-8695-2b7eb958e3d8", "value": "TOP URGENT-NEW ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bfa7c7d-e705-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654677128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677128, "uuid": "d93de3b9-7603-4393-b5b0-f38ef3c8054d", "comment": "Malware payload (Heodo)", "value": "8057b92fe2f5c8c811360cd53eae78a5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677128, "uuid": "d01fe463-ddd4-4171-94bf-5b4d40404bb7", "comment": "Malware payload (Heodo)", "value": "3962641fc2aab5e7853d550929a560c0d088c0c847e4909c825d75d501566e50", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677128, "uuid": "146917e1-fab3-48bd-a534-83aec9178117", "comment": "Malware payload (Heodo)", "value": "58a448a04deec86a33e66e4c9400b7432d85ce12", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677128, "uuid": "05a69079-3beb-4db3-a775-a0d939030fd5", "comment": "Malware payload (Heodo)", "value": "27f18b331d982b9348bf5795f09bf68f6c133483a82ae53063222c6ec398e5abcbf19d22d28b23630966a69deec2fb33", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677128, "uuid": "2e121341-6bd8-4f68-b325-51cca24aef33", "value": "T14D44C089ABE1ADDBD51407798DD6D324333EF2814B8387076B2598390F23BA4BFC5A45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677128, "uuid": "6e2eba00-8aaf-455d-ab0c-fee8ca4ed8ed", "value": "963f2e88a5b03877d0583808b2526c1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677128, "uuid": "9d41630d-188d-4bf8-be1c-efd9f202bfbc", "value": "3072:7R7Ke82w+Oh+UjuFJrfr7CS/FmikytkqroMdjaWtHCqPZ4PEx2ES2vZg3f4L5ZJi:7l9Juk4uFxOmFwytLVxDtfPZ4PE2sPs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677128, "uuid": "0e7adfff-227e-4a47-a882-2a019c6387cf", "value": 270403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677128, "uuid": "622a1dc0-fb1d-4fcf-9418-345198fece60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677128, "uuid": "4a5909cd-3ef7-4262-ad94-54244229adce", "value": "8057b92fe2f5c8c811360cd53eae78a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a9326d4-e76e-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654722142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722142, "uuid": "ba38e89c-5ec5-4f14-9da1-88e4f90a3742", "comment": "Malware payload", "value": "a29c2bf29259cca10e60041001b343cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722142, "uuid": "36e375f9-09bd-4753-b414-a14960fc1d8b", "comment": "Malware payload", "value": "39f1a98ab29664ef492b052c44f6ea76148d75baaf55b7b037cc0575eb8b25d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722142, "uuid": "5ef6fa04-cedd-4aba-b036-50baea11d842", "comment": "Malware payload", "value": "9f193df4a262989c24d7c212c2fd0c986829468c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722142, "uuid": "dbc73716-9d9e-49f1-8ab0-f5d0c76b366c", "comment": "Malware payload", "value": "eba5121d396e5f7a5280e861cb7a6d4b28d31622dfe7a02f068f4a342efec06e3e4c14a68e6e64b1690af6bb709f5ec2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722142, "uuid": "d7aa9182-b54a-4757-8b29-5eff76b0e2e4", "value": "T13A448D00BBA0D035F5B712F449B9A3A9B93EBEB15B25D0CB52D51AED5634AE4DC3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722142, "uuid": "b4e847c8-aee7-4df3-983c-ea4bfb898e71", "value": "3215fae786e72310b15953e12ddd6b57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722142, "uuid": "4e6c8ae8-d9fe-40ae-8536-6af5fbc0811e", "value": "6144:6THIVCTsxvZQIdNam+EJAZAB8mUnyQVRbm2AY0zZyg:6ToQAZQIdkFEJAZ7Ln7VRiF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654722142, "uuid": "cc567d4d-ee94-467f-8b35-53ec9b5586b0", "value": 272384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654722142, "uuid": "5266d758-ea1b-4b71-8e7d-600949f2191b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722142, "uuid": "56df2807-df19-4dbd-95a8-d73f509003a3", "value": "a29c2bf29259cca10e60041001b343cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7aaadf7-e6dc-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654659619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659619, "uuid": "42acfa9d-9d70-4409-8efc-835f5ca6117f", "comment": "Malware payload (Mirai)", "value": "e8630e3e4de23aff4f0038fe3b46c299", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659619, "uuid": "f875ab55-b591-408c-8f09-f12cd4d0c4ae", "comment": "Malware payload (Mirai)", "value": "3a2060820dd24383935fca7442650059e4f258e86ee51e4320d1da8cfe429433", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659619, "uuid": "26fe85ce-f665-4cbf-85c2-9dc421e0c2a8", "comment": "Malware payload (Mirai)", "value": "9fe2ff89b237a7d4b0ffff50c291c7c03f3ff766", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659619, "uuid": "52cf3e13-2a1f-4421-b71e-95a0e8de687b", "comment": "Malware payload (Mirai)", "value": "763823b1ebe0dad8134374306fee985d5e1d99f040a97180d5c50dbdcbf19b153331beff79da827d73165f5c0e179422", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654659619, "uuid": "3b632514-1b0b-4ed7-aad6-f184cbc318c8", "value": "T1F5E33B46A6408B13C1D61B76FA9F42453322DB54D3DB33069928AFF43F8779E4E6360A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654659619, "uuid": "938965bd-3897-4e06-8328-dd4391c65c9b", "value": "3072:6sBOZshMAREoNaUxqTbcYXxlVHWDdpuo/PvaM/9whaZ:6sBgbOvNaUxqTbpXpQpuonvaM/9whaZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654659619, "uuid": "23189880-de0a-4e0b-9daa-790f80f4c295", "value": 154210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654659619, "uuid": "9e9fbb90-3fa2-4998-a220-3b832e038311", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654659619, "uuid": "48bd128c-ee8d-4f53-9198-d102174fe485", "value": "e8630e3e4de23aff4f0038fe3b46c299", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba4bb234-e75f-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654715887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654715887, "uuid": "86335208-b619-44db-bc5e-01e8cf5e42e7", "comment": "Malware payload (Formbook)", "value": "b67ab478ddcd3d560869e74582314617", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654715887, "uuid": "f4b94aa3-9ce7-461a-ac2e-6f7c6c191645", "comment": "Malware payload (Formbook)", "value": "3a3e53c4e425125504f39cc4d912677074a15fc4cfe529d1814262b04b50e60f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654715887, "uuid": "10767bb3-accc-40ab-a289-e8615f308de1", "comment": "Malware payload (Formbook)", "value": "7b805a63a8b0286f8cec79b24ad505e7ef1bb0e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654715887, "uuid": "9f2ed795-6f18-45d0-ba60-6b3761fb1b88", "comment": "Malware payload (Formbook)", "value": "09fe83e25f77f1f301fbad786ce1d7ef021c9b0e76a5f029f403858f350bfa957a1d2af5c0a5cfb9b76981452f97eb0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654715887, "uuid": "c167d7bc-bc0a-4cd9-936b-f6c426a0d12d", "value": "T125F4E002F5BB8E32F29603B7C4D2545097B69149A297F70F329802D6AD43BDEC993787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654715887, "uuid": "b586da39-3e62-4a25-9c07-ec1c6d11fbe3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654715887, "uuid": "f0e189ed-f968-47df-a6ee-61c71e595418", "value": "24576:fMEqLhc66dY8xOoeDZDfapG0GqI7mj4O:UEccNdY2OVDZDf77mjF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654715887, "uuid": "b70a57d7-bb1f-44dd-8081-83952eba7045", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654715887, "uuid": "b1127b8d-ebfc-457e-8d6b-9ef845f38f2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654715887, "uuid": "0db10bdf-6bd2-4605-9ac9-7d74bfa81676", "value": "Specification & Samples-pdf-.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05eb1077-e733-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654696687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696687, "uuid": "3b5ecfe3-736c-44b4-b3f9-3b2c5d3f270e", "comment": "Malware payload", "value": "1cb47247f634853cb0e9de8baca342bf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696687, "uuid": "48d80207-7902-4659-b87b-b8469fa28fea", "comment": "Malware payload", "value": "3a55dcda90c72acecb548f4318d41708bb73c4c3fb099ff65c988948dc8b216f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696687, "uuid": "6b15d237-ae95-40cd-927d-71b14c0d409d", "comment": "Malware payload", "value": "87df9ed2680425faeaae398d0eebe27504a3fcce", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696687, "uuid": "0adc0160-70a9-43e9-b84c-440ec1a58718", "comment": "Malware payload", "value": "67dc749244a6943bd24bb41f25fba4210adf4fbe511344847a3f057c78a62fce100f583b3d680065d5a910ada2286d80", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654696687, "uuid": "daf1f818-1538-4db3-8e67-038d94e40454", "value": "T1E623F121DF247A5AD44C9DB5C0680B96A80470D7126D2F8EFB24DDA8E21FF07F9CA422", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654696687, "uuid": "29505373-430c-4375-91cf-accc06aa13f3", "value": "768:0sDES6M5eBWJL/SL7w7EerR+t4SIpDcL47DC0eYly6WRc9HcxWgVDNM:puM5eMcLEYeYyxy0DyS97CM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654696687, "uuid": "71e54db6-4877-4473-b28f-a2092a7fae89", "value": 45632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654696687, "uuid": "69b65ee3-1686-4dfb-b25f-8a0d8498ad5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654696687, "uuid": "c029fa6e-b98a-4021-8156-2db42dea1dbf", "value": "gummy.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad331ab-e786-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654732585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654732585, "uuid": "75170916-cdb5-4ef9-9878-2fbb3faa32f6", "comment": "Malware payload", "value": "2fb9ac2c23b039a6e2bbf5d4102ac6ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654732585, "uuid": "a60ece1e-b94d-48a6-af6f-10cdb610851d", "comment": "Malware payload", "value": "3b5f24001f508dd615d3b0fe2af6035b769ad251dfb96ce758bb41f880b6b946", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654732585, "uuid": "d4e28070-5cab-43f7-ae74-dad6d61d40f0", "comment": "Malware payload", "value": "531bb7a9e8c2b6079c61d34dfccb530cc143eca2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654732585, "uuid": "9970f7f3-7ed1-425b-bc4b-5a5b12988943", "comment": "Malware payload", "value": "f4072503c49be13d525ef96ba34d46e9009b1b741464fb89de1e4519c46fc9dc9a3654e482e348d8cef916670fb91930", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654732585, "uuid": "9730be41-ba6d-4f25-98da-7a96bd0c0433", "value": "T19424015D71E8C4DFC8A2DB350D72C1A2DEFF28261958660313A4AF68FA722915B1E713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654732585, "uuid": "0dd5bb9b-0bac-4832-8918-5ed06b3efdb2", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654732585, "uuid": "05f00c86-e28d-4634-98c3-f70a50d65993", "value": "3072:YfY/TU9fE9PEtu3/YYBxCRw68evHOfO2yR/tQEurgF/hfPbtWV3j6HTaYlqFGAz+:OYa6d7v68evHiO1Fxto6+YEHKprN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654732585, "uuid": "1438d7a6-1863-4e6a-9bec-93f7b7e13622", "value": 228483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654732585, "uuid": "bd85fdcc-822c-466a-8e02-d2d505e9cac6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654732585, "uuid": "8e7f0644-6de9-4e67-a733-3c853df4d24b", "value": "new inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c715d83-e6f6-11ec-93bb-42010a9c0043", "comment": "Malware payload (Joker)", "timestamp": 1654670632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654670632, "uuid": "84339c3d-5fa1-46f5-aa84-b038e369402c", "comment": "Malware payload (Joker)", "value": "58ad9a95360a8af07f95f70bcf9f1a05", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654670632, "uuid": "48bc0f3e-839e-4e3d-96fd-fb810c3ac80e", "comment": "Malware payload (Joker)", "value": "3c080a213740e0baf89643fc50bb7e7ed1ce885a5ebd39d7575d715b4d97a243", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654670632, "uuid": "14317ff3-d65e-401d-a3c2-6c188ec5c24a", "comment": "Malware payload (Joker)", "value": "cc69978ffa27e6d8d39d29b3debb1921fa99df52", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654670632, "uuid": "207a6664-1ccb-4d3e-9a56-fffeaf3148fd", "comment": "Malware payload (Joker)", "value": "161662c12fb3cc95b5d4c53171d598ef2d1953b6979c39ee86f623d904e2cb5dcb613d50bb17a31c70fec004cea067a7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654670632, "uuid": "564d341c-f257-44f7-a15d-8619cb9cda81", "value": "T18087331BE768B85EC4F383334AB5567545960C218B43DB932908F37DA9B7BF08A49BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654670632, "uuid": "db37d77e-66d7-4682-8cbc-24676c0e787a", "value": "786432:u5LMrUAaaMljqNro9V9MtVpfC87CjPvCPCvhLVO/MSeh8k8R:OMrUwNro9ViFC8ACapLePqd8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654670632, "uuid": "17010bed-3264-4366-9f90-6efc9f7a2e72", "value": 37882491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654670632, "uuid": "b875fb21-3550-4143-a866-4aa10c07c055", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654670632, "uuid": "0b285eb8-a3a9-440b-b89a-fde3b91cb638", "value": "Digitize PDF Scanner_1.0.4.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a89c0d4-e734-11ec-93bb-42010a9c0043", "comment": "Malware payload (ModiLoader)", "timestamp": 1654697231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654697231, "uuid": "37f0b933-b881-49c3-a162-5b4270c9df42", "comment": "Malware payload (ModiLoader)", "value": "c0a9f8c0059bcb41809eed8ff2c6b948", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654697231, "uuid": "20b6fbf1-eaf4-4544-89d6-9fadb58ad21c", "comment": "Malware payload (ModiLoader)", "value": "3c4b204d7858daa96b64da8a6746769c4e9c5aeee54a7b4a6da55fab224774fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654697231, "uuid": "cefa718a-2a24-43e9-b58f-17062ab8e9fa", "comment": "Malware payload (ModiLoader)", "value": "8da815b8cc15dcded34e6b0b874d0dc0eabc6c08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654697231, "uuid": "367ac595-f906-4ba6-a267-b6da917e68aa", "comment": "Malware payload (ModiLoader)", "value": "59a20cb8df7f0079afc48bf1cd490deb9124e6a92e5886ae9601f1b93c0b8b95d5f218032d25905acafd486442268f38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654697231, "uuid": "cd99b8e5-939e-4b3a-bee0-e38ebaed65f3", "value": "T17C35BF22B2810537D4772A345C177FA5A96ABF002D24A84AABF63E0CDF793D17D38257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654697231, "uuid": "380cd492-62d5-4605-878f-c88d1bd4a0b0", "value": "02a89028ae3fc76c6e22c422944c365e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654697231, "uuid": "60001b64-a3bb-408f-8579-c99c47c16a9f", "value": "12288:MIfbQK/punQN2hK04lk5WiZt0/2CjDj3+3S8HL75M9JOGkMTgIGuURWCXCEUaWQR:M+UKInQ0KO5b4+CfuieZM9JJkMsTWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654697231, "uuid": "48d225fa-0e4f-4a6a-8b33-3e892f153ee4", "value": 1064448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654697231, "uuid": "3b2cd95c-bb62-4ccd-9743-5f1f8d2c34d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654697231, "uuid": "2ee0dc9f-8760-4d89-9e9e-b015bfd0030b", "value": "Invoice and Purchase Order Copies.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37da4e08-e6e5-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654663270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654663270, "uuid": "8c95eb1e-3c70-4942-94c2-53b37ae992b1", "comment": "Malware payload (AgentTesla)", "value": "779d766767b3f56303725cb565957897", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654663270, "uuid": "9939d869-56f7-455a-8706-516a1d8b59c8", "comment": "Malware payload (AgentTesla)", "value": "3cc00430404164c201c89470c9e8c1d7cafdbecc8b32a17fab2db324bd26766a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654663270, "uuid": "194e820d-4c6d-4926-9157-b930e8b13d55", "comment": "Malware payload (AgentTesla)", "value": "f292e4c9535501a4c86f304f23bb3a9157958e9f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654663270, "uuid": "2c256074-d139-46be-9f93-dc61fa10a86e", "comment": "Malware payload (AgentTesla)", "value": "b288b806ec17b13106df132085752872454d245a9ebae945ae3f2cd1095a808d2e30362a1ac94b1656ac2eb0969c69c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654663270, "uuid": "8b11c047-ca4d-4aa5-8542-d70b2d5b4623", "value": "T1C773020172458D6EFF65B63A2BA0A15CD1EE9C3D1E6BED82E5217F8836391D01DF421C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654663270, "uuid": "2fe0403c-37d7-4e36-bc63-0820a710847c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654663270, "uuid": "8b616cd7-ca47-48dd-aea4-8faa4220619b", "value": "384:trv14gCWFf0E4S9gxGP4b2S9+2DIpPmfTyqGhYgjF56vH:tr+gCWOEp9gS4bbPiCaF0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654663270, "uuid": "494dee54-fcc3-4721-b14b-bdcc3f71fe8b", "value": 78336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654663270, "uuid": "a4e2b86d-37fb-42d2-ad08-5c35ff8e6885", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654663270, "uuid": "be05b401-e9cf-4e07-a637-a7bddbdecde9", "value": "SecuriteInfo.com.W32.AIDetectNet.01.25358.9251", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5621939f-e77d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654728604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728604, "uuid": "bb886fc1-8707-4776-a608-06c75c214877", "comment": "Malware payload (Mirai)", "value": "f8661c84f4e9c88e48cdcb908f6d3ff7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728604, "uuid": "1c88421d-afc2-4894-bd5e-568969646b37", "comment": "Malware payload (Mirai)", "value": "3cfade8b74b9311d94deb297e8a4a1014d1bad29a395ea5fbc551f2969b91d06", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728604, "uuid": "a29893bf-c454-4aed-9aa9-f1d726e8915b", "comment": "Malware payload (Mirai)", "value": "66fafc3f1e23d3a112f689a29118759d2b78f998", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728604, "uuid": "bb663d74-9332-4b57-b20b-5a51cb7a63ff", "comment": "Malware payload (Mirai)", "value": "c3dfc4c8721b3b15c0662aad6b5ad8ed58c563e190023a332e9bfc14dc9a6046e44d5df3fbbd0f44f7e8375a7b7b0576", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654728604, "uuid": "5e7c6e11-a258-49ce-9f22-32c629930b87", "value": "T1BCC2E095D877BCDFE578E83A4E9CEE2D5250C011A3392604E66D8533C0E6B10ED5EE40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654728604, "uuid": "9fa0eb39-43de-4418-8c22-75ff394e332c", "value": "768:OXHlYrPe6dyVqfASgDiWtUOon196VGbnZ82rN7:OXi2eyegDmOon19IGbKEN7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654728604, "uuid": "6e9fdbac-6537-4289-b23d-98e1ede04d3b", "value": 28080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654728604, "uuid": "2ebfd5b3-3f8c-4de7-8bca-ad6c7ca0fdd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654728604, "uuid": "f3bcb888-a953-4bf3-a2fd-9a7eb9de4646", "value": "vailon.x86-20220608-2250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0207ad7-e75b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654714206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714206, "uuid": "bbd5b34b-44ba-4d22-a370-fba5b022955a", "comment": "Malware payload (Mirai)", "value": "344f65fb091815b9f38f47cff4072815", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714206, "uuid": "456b5d4b-0da9-417b-850c-bc23fe28246a", "comment": "Malware payload (Mirai)", "value": "3d5cc5d8f2cad4c8459cd3cd6014f83ff66737a9470b56fb9352ed6ea8d434b6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714206, "uuid": "d5d5dd73-910c-4c06-873f-c899f0899bbd", "comment": "Malware payload (Mirai)", "value": "bf13587a9ded45ed794949eb6b1a601ef4ae3128", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714206, "uuid": "3d60b7cf-383c-4684-a036-a15b949cac75", "comment": "Malware payload (Mirai)", "value": "e4efd2b8f3ded130e8ab20c16d9463e983e9fb575be63806289e67f9128f88e9a14c76c42e2eada728ff11b7ffc55d84", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654714206, "uuid": "c345ad6b-51a7-4e31-ac36-6fcfecba95a7", "value": "T156932A85BC44A622C7D812BBFA1F028D375513E8D2EA7317DE209F60778B52B0DA7746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654714206, "uuid": "02aed186-a799-4376-9044-2b2766181bb0", "value": "1536:d3kOJp37IdaIH0PScn5HhiSRfXSon8lP2PHasRuMnKOpZ1cnsWcDvG7nnn:d3kOJp37qGS+VhtTMPEHasBje8G7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654714206, "uuid": "a64c145b-42a3-428a-8828-9bad35b77b52", "value": 96404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654714206, "uuid": "9078749f-f998-4dd9-a818-cfa900c02226", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654714206, "uuid": "59066d4c-066a-4c22-9cc6-f03eda2dc240", "value": "garm-20220608-1850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3414fc1f-e6f7-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654670994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654670994, "uuid": "db59f153-fc4c-4fde-9008-14147c10fd00", "comment": "Malware payload (Formbook)", "value": "29c3d3c4b57cca153046ac837ce41be3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654670994, "uuid": "a38a3910-b8b3-4a5e-9d24-00ec74699403", "comment": "Malware payload (Formbook)", "value": "3d92a8622132f951fa5c76cc35ab4936c74a7f273b26d02767ba54296467ad8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654670994, "uuid": "f8429a13-731d-41b2-bff0-cf0d8190ceec", "comment": "Malware payload (Formbook)", "value": "6b8c6cc6e42dcea5be090bc88e6d1f54836b0f99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654670994, "uuid": "b088a053-c290-4d6d-95f8-3f4f40a9e219", "comment": "Malware payload (Formbook)", "value": "f502e40e2748a788614f44eb559e1557389d5f0c4f0d8352c3579a87df53e4e7e21e792a3b49dda079b15d510f0057bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654670994, "uuid": "2deb88d3-4476-433d-b006-40f0ab2923e2", "value": "T1AD64F1C2E29249DBDDA557F3493AA91E32B7EE28D830A11F436B36A56F732D30117503", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654670994, "uuid": "02b493aa-f016-4454-bb5b-7cbcdc710032", "value": "dd1742eadfc6df18ded3c26ae64ad610", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654670994, "uuid": "c5605268-9205-4a67-9a16-20668c298d12", "value": "6144:obOZv9EkKuMq8PxiCrBIEHqVLM+DSEuID:REkKuMq8PxiCmewbeaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654670994, "uuid": "bb543e93-9354-4e22-84de-19eb61672bcd", "value": 329359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654670994, "uuid": "3ac4d16a-e361-4382-beee-e4b31456ee86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654670994, "uuid": "6a138a9f-b1b7-4396-a5b6-91041b7cbdaa", "value": "price_list_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47449bfc-e720-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654688636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654688636, "uuid": "da529424-1d90-4f27-ac44-635e95988920", "comment": "Malware payload (AgentTesla)", "value": "c177d21f900cdc214a4d2bd4692a082a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654688636, "uuid": "c2090ef7-b3d7-4526-9d96-e30cdef51f86", "comment": "Malware payload (AgentTesla)", "value": "3da3c80ea2cc021eb62400339af24ea741180be47582a9699ed3eda1c3389892", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654688636, "uuid": "4ac5a5c9-8c0b-44fc-a76f-1f3720dbd431", "comment": "Malware payload (AgentTesla)", "value": "264bbd28943373c723f3aaa47bd6965ff5cc0483", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654688636, "uuid": "4a1ba997-3435-4fb7-9a1e-f50a3a61ee11", "comment": "Malware payload (AgentTesla)", "value": "8f3177e946b43cb69f7acc0a60d2092ec418084dc0f65cbb50079407432edd5648bb97c92e2efbb42abbdffe80af8c1c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654688636, "uuid": "f77f5bcc-ccdf-4bd6-af37-2c48b865493f", "value": "T13705E106B5678E73F39B077BC4D34510A3BB8106A9D7F32B624403E96D437EEC962A46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654688636, "uuid": "1fdc059d-d8e0-432e-b611-f9d9cd125599", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654688636, "uuid": "d6dd5f22-58a9-4f02-9d85-b7bc2ed69c97", "value": "12288:grsLaTnu4ihZ9qERwcyF273ArZqiU2tH0GWZ6O6I2IH/Gn7svaW1QL:VLaLuHhZ7nygWTPy16I2IH/Gnak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654688636, "uuid": "e69b196f-36fd-4814-b5c2-ae0365a62b21", "value": 827392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654688636, "uuid": "39ea5d3c-7a1a-47b1-bd79-2e3ecce4c2e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654688636, "uuid": "29b8f3e6-459c-4ab2-a3b5-29fbebd31aba", "value": "PO_90654437PR_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be09d3cd-e6d4-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654656193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656193, "uuid": "f04e4c7b-b902-4278-bd7f-ef648c237cc0", "comment": "Malware payload (Heodo)", "value": "82594080301c53efda4bdc913512d458", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656193, "uuid": "49a55d13-525d-4aae-84b6-a469aff6bb1f", "comment": "Malware payload (Heodo)", "value": "3db54b980748e01508dded127904dba459e61e8ac6c34747ba8d025ea8f2af42", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656193, "uuid": "6434f711-4d01-4357-8093-1f532937f2b2", "comment": "Malware payload (Heodo)", "value": "5db023b2d08253107e47ea2d5566b4bc17def112", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656193, "uuid": "60053584-80cd-4cc3-9e9f-13bc794e2b9f", "comment": "Malware payload (Heodo)", "value": "9a987da953f67651b56b76cf4b58a57e6ad63550e183b52f3632604c689226556dab1aaa981ec85d6463645087d47b90", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656193, "uuid": "aabac599-6c53-4eb7-9737-14212d505383", "value": "T16F04023EE5031A98C22ED8FC58EE6DF9D5F634006268063A1BA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656193, "uuid": "3561890d-7a06-4c37-9a9e-150dc31fc28f", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656193, "uuid": "f23f9c86-a95e-4dbe-a34e-83c60d1d2931", "value": "3072:VpjftGFs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VR0i1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654656193, "uuid": "44967e80-faa6-41fb-8e23-45aa7ed632ac", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654656193, "uuid": "c3ecafff-b6da-4f9e-a82a-b89e2803f81c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656193, "uuid": "400a81b7-dc3c-4148-9afc-5c10f612d6e7", "value": "3DB54B980748E01508DDED127904DBA459E61E8AC6C34747BA8D025EA8F2AF42.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c049a0-e6dc-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1654659622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659622, "uuid": "d3e666c9-aacf-4213-9ed6-e4426415c44b", "comment": "Malware payload (Loki)", "value": "60b4512b3312b4f60dd9e1304bafd1c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659622, "uuid": "5d8effea-3cc2-4b7e-84d6-850ec0a78ef8", "comment": "Malware payload (Loki)", "value": "3e1ed40043db2a405086385b7217fba4dc74341a62045b39bc7a50ac62288da8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659622, "uuid": "ab919a3b-3744-4804-b044-81378c9e4cd9", "comment": "Malware payload (Loki)", "value": "5caeab3bf91e2c26a29abe08056438d8df44e6fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659622, "uuid": "05a1e141-d2b9-4acb-b68d-c54eb836db37", "comment": "Malware payload (Loki)", "value": "388bfea24be1a9ddae463c5e40cb3808e22001e3b4d064f12ab8bf7e10ec1ca36a5822a04e8936a2c1b9ca0403a2ff3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654659622, "uuid": "659b5344-5347-4362-b7cb-f57d17de4e20", "value": "T16AC4121476EC1B62C67D0BFEC4A9424047B0A72B682BF74F4D4675DE0E2BB81C61672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654659622, "uuid": "0dd9a920-90c3-4608-a5b9-be511d0c5623", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654659622, "uuid": "0eb68791-2fa6-48b5-9dad-3c6ff2e34212", "value": "12288:ckU+wyhhm/LxUJgla0dBUeHstnIkbo9q:n/n0LxUJglGeHst3bo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654659622, "uuid": "0e131358-d5fe-4c0b-ba13-a2c347b56a43", "value": 571392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654659622, "uuid": "96b8b173-55b6-4052-a760-5a6dd974771c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654659622, "uuid": "475cb122-773c-43c9-87be-fa255a592223", "value": "SecuriteInfo.com.W32.AIDetectNet.01.7537.7249", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "215156c2-e6ca-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654651635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654651635, "uuid": "05a18d49-141b-4521-a866-cfc910cc2b4f", "comment": "Malware payload (Heodo)", "value": "605d300cf66ee1cbc21ea8941f9b823b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654651635, "uuid": "0232a014-a3d5-4eae-bdfc-1ad05a463901", "comment": "Malware payload (Heodo)", "value": "3e3ec314ef820f55e7b676b43a076a31098134a44b4a167c5278390f15d9d0d5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654651635, "uuid": "0d98953a-65bd-4f92-bdc7-93f30ae02e0e", "comment": "Malware payload (Heodo)", "value": "8e11f8bdcbc9cb1e8344b2c5b0704a8fb05782ce", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654651635, "uuid": "070b25c2-03a2-4a17-b4aa-e5e0df9c434d", "comment": "Malware payload (Heodo)", "value": "52c7ff1b571958f9aaaeca05c564d2792c61a3f3b92ed9fbcb3c0c9a95c73889d4fda25af98d60656a32de68ee5788e6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654651635, "uuid": "61ded6a8-bdc1-4433-81e9-23fd6450ec67", "value": "T18A04023EE5031A98C22ED8FC58EE6DF9D5F634006268063A1BA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654651635, "uuid": "7fcab2c4-8a28-4df7-bc9a-b0f9acbbde85", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654651635, "uuid": "521261a6-d0c7-4b15-9df3-46f439771958", "value": "3072:VpjftDFs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VRVi1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654651635, "uuid": "7a7bf48c-0165-4329-92b5-4fcb3ee284ed", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654651635, "uuid": "4f90536e-3e77-48e8-b293-f427d5b18929", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654651635, "uuid": "84a6467b-88af-49cf-b5c0-31939501cfbb", "value": "605d300cf66ee1cbc21ea8941f9b823b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cbfb501-e72d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654694282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654694282, "uuid": "6f0a9ac9-d7e5-4ed9-a554-3e8560d9a9d4", "comment": "Malware payload (Heodo)", "value": "dc41ee74edcd1712b8c517be03a3c00b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654694282, "uuid": "3d3ceb39-e882-4a73-ac0c-984bbc99868d", "comment": "Malware payload (Heodo)", "value": "3f3da28e25a2279ed91ae9c50ca6db50047a1d33890761a8c09ee0a984557029", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654694282, "uuid": "c2caf66e-af70-407e-bce1-4e6a09b546ef", "comment": "Malware payload (Heodo)", "value": "65c86a1ea45cc863b86fb6a3ee4f52323ec79121", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654694282, "uuid": "031cd9ac-46be-4d78-bc81-a352bf46a29d", "comment": "Malware payload (Heodo)", "value": "ce2702fd36ea4f364e20dd5b94ae93395301630ce4c9645bd4ad647dc09f8caf084f4d79ad5995dcd3d0b5b9bfda4536", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654694282, "uuid": "8cfcd4cb-12ae-4cc6-a7a6-5620dcae8f5f", "value": "T11844C089ABE1ADDBD51407798DD6D324333EF2814B8387076B2598390F23BA4BFC5645", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654694282, "uuid": "5aa0896e-08c5-4397-83ad-8c4039edb4bb", "value": "963f2e88a5b03877d0583808b2526c1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654694282, "uuid": "9b8fa74a-abd9-415e-a867-561c71060546", "value": "3072:7R7ve82w+Oh+UjuFJrfr7CS/FmikytkqroMdjaWtHCqPZ4PEx2ES2vZg3f4L5ZJi:7lWJuk4uFxOmFwytLVxDtfPZ4PE2sPs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654694282, "uuid": "0fd50505-95de-4c42-93ce-89b15f2c8054", "value": 270403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654694282, "uuid": "ccc8c1f5-0ee7-41f1-bc5a-9106031d65df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654694282, "uuid": "167c9b77-2901-4b3d-8adf-2af6f0ad258d", "value": "dc41ee74edcd1712b8c517be03a3c00b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0496c7ea-e74b-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1654706992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654706992, "uuid": "d7c9446c-a070-46f4-bc26-2e94b8ed6a37", "comment": "Malware payload (AveMariaRAT)", "value": "afe3cdc677856c27d51bff6da749e991", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654706992, "uuid": "dfc70fd0-0c43-4b12-baef-6365ae1648d2", "comment": "Malware payload (AveMariaRAT)", "value": "3fba186854c95d8ea3f1e7bb2b5770c8f3f7d7ca6d7b75646ed2446944c92693", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654706992, "uuid": "f533a69a-5a64-4501-ad4a-eab6d121a0c0", "comment": "Malware payload (AveMariaRAT)", "value": "1c1368a5000e71a791b7b6b56281b8e0055b7928", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654706992, "uuid": "7fb53bca-8f65-4dd2-882e-8a22db999c26", "comment": "Malware payload (AveMariaRAT)", "value": "ea2354bd0c40c5df09c875dc9977416c44b3d8067a410945643d1f25b2e4281374cfbe0441993b3f92f8cdcfd64a98ac", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654706992, "uuid": "57cb7b55-0042-4138-a8de-ee4f685d60a3", "value": "T1BA35BF22B1424437D1621F344C17BBA56AAABF102D28B8466FF53D4CDF7A3927E39193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654706992, "uuid": "ba265321-7f91-4e99-98a6-22219af4da9e", "value": "02a89028ae3fc76c6e22c422944c365e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654706992, "uuid": "489e275e-c70d-4898-9e26-024afa794b0b", "value": "12288:MIfbQK/punQN2hK04lk5WiZt0/2CjDj3+3S8HL75M9JOGkMTgIGuURWCXCEUaWQR:M+UKInQ0KO5b4+CfuieZM9JJkMsTWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654706992, "uuid": "6905ff6d-5125-4ac0-a0da-4c19f01a049e", "value": 1064448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654706992, "uuid": "243e692a-0e27-4827-9a1d-f404d2c2c32a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654706992, "uuid": "b4094720-2cb0-4409-9f50-793c417acd3b", "value": "New-Order-Scan-120422-and-Company Profile02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c5ea72-e70b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Socelars)", "timestamp": 1654679553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679553, "uuid": "5a796c6a-a630-4823-9151-8c465e41a32d", "comment": "Malware payload (Socelars)", "value": "9f6c273642842ca56d0a7253059a864c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679553, "uuid": "9ce05153-4ceb-412b-9aee-0ef63bf0c981", "comment": "Malware payload (Socelars)", "value": "3ffe0cd89ec6899d39c06e83e857d3429823bb641fdbfc5b384d835817ea479b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679553, "uuid": "07bf3147-fd50-49b1-ad04-e4f5d5508078", "comment": "Malware payload (Socelars)", "value": "5aaee07c12f6802ee617f23ebd049aead6f170f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679553, "uuid": "b6fe7947-f86f-48c3-ad16-7bf521f190cc", "comment": "Malware payload (Socelars)", "value": "f8e77b7cc4959a8c2fdee8e5c7f67dc075c7f25c09c2a3e708a0ceb3cdc10580b947cf917811f5594f2fda0c117285a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679553, "uuid": "c98249cd-7ff7-4b58-ab6a-ffa0c5b397e1", "value": "T120659F11F642A036ECE3107682FF4AFE8D38BA21031854D7E3C45D6A5E619E37A37A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679553, "uuid": "2003e2cd-362a-4235-a749-43f6ebb84d25", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679553, "uuid": "3f08169a-9c71-4cf1-a7fa-002adf2290c1", "value": "24576:b6pYjfuKDGp9FGF3KUK2pdAlLnbYt6GH7LPv1lR5Ue5nHWON5bb7YrLs:epMRGe/4ebLPv1lfUQHXbb7iLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654679553, "uuid": "b6a51b7c-0663-4f3c-963a-b921a1a15e59", "value": 1489920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654679553, "uuid": "24b5d6f6-6fcb-4080-9ead-99660f903df2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679553, "uuid": "57f120d7-b98d-469f-a7dd-50d8df3bba1e", "value": "9f6c273642842ca56d0a7253059a864c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c324f6-e700-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1654674893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674893, "uuid": "051f556c-c89c-4c26-a8c6-d946562b0a01", "comment": "Malware payload (Loki)", "value": "9324524188ae2bd95b762d33a6b5e0cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674893, "uuid": "540d1b97-aaf9-46dc-a762-754d054e87c8", "comment": "Malware payload (Loki)", "value": "408140e9dcd2425d9699dbab111b30e664f0ade9c453c56707aac196855e60a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674893, "uuid": "efca908d-8716-462f-9aa8-e36858e8b514", "comment": "Malware payload (Loki)", "value": "5de8ae0123a24c7ba034bda2a16ff13b012c63a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674893, "uuid": "e52524bf-8cd3-4607-92a6-856a4b311c14", "comment": "Malware payload (Loki)", "value": "e3a4a45d0294dbf885dc7c54aa054cf209e213bb4300ed120bb2556739d810126f999fb8c897d25fdb837bb32da859dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674893, "uuid": "ba8c6368-b2a7-4698-9307-d8849c1692e7", "value": "T1B5D401277FDD06A3E63E2FFB8454024157B0A52A652BE74F4E4170EAAE36BC39D12113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674893, "uuid": "9aace7f8-36a8-43f8-9922-3dfbba2663ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674893, "uuid": "760db79c-a3c0-426f-9114-5adce71efa79", "value": "12288:XaTD5ESxr6cQ8KfMdqnWQ0wpylJJuY+wmYpcbo9q:WDmMr6cQ1Ed5UgJ/ebo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654674893, "uuid": "d78c381b-9e94-4542-983c-33f83d067062", "value": 621568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654674893, "uuid": "d8c77b76-3186-41c8-b2a0-d80450403b7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674893, "uuid": "63cbf7d4-b88a-4530-8b95-f53d99a89d5a", "value": "\uc120\uc801\uc11c\ub958 \uc0ac\ubcf8_pdf,MOULD EXCEL INVOICE(2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f64f8be4-e774-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654725007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725007, "uuid": "21dc342d-1679-4b74-907a-8daa8e0b974f", "comment": "Malware payload (Mirai)", "value": "b02830d40346e3757908bb9845ca0b8c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725007, "uuid": "6c56f271-e109-45b5-a12e-15a597523979", "comment": "Malware payload (Mirai)", "value": "410d8a02c4e69e8398b30830206d103c972c0a6537e1e384fd3a9ceb96af0e92", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725007, "uuid": "b065607f-8983-4b18-a55c-f305e1ad9c95", "comment": "Malware payload (Mirai)", "value": "d5807b4487db89ff36405d78f908f8358896e422", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725007, "uuid": "723b6d44-95a6-4a44-877e-f9ee14f0bb96", "comment": "Malware payload (Mirai)", "value": "4cea826f8faa1bad6ed27a2ca08b36d3722f18d046b23690955177de315c9bd5c1977a80c7e4e653a2011fcd8f5df2de", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654725007, "uuid": "6a25698f-92f6-4b47-b9ef-31af744fbee6", "value": "T186632981B891A626C7C112B7FE2F018D331597DCD1EB33429D296FB876CA81E1E37646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654725007, "uuid": "f7a69fa3-720b-4940-b031-b52e02c2e25f", "value": "1536:2Omiucn0OWRZ5x+030D61w5fU27hc4Hih:2OQOIG0n1qM2tr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654725007, "uuid": "587b0e8f-d502-42e9-a583-e9da6fd440b8", "value": 70712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654725007, "uuid": "e0de0808-de8f-4447-aa23-bd194d880934", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654725007, "uuid": "95e2e750-0513-4cb2-afae-b11f3405a25e", "value": "rift.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bccac378-e73c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654700859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700859, "uuid": "a491c085-abb6-4db2-a7ae-d7611f9c384d", "comment": "Malware payload (Mirai)", "value": "a84f422f685ed3d5afd8bad92fa8e1db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700859, "uuid": "18a1527d-5440-4f5c-bb7a-c924ed066850", "comment": "Malware payload (Mirai)", "value": "417d7a0c03ad4bbd377a1ef7dbb72e4efcb535b8606ceb38c6dba3cc947db701", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700859, "uuid": "96280e3a-4c8e-4ae8-be2f-6049feb31d52", "comment": "Malware payload (Mirai)", "value": "70c8411bc6514f11cbdf526d8137afa4beac1431", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700859, "uuid": "db6c118e-f268-4d01-8a4d-a65d8b8c197e", "comment": "Malware payload (Mirai)", "value": "f0af54145dd79e8b8ce6e0437d556ab827941da2836d4467afd56a8a9d8f12db694907f6443b702c5d3f5eedb1281b4f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700859, "uuid": "f799a53b-3424-4c07-9194-0a94bf6fb623", "value": "T16A832991B8819A23C6D413BBF96E418D372563E8E2DF7203AD211F6437CA81F0D77A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700859, "uuid": "1dd13d03-0d34-40ee-99b2-1ccb3baa66e9", "value": "1536:fHK26YJBoTQso7beFacHCzRci4dduAV3TiTy9sI3G5D8XIhad5GkRA5q4cx35QQY:fHK+592d332yKIWFXhWLAo3tJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654700859, "uuid": "98c60016-a11d-432a-9304-fbef2131d84a", "value": 81156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654700859, "uuid": "4e9aee9a-fea9-49ed-a6cc-95c76bc49aa2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700859, "uuid": "b0d93bef-f0a2-4e77-8fc9-078b1fa07285", "value": "a84f422f685ed3d5afd8bad92fa8e1db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55f9ba94-e6ff-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654674487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674487, "uuid": "8b5251e3-855d-4230-a795-60a849bb7cb0", "comment": "Malware payload (Formbook)", "value": "f0f4bda493207023c42682ccbae2df48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674487, "uuid": "fd225cd1-b49c-47a5-8d4b-0e3ac1ded72c", "comment": "Malware payload (Formbook)", "value": "427c9b2f96d7de03cdc0dc7aee9182be34dff11ccde29086da146a3cd4abf821", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674487, "uuid": "1e1ca323-806b-4895-b92f-30275ac6e71a", "comment": "Malware payload (Formbook)", "value": "cafec82de586c3fb2c81da1c765e6d1fd77d9f98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674487, "uuid": "3be600c2-44e6-48d8-8efc-39e87fc05087", "comment": "Malware payload (Formbook)", "value": "fe2537e33d3ef675430029c812f5a116dde5e856c30f8043ebc9d39603cfcf2ba69ec716658edd5c35e602835828b5d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674487, "uuid": "bdbb1c18-3be3-4639-b144-6fbb1ef2541c", "value": "T1CA2401C5BAF81EB6E549867040B7EF68B5788E74640142470B54BF6BDEB01D38A0B3A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674487, "uuid": "2bb9678a-820e-4d00-a368-bf309c1c8436", "value": "dd1742eadfc6df18ded3c26ae64ad610", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674487, "uuid": "a782e42b-30da-4e84-b9d7-dd204e75cc22", "value": "6144:Rb5HI5d4JSsEp1ymFcflyLFVQPoyKeWEP:fHELR0flwFVQPoyKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654674487, "uuid": "faf265b0-4c1c-44ee-96d3-ef68d101b354", "value": 214801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654674487, "uuid": "18496bfb-c7b3-4eb3-b09e-c9b5d4ccd64b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674487, "uuid": "58f029a6-9824-4742-ad21-2bbd11aa6637", "value": "Inq-AT992071.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a4e808-e6d6-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654657152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657152, "uuid": "6607348e-12b5-4fc4-85bb-9083db792289", "comment": "Malware payload (Heodo)", "value": "471718bf3dbf6de6799578d7562661a6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657152, "uuid": "83e2b9f6-ed0b-450f-abd8-725272889000", "comment": "Malware payload (Heodo)", "value": "42a4d0eaaf789e263b2978c291c365e2ba1552873fdf152f48735e6a559a5016", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657152, "uuid": "313baa95-2a98-4b3f-8e4d-03283aec7590", "comment": "Malware payload (Heodo)", "value": "70c2f45d4e9340156c97c0dc05d670172ddb7e03", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657152, "uuid": "cf90ea15-5154-4160-9941-c6677681359a", "comment": "Malware payload (Heodo)", "value": "737d335f6554b4511af95880aaad698e439134cddaf129134488a8ed6f023ecbd75647ecfeb602b512eed61f55a9bb9c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657152, "uuid": "6c1ee0b8-8001-4697-9cc1-a1870f29db7d", "value": "T1EB04023EE5031A98C22ED8FC58EE6DF9D5F634006268063A1BA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657152, "uuid": "a87b7ce6-5f1d-4327-a3f0-93167e3ee5e9", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657152, "uuid": "3183fffc-bb17-40ca-9d6d-49a82f3f6c78", "value": "3072:Vpjft6Fs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VREi1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654657152, "uuid": "19173248-ded9-4c37-a359-1227cdb1f750", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654657152, "uuid": "9a9a1e41-a7b6-4b15-a15a-57e772d87ad7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657152, "uuid": "41c2d29e-15ab-4dd7-859b-635325685fdf", "value": "471718bf3dbf6de6799578d7562661a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55bd41f0-e763-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654717436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717436, "uuid": "dbf0130d-cff7-4544-86ed-6050b973fe32", "comment": "Malware payload (Heodo)", "value": "17d8e9070e5e432b7633e4a09ee5efbd", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717436, "uuid": "19633ad8-12db-4f98-a638-176d1f1eb240", "comment": "Malware payload (Heodo)", "value": "42de192e86acdd214e0a64ff6d09faaa1a110479f010c1c752808af5cc30bb99", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717436, "uuid": "bf5a78df-5935-42d9-9f3a-0b26a83a1417", "comment": "Malware payload (Heodo)", "value": "15b3ea6cc3d2535bcd476c9b4b2927f522210540", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717436, "uuid": "71463594-e950-4756-8ec1-f4e1804133af", "comment": "Malware payload (Heodo)", "value": "f94e4e4b5cb760e2f79c3645cc4551dd1a7f37624d686eb749c9bd8fcaa64ad4cf7245e2d85cee01fa8d262fa981b249", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717436, "uuid": "aa83f0f5-22f2-4649-993f-047982f0dfd9", "value": "T15C051947E77345FCC96BC97482A6A732B930785841397E2E4F80DB226F65F20953EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717436, "uuid": "3b8b452b-d09c-42f6-abee-c97579a9cfa1", "value": "733e4ccf9ef47c6e471d93270b5eb898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717436, "uuid": "60ea148f-35e9-484d-a2e8-66a214dbf4f6", "value": "6144:v7rc6Wk6SYnaKOai5uWLwrd0jSjc0vNPqBVzLFWhWUPV2m7hzS7583Tg7A+++ncE:vXcFk6SYna2Frd0jSjcc9SnmBZX0TMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654717436, "uuid": "4f4d5766-5180-45ab-8818-a203f5d93d5a", "value": 841728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654717436, "uuid": "a91a89b2-c376-4cbd-9409-ed68d94bec2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717436, "uuid": "0a78423a-e5c6-46ce-80a7-1e0e39de9706", "value": "17d8e9070e5e432b7633e4a09ee5efbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "657a163e-e720-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654688686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654688686, "uuid": "a491e90e-7d3d-4385-b08d-39aae68a7fbd", "comment": "Malware payload (Formbook)", "value": "7da04dc46171bc1ec53f1c141ed80e44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654688686, "uuid": "030b1fa3-90a6-4284-b028-a29d9df789d5", "comment": "Malware payload (Formbook)", "value": "4330d9c1362dfccf1ad5d79cc9329abe6f4a7685a2169b7e42de68a1b1e50b3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654688686, "uuid": "0a8fc078-098f-450c-9a53-5c86265c3e2b", "comment": "Malware payload (Formbook)", "value": "2c4044f32cfcabb32d1ab4df0467d0ccd3452105", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654688686, "uuid": "9d4df54f-b820-4d27-99ca-17c5721cd0e0", "comment": "Malware payload (Formbook)", "value": "220a5342333258c0569312b761becc1d6890c1592cb15bb43e52e06be140e5c47b030a9241b299327312c391d9d0faf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654688686, "uuid": "de591edd-5f19-48dc-b605-906f32bba3a8", "value": "T178B48C9C366C31DEC857CA72CAA45C64EA6074AFB71B9107D06309DDAE0DB97CF205B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654688686, "uuid": "48544200-fa88-4a88-834c-2eee20ae927e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654688686, "uuid": "09847a91-113c-4807-a083-cb42f7c88f70", "value": "12288:vSo2LqOfsr716/Hsnub8+aOifubgAz1W1BJ/icEqjXYxj14vhW/ObZ107:6o2Lh+6vsn48+DsBJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654688686, "uuid": "7bbd2416-9042-4186-b704-3bb865c42684", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654688686, "uuid": "1b881ec2-8dc9-4981-a69a-b0ef73e518ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654688686, "uuid": "2d9ffcf0-a204-41ef-998e-cf79e8ac278f", "value": "shipping docs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86effbaa-e76f-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654722673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722673, "uuid": "aac04121-5486-4190-a267-7fba202b4610", "comment": "Malware payload", "value": "e09a69ec488d55dccdc4f385ced44a25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722673, "uuid": "6278467e-67fd-494e-ba5b-f8125d211930", "comment": "Malware payload", "value": "43656b3aec1f1157f5f3bc34cad394d0653a74417a0203413066e57b39eb940c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722673, "uuid": "7d59a913-8a9c-4b44-be1b-92026c3ae58a", "comment": "Malware payload", "value": "2db5471c0bf2ca0ce5b2a6151c6cb97161348a85", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722673, "uuid": "063fe84e-a914-41e2-b8b0-f986f02edab5", "comment": "Malware payload", "value": "4cb2b9ca3cf231ee874c685bab03ba4564bab01ec686a449dd8d7cf144c440ca641f00714724044c41396bc96764d50a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722673, "uuid": "bb71627e-e1b5-4861-a59c-911e38a16353", "value": "T1D1447D00BBA0C035F5F712F449B993A9B53E7FA15B2490CB92E52AED56346E5EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722673, "uuid": "2d2c2d49-45de-4dab-842c-8c13447f4f04", "value": "3215fae786e72310b15953e12ddd6b57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722673, "uuid": "ce685b84-b349-4bd5-bd49-d1a1b9d54e61", "value": "6144:72IIVJzEzvUz3SZa9e3kY2ESJmLyV0Glu0KxkA:72lHGUz3SQQ3kY2pkyV0xP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654722673, "uuid": "b260f54f-eaec-4636-8d98-112a9eff94c0", "value": 272384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654722673, "uuid": "229d7af1-5314-42a7-a0a2-35cf83c9a365", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722673, "uuid": "c88cff8c-aa59-4eec-8e63-80b5ae5a53bc", "value": "e09a69ec488d55dccdc4f385ced44a25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad0d4007-e6dc-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654659601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659601, "uuid": "40169e47-f904-403f-bd2c-c51787e3c004", "comment": "Malware payload (Mirai)", "value": "135f64df6197cc0783256e825c55224a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659601, "uuid": "5a0d318b-528b-44b1-bf5d-c68b330e5c9b", "comment": "Malware payload (Mirai)", "value": "437312e7cf027cf8ee6b9f6f18fac62270757876240736463d046870e5436f71", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659601, "uuid": "cc89dacb-1e18-4101-b064-0c32370f1d84", "comment": "Malware payload (Mirai)", "value": "5729f589b0fa3fbd8d7faa875e082223dab43154", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659601, "uuid": "b9f5bcdc-11d6-408d-979d-cb3950bd5d3c", "comment": "Malware payload (Mirai)", "value": "e043053be6dc1e032427a5464bb73bceae8330f685b3a98b76b9c56c1a94ec01dc890e8ae0dcef684e4d2f457886fce0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654659601, "uuid": "5f0fc3bc-ad4a-4e33-8c5a-8b4664f81b82", "value": "T18F634AC5BC81A622C7C25677FE1F018D371957D8D2EA33139C2D2F60768B85E0E67A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654659601, "uuid": "4d063e0b-f0e1-49b7-aef8-93ffddfba1cb", "value": "1536:Yb6G6imMgIsfeZtQ9UKhiq/XC3WVAKuzvWLB8:o6dTfwIN/XJGHMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654659601, "uuid": "86bbfe8d-778a-4e02-b8d6-ba46f3b5ba82", "value": 71420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654659601, "uuid": "a195a965-2ef7-4a9c-aaaa-a6249e50d1a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654659601, "uuid": "de7a2890-0c88-4539-9dd0-cdf0a4dc6976", "value": "135f64df6197cc0783256e825c55224a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6a18c22-e77f-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654729652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654729652, "uuid": "d84acec5-10b4-4e89-bebe-41eb9884a349", "comment": "Malware payload", "value": "fbe8d761f9c4d752efd84c279e3bf1c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654729652, "uuid": "3f1ef9af-2b9b-40aa-b615-1409ad2e3cdf", "comment": "Malware payload", "value": "44e36f5dba7cae4389dd181c63237d22f38189f75ddee2f4c0eaf9427551c16f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654729652, "uuid": "cd6a3a2d-1c07-4f6c-9970-3a51cce23406", "comment": "Malware payload", "value": "5bbd0c2247121d68db77ede6463c8986502a577f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654729652, "uuid": "bb7f3f23-b19b-4c9c-b3d3-00dc0b115be7", "comment": "Malware payload", "value": "855a7e45ed7c509411d8f381b2c52f37acb92161254efd5fe19c8c17d93fe661b275f70d297a2b1a78a2c47167309018", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654729652, "uuid": "369b3f19-bf3e-4e51-8c9f-41212d8a25fe", "value": "T14BC4F0F5AFF478A0E0292133B454A13C3BE35D1DDC69A53AD68BF19E3492AC120F5A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654729652, "uuid": "836a6ed6-060a-4e28-a0d1-b034be2f16b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654729652, "uuid": "ab792253-a585-46b3-89dc-de92b8e1d720", "value": "12288:dNkZ2iN/I9qZWJ0DgArp6vCJi8LSGHYnpf2y5:81pIhJA5t6vT8LzHYpf2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654729652, "uuid": "8e923901-747e-40df-a54d-6012abd5542c", "value": 575488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654729652, "uuid": "5e2638a1-6f0a-46ab-bfd8-8fd42dfbaae7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654729652, "uuid": "444b103d-0f1e-4188-b83c-3143abf7460a", "value": "DHL-09-2022.pdf..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ad782a7-e705-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654676992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654676992, "uuid": "62777406-40d9-489a-8c8c-75b299d83765", "comment": "Malware payload (Heodo)", "value": "a6ccbf04a5c0a09022c1176fa061f257", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654676992, "uuid": "bfef0996-c057-4764-bcc7-952a6f82d4ef", "comment": "Malware payload (Heodo)", "value": "450e20a1ac60f7936a8e39bf3338afd3254e484d1b6db9e2dd729d904e2ea6cf", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654676992, "uuid": "f8a510bb-1da5-484c-8b68-c27c26c64e68", "comment": "Malware payload (Heodo)", "value": "1cea72b7fa0bd99fb74d03caf59cff15f41b9618", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654676992, "uuid": "7e3874db-1046-4fb6-9a36-4126c2bb81e4", "comment": "Malware payload (Heodo)", "value": "80e36a7dfb80ffa30f47220b05d10aa08693f9695fe9a89a4f71fbbe722e81d1c85e1fcd5e70ab403c94f3be43e702f5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654676992, "uuid": "7262dc2d-a35f-4ef0-b9e1-218d64206540", "value": "T17944C089A7E1ADDBD51407798DD6D324333EF2814B838B076B2598390F23BA4BFC5A45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654676992, "uuid": "4ad8ab2b-51fd-4d1c-a310-e0d1d766ad7d", "value": "963f2e88a5b03877d0583808b2526c1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654676992, "uuid": "1a2c834d-65b0-45db-901e-c86ab9e0cf20", "value": "3072:7R7he82w+Oh+UjuFJrfr7CS/FmikytkqroMdjaWtHCqPZ4PEx2ES2vZg3f4L5ZJi:7lMJuk4uFxOmFwytLVxDtfPZ4PE2sPs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654676992, "uuid": "8a078109-bd6f-4cf5-8345-903cffd3f252", "value": 270403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654676992, "uuid": "fcbfdd35-9a4b-4b5c-9c03-9dc4a97035c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654676992, "uuid": "688d6f99-0ed5-48c9-a82f-76f6eec0d87f", "value": "a6ccbf04a5c0a09022c1176fa061f257", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93d37ba4-e76c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654721406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654721406, "uuid": "71ab156b-6684-4dfa-b49a-362e7b022c8a", "comment": "Malware payload (Mirai)", "value": "0f35301e8efe8a59965b2a64a2d0efcb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654721406, "uuid": "b264c26e-98f0-42de-a68f-39a6c20897ed", "comment": "Malware payload (Mirai)", "value": "45441d85b1c6341229378d6fcf90af92ffe79531c16e4df70025eade85c91615", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654721406, "uuid": "89672fcd-1bb1-48d4-8487-fb1eb7195a82", "comment": "Malware payload (Mirai)", "value": "551bce3c3cb20cd024659e5336e39649634f0aff", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654721406, "uuid": "edc10641-00c9-4436-8cf3-f434c1254251", "comment": "Malware payload (Mirai)", "value": "7fce1bdb92242a488904732f5837a6296b97b5d2ff644ec9a5c3cf2952031a00dd1a54b5382a7aa7ced1b3a4aeb4831c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654721406, "uuid": "1ffa7edf-6c4d-4981-afb2-a39a6218e9fc", "value": "T1D06319827C80AA26C7D0177BFA5F108E3315A7D8E1DA73478C142F9576CA81F0D6B79A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654721406, "uuid": "42124c6f-4218-4ce9-81bf-e137fb6433bc", "value": "1536:at/LYbUxYVUUO03k704oVLMNKHwbKnJeZWovjHJkKsg:at/LY0bKJwpvj3h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654721406, "uuid": "93a133cf-b38e-4ab2-bddf-00fe02d4fab3", "value": 70468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654721406, "uuid": "bb4f27e8-824f-4815-8167-c21761fa43cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654721406, "uuid": "67b513ab-aa3f-41e9-a653-8f932ba0bbcc", "value": "lessie.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a98595f4-e73c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654700826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700826, "uuid": "7387a577-ce06-427e-9690-e953710789f3", "comment": "Malware payload (Mirai)", "value": "c8b328941368480f91d7d9dd407080b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700826, "uuid": "93ceb633-9667-4d0b-884b-d69c2b0e8011", "comment": "Malware payload (Mirai)", "value": "45455a77ac4a645d974b0712cfbd32263022f9fc8a78963bb9c199c850fd3809", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700826, "uuid": "0b8fc850-1005-4140-ad95-39629d818d47", "comment": "Malware payload (Mirai)", "value": "9fbb871747fc0bbd64effa2cd4c0d2c950f43ed6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700826, "uuid": "aaa5894b-6df8-4e14-98c5-ac91bf515e40", "comment": "Malware payload (Mirai)", "value": "36f67943d8a9faa74d1c106a7ad013523d95816b323f83331cbd9d3f8b5a442f38cfcd4ae007740e205c3281b585cd4c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700826, "uuid": "25959d43-f722-464d-849c-a2d8bec5f653", "value": "T11CE35C46EA808F13C4D517BAB9EF414A3332A79493DB730699285FB43FC665F0E63906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700826, "uuid": "d8c04d7e-7e70-415a-abd7-412468814f99", "value": "3072:ABHtBjgHD0HQkKJKarl2hyhYv06sb0cwwR63KxUXnOOSUuL2w3hM/9FY93KsO:ABHttgHD0HQkdapey4e63KxUXOO42wx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654700826, "uuid": "d2dbb841-63ae-417d-9c34-b09e3a8dd184", "value": 156768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654700826, "uuid": "7941b14c-058c-49b3-adae-205e1694a7c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700826, "uuid": "c62e5384-ca2b-4445-9cd7-e58bfed9f929", "value": "c8b328941368480f91d7d9dd407080b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f11a31-e700-11ec-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1654674938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674938, "uuid": "2d0da694-1072-4c81-84c1-5a79697b63f3", "comment": "Malware payload (SilentBuilder)", "value": "2e81d91bc590b987d4e5c5f688c61401", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674938, "uuid": "62ae3753-c133-4a48-9564-c1b49ad4ffdb", "comment": "Malware payload (SilentBuilder)", "value": "45bf4d782eec15ce22609f4ff3cfc73eef77095fa856ebf141ab59957afd9032", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674938, "uuid": "03cb9f73-a5f4-495b-8f76-bf10660bf8da", "comment": "Malware payload (SilentBuilder)", "value": "77238e6371566024f3dd73c639b1b8c20c8ffc11", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674938, "uuid": "fe426d30-de3a-4bb1-8824-83d10b806774", "comment": "Malware payload (SilentBuilder)", "value": "e5d670a8c8348593ecfbdd9fd8f2dd485821e1521bbcb4cbdfe5f8fe0c6c8d768dbfc70e21d81931718705875786b75d", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674938, "uuid": "80749096-e372-44da-89ed-cc5f062f0617", "value": "T15D23A446BB5AC85DF914873448E747AA7323EC314F6B0B433669B3256FF89A05B0315B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674938, "uuid": "d91797bb-efb8-44c1-b01a-d42ea9e8f3e2", "value": "768:pDMPKpb8rGYrMPe3q7Q0XV5xtezE8vpI8UM+VQTUs77quK7KtGu6g:pYKpb8rGYrMPe3q7Q0XV5xtezE8vG8Um", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654674938, "uuid": "65f7f4c8-d66a-4dcb-a733-a814953c0b36", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654674938, "uuid": "ec7100c8-3f80-4abe-8919-7afb6de73028", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674938, "uuid": "f1b023c3-5127-4521-979e-36af61512747", "value": "Rechnung.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "037a3f57-e70b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654679503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679503, "uuid": "c588e7ff-f9cc-46f6-9536-adc3c4d03589", "comment": "Malware payload (Heodo)", "value": "88cd7646eddb5f2b123b6961609e592e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679503, "uuid": "6db0e2d0-ece6-4d18-aa83-9a4f9909e5b3", "comment": "Malware payload (Heodo)", "value": "45fe8aa372640dc55073b96173426470792c8a6873222ca253956dfa664434e6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679503, "uuid": "324998a7-98e0-49b9-a66d-d9e20c4bcdc5", "comment": "Malware payload (Heodo)", "value": "31b90234d75813855016bc2fe17b46b6462d15e4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679503, "uuid": "b40934a3-913c-4712-9d58-32cdeea88bda", "comment": "Malware payload (Heodo)", "value": "21c357fd757aa9ac87195e0adcf32955a76040eaa02278ce8ae1c53f5fc4e1fdaa6b853fda2599aa563fa7b344ddaed0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679503, "uuid": "31557604-7c72-443d-b85c-4b90af5f9518", "value": "T16044C089ABE1ADDBD51407798DD6D324333EF2814B8387076B2598390F23BA4BFC5A45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679503, "uuid": "ca1ca5f3-9b0b-4bc9-a206-65ee797f5c0a", "value": "963f2e88a5b03877d0583808b2526c1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679503, "uuid": "6590d943-79e7-4775-a61c-273f1fcb590a", "value": "3072:7R7Je82w+Oh+UjuFJrfr7CS/FmikytkqroMdjaWtHCqPZ4PEx2ES2vZg3f4L5ZJi:7lEJuk4uFxOmFwytLVxDtfPZ4PE2sPs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654679503, "uuid": "306a7390-4e84-4d44-a80f-31883ce7a7f3", "value": 270403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654679503, "uuid": "f5eff819-cf42-4237-b641-17d8d48e6eb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679503, "uuid": "50b52d00-dab1-4f53-bf53-b9f39c7aeb0f", "value": "88cd7646eddb5f2b123b6961609e592e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "175f9902-e6fa-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654672234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672234, "uuid": "f5d55ef6-2a1a-4c96-a347-d442d650d57e", "comment": "Malware payload (Formbook)", "value": "ae4ff895012e1f6266adbd976d74ff57", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672234, "uuid": "ef8482ea-ce8c-44c3-ac2c-f96e04970e49", "comment": "Malware payload (Formbook)", "value": "4677020f17b9de0f4df993ca999235f0f738ff98b24e7aa2ca46bd83d6535787", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672234, "uuid": "50fb4689-d79b-4ee1-98e5-1ab742e1ee87", "comment": "Malware payload (Formbook)", "value": "fb4da19d70cce4f65541b57181a61c337f3659a5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672234, "uuid": "811f9b68-f1e3-49d8-8fd1-8345910c24a7", "comment": "Malware payload (Formbook)", "value": "9161922ff2113edf01c727e1f123dc560bce1cb277892b838f4efa92d2fb471d7f3a4b3ca851db0fae784f17001273c2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672234, "uuid": "46930cda-7f04-44cd-9f11-75a495eca37e", "value": "T1F68412453F998763E6C793F617A0E42B1E03EF007A9ED9097107730A9A39B452FE9634", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672234, "uuid": "84dda9ee-2f04-4310-ac4b-4d6ec01eaeae", "value": "6144:gUjCczn44LAntiLuuePaYYc0pbOw5+GFCNLans2L1GNVeLUpY7rhoUSLt:7znZAnsLX07YcPw5+GFCN2ns2L1GN4C3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654672234, "uuid": "25a6f495-5ee5-41f1-9436-e675ca00aa7a", "value": 388440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654672234, "uuid": "3034f64d-688a-4202-ab6d-15f70f0a032b", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672234, "uuid": "9b5ea2f8-f758-4959-82fc-56f282709b40", "value": "swift copy.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cd2539c-e776-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654725689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725689, "uuid": "a0707c78-9238-41ca-88cd-ebb79050177e", "comment": "Malware payload", "value": "d269a067220e167882e8235d4cd172a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725689, "uuid": "bc8ca181-28a2-4cfc-af13-408ab4115048", "comment": "Malware payload", "value": "46ffb95959577806be159b809f5d867091640ddae7143ebf062ee707de85e06d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725689, "uuid": "87c55184-4654-4e1b-baae-c498bf71afa6", "comment": "Malware payload", "value": "706d2c3b6cabef702cf2bb247e6a34ac06881ce8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725689, "uuid": "59397bff-c6f7-4c97-9d93-8d8d3b7c4bea", "comment": "Malware payload", "value": "ccf91efec13eb42a28a6abf5d12c0dce3f8d0c253f6d8b1040cc03113d51998abc737d4e3fc18777d5703002b0d289c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654725689, "uuid": "c6839d33-01e6-409f-a58c-4a090b49d26f", "value": "T1CB051947E77345FCC96BC97482A6A732B930785841397E2E4F80DB226F65F20953EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654725689, "uuid": "67a4afbf-a1ec-4286-93c7-ea3e38acde17", "value": "733e4ccf9ef47c6e471d93270b5eb898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654725689, "uuid": "9d564e10-2ed6-4f14-9bde-42e048a51aab", "value": "6144:v7rc6Wk6SYnaKOai5uWLwrd0jSjc0vNPqBVzLFWeWUPV2m7hzS7583Tg7A+++ncE:vXcFk6SYna2Frd0jSjcc9SWmBZX0TMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654725689, "uuid": "70ac91e2-641f-41f8-99f6-1e5e9f17a7a6", "value": 841728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654725689, "uuid": "01d34f31-9d4c-4790-b11c-677e37c0236c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654725689, "uuid": "39d8e033-ff89-4fb8-80b4-4d040e1fef3f", "value": "d269a067220e167882e8235d4cd172a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4e6d619-e745-11ec-93bb-42010a9c0043", "comment": "Malware payload (Quakbot)", "timestamp": 1654704711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654704711, "uuid": "a693ffd5-61ae-4992-95fb-8d32495efc32", "comment": "Malware payload (Quakbot)", "value": "beac666ab8f322af88acb1430ca3b84f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama187", "colour": "#0BCF63", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654704711, "uuid": "4ca62f6e-9369-464a-91c9-b0aa4f077c86", "comment": "Malware payload (Quakbot)", "value": "47999e5dc10c968442c74422ad503bf77a54ed8a3ebed9a2bc5d294919036658", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama187", "colour": "#0BCF63", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654704711, "uuid": "423f7701-7b0a-4cd2-af74-f7c1306a9c55", "comment": "Malware payload (Quakbot)", "value": "9356abc59c6d722f5884a1fec878bd004d74b9ab", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama187", "colour": "#0BCF63", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654704711, "uuid": "4c4a319a-c5d2-43d7-a9ce-f6a56f493b8e", "comment": "Malware payload (Quakbot)", "value": "6d9d8667b256d7f92d4fba927b8fa2e44edd2165f6fc3216dd059861a090ed7aeee20c65bc63ba733dca21c7e9a22907", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama187", "colour": "#0BCF63", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654704711, "uuid": "a35d1b38-72f8-43a5-b68c-d6a0e694a7e7", "value": "T1AA05BF22E7D14836C2631A7C9D6B776C983B7D102E3998C76BE81E4C5F392803B66357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654704711, "uuid": "c4329b0b-3111-4e51-8d11-3b2676b78b85", "value": "92046417fe46b0698ba7913a6f0e3563", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654704711, "uuid": "f5a9dc52-3236-4d27-9724-22da3097e33d", "value": "12288:bHA5sfLt6JfZPR2r7E43UDeXoMyvgulzMyvgul:02fMJfNwEhqny5Wy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654704711, "uuid": "8255206e-cc43-404c-9433-e6b79ad9d7c2", "value": 863232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654704711, "uuid": "f156de21-f8bc-4bff-b82e-b7a30528316c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654704711, "uuid": "7276f691-0b88-4d1e-959c-c39088302164", "value": "local.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45689cbd-e703-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1654676177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654676177, "uuid": "9ff111dd-d451-42de-b575-851d5a71bcca", "comment": "Malware payload (GuLoader)", "value": "6eeb2e99997b286dfc4335be57008279", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Femkamps7 Efform1 alchem Hensigtmssighed7", "colour": "#B08E4B", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654676177, "uuid": "1a20b94e-c06b-4da9-9ee2-5976916d7499", "comment": "Malware payload (GuLoader)", "value": "4831677bda2a51addc2734e1a2c8086ab4ac72ee44bc3630f7bc2f6c04d16e25", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Femkamps7 Efform1 alchem Hensigtmssighed7", "colour": "#B08E4B", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654676177, "uuid": "ef4c031c-9291-409c-825a-067e6328b599", "comment": "Malware payload (GuLoader)", "value": "615166a3d42464328975ba8c2aa23a0568fcfe55", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Femkamps7 Efform1 alchem Hensigtmssighed7", "colour": "#B08E4B", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654676177, "uuid": "8d38c1fa-ac3e-4ad2-a2a7-3c8d870a8f9a", "comment": "Malware payload (GuLoader)", "value": "bbd0b5916c84d74b0d09c598e0313f8b2397518367fa05712b421672ff9b7f2ef7d4b9cba2a4d933defa87753989fb42", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Femkamps7 Efform1 alchem Hensigtmssighed7", "colour": "#B08E4B", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654676177, "uuid": "477e9caf-7f9b-4607-ad4e-9021cdd1728a", "value": "T15D9423D4ABD5589D00F76601412DE49AC74C8FBEB4234F258FA6EA20FDD106B9EEC427", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654676177, "uuid": "215b081d-2a27-4de8-a403-5041ad9980b5", "value": "12288:NRCgTZGDNOMSQebSRQTxeGxJhRrzXoFU+++Es:NRCgVGREQaSRQVHxJhRHjv+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654676177, "uuid": "7626be7e-dcc3-4af7-83ee-cbe28b5ad348", "value": 446485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654676177, "uuid": "29b3d766-11f1-49fb-93e5-ee2c42697016", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654676177, "uuid": "d370316c-6da7-4f98-942b-f9f650e7ff6f", "value": "2901365211- EC650SX3-36AT.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b8df13b-e734-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654697340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654697340, "uuid": "76eb0578-28e9-4af5-a898-27a77bcd9775", "comment": "Malware payload (Formbook)", "value": "20bdb6ab4a258a72acdc607d14d5025a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654697340, "uuid": "147ee7cc-11bb-4a93-bf92-965ae978bf50", "comment": "Malware payload (Formbook)", "value": "4846993450894da0e6539fc7e6ee47408308997880fbe3d25e412a5b054022e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654697340, "uuid": "1b6b20a2-6481-4ac6-a4bf-bca6b31a1d06", "comment": "Malware payload (Formbook)", "value": "1e4a0bd4e1d93eb9e798f377fe65566d94a2ca59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654697340, "uuid": "d9278b1e-5a1d-48a7-abbf-372ef99e3c1d", "comment": "Malware payload (Formbook)", "value": "42fc60edc7450fab0618ca5c11d717e0f2206ac45c43d3ea0c02a8e2d3ec74bd8a09fe4ff13c1058d35ebbb53f5f9691", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654697340, "uuid": "8e368127-ed75-441b-a80b-8d540ba6f1e4", "value": "T196F4E111B6A7CEF2E2E90777C0E24510977AD185E197E71B325803E9AE433DECD0678A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654697340, "uuid": "a040ab5d-0d82-4bb8-b61c-ebe132aeeef1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654697340, "uuid": "ce5e13ab-fc63-41f5-bf12-b2c2d963138d", "value": "12288:UD+PTjqtKhUdGhv9qrzNOZ5Hw+L+Qs2juABQNsxZ/3uQanoCF7:YtKhUUhvINURL+QuABrZ/eQanoc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654697340, "uuid": "28d8042a-8491-4811-81d1-c0dfbe58369f", "value": 770560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654697340, "uuid": "85be2a83-748b-456c-a862-f8c91a5ea9d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654697340, "uuid": "f9e96bc1-2a37-42a8-b333-6f5019be0432", "value": "PO #25997.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c72682a4-e705-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1654677254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677254, "uuid": "99afbbe8-c75d-4c1a-a32c-dd86c36d8fb8", "comment": "Malware payload (SnakeKeylogger)", "value": "b37830646fb5cece9aac6b0cd503e96d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677254, "uuid": "86bcd0c4-f7ab-450d-94ba-c5f4fe145167", "comment": "Malware payload (SnakeKeylogger)", "value": "48c7dfbe502fcb0608141510f4e3be68c8132fe2919301d22bd10c520158f8a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677254, "uuid": "ccc438d0-cdaa-4893-a6b6-3ddd31282950", "comment": "Malware payload (SnakeKeylogger)", "value": "62795f4b1cdbc1213c1fe6b92a8e0555b16766d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677254, "uuid": "cb7fbb7a-2d9a-4ce6-a3d9-608881ca671f", "comment": "Malware payload (SnakeKeylogger)", "value": "b7188395af176c20c6a7164140a2b801c0165f347c96baec2dda5992171c3a2c5950e34a2e7304c4895545d720e199c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677254, "uuid": "29c59060-fa53-4a73-866e-fb4a862c253e", "value": "T170E47B233AAC6B5FD2289271B570467046F1EF032461C69A3CD4EDDD4AF1F0E4B616EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677254, "uuid": "1405d941-a4ea-4466-b7c1-48bf1b9ee986", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677254, "uuid": "b62ba52c-99c2-4ba3-92fb-713094f57ac6", "value": "6144:rdOvXdYAomXk1XLmCzK8+KICoqxn4Jb1XXiV3ZlJb8GV7g2lZGSDpiV6N1H/rMSG:ROBoZzl+CN6XYt8GVUsGUYSs/FWTN5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677254, "uuid": "ef2ee7af-2b24-48b9-b637-15e94fd63bba", "value": 674816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677254, "uuid": "5f6880f3-d765-4677-beb0-17eb7bf15a3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677254, "uuid": "a8417188-8da2-428c-aa50-56cc20cf96d9", "value": "b37830646fb5cece9aac6b0cd503e96d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e51b13b-e712-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654682635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654682635, "uuid": "4b446e8d-fa69-4871-b6ef-1a01654c331e", "comment": "Malware payload (Formbook)", "value": "92211f235250386fb795a99b1eac644f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654682635, "uuid": "2b9fa977-3dee-4644-a154-b6a07185bfc2", "comment": "Malware payload (Formbook)", "value": "49958e9bc0881051e13e707be2515d462632903d3d243be7be890b5eb09ad7f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654682635, "uuid": "503bee49-cfc2-4e8c-9590-e21e29bed741", "comment": "Malware payload (Formbook)", "value": "2befccd562dcd1261fbf2d4a564939e6d675541d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654682635, "uuid": "01d5389d-20c5-4a26-bf14-24165e059cf5", "comment": "Malware payload (Formbook)", "value": "d9b5bbdb943dfcff82fae3e906049b37ec3e889a222a099fba58fc2ce02cdbe9c1d0c462e219af6792f3b1f78634087b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654682635, "uuid": "628678cb-b22f-481c-b606-9e0c64b78279", "value": "T1BA75CE05B360E74BC226B33B1964F73912661FD6BD12E7609935BAD33C623808F65BD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654682635, "uuid": "cdb6d4c2-cb8a-4944-aeca-233b6ac6313b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654682635, "uuid": "a2b23b1e-7888-4ec2-984c-00d54bc71e6f", "value": "24576:CtUk2BxUk4g6Va6GvxhlbQF8yl5fq+z5fq+sOT75fq+W5fq+tJX5fq+z0sz5fq+w:Ctj2Bx9R6VAX0jTrOEIZJVXG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654682635, "uuid": "0b4aca68-a52c-4b07-a885-d30475275a44", "value": 1603584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654682635, "uuid": "5c08c9ef-9bbd-49c6-bcfd-9e3d97d53d01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654682635, "uuid": "d4d6430f-410c-40bb-a32b-eb92cb610c1d", "value": "SecuriteInfo.com.Trojan.PackedNET.1372.9978.12117", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d25e2089-e705-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1654677273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677273, "uuid": "be81ed32-283f-42bd-8426-5ba9a98a5083", "comment": "Malware payload (SnakeKeylogger)", "value": "fe0ae2a043b5ef672f65faaec3eb1cb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677273, "uuid": "5f587c3f-2983-4b77-a0a9-548cb39a0ef3", "comment": "Malware payload (SnakeKeylogger)", "value": "499d8a645fe7128120c1556160890616ddb8f94da3c6807023da2ef5f257d2e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677273, "uuid": "99475371-b7ba-4edd-a5e6-7ef7d6658b9c", "comment": "Malware payload (SnakeKeylogger)", "value": "de7f5b9ac53375fffb0919493ad58daebc177be2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677273, "uuid": "cc078f4e-40ce-4dc9-9e84-fe0fb92f90c8", "comment": "Malware payload (SnakeKeylogger)", "value": "0a59cdd50145a028431cde03cd5a5f8afe8d458e42234315f996f45b110b935e5984d24a7d030a3241b6bef042deae97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677273, "uuid": "d7ca525d-9194-4d26-ae66-0ea6b0b825e0", "value": "T1E1F44A4E7B86D9CAE800EB75DEB31B601A68DEB61C591317E3A9362EC03B7B41D40717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677273, "uuid": "59e13e42-3dd3-4513-a474-620b878c4d74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677273, "uuid": "ec5a5542-42f2-4232-a86f-3283050fc1c3", "value": "12288:3ukH22qla5w/yXbxfNzCg5JpmldFUAimKb:3ukH0MW/IbxfUg5JpmUp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677273, "uuid": "6fe7d5ef-a44e-492d-8a08-06a536c48f85", "value": 764928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677273, "uuid": "60f032bd-4f63-4317-a298-bf55b4fde926", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677273, "uuid": "08a46015-a245-435a-8dfb-7e93afb54249", "value": "ASENWARE REMITTANCE ADVICE-1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03452d7a-e6cc-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654652444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652444, "uuid": "7d1ef31d-3db6-41d8-a1d8-4681962d6f58", "comment": "Malware payload (Heodo)", "value": "a11f8d69fb487c55b1f6bf232f9123d0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652444, "uuid": "4b1dcb1d-890a-4054-ab45-d06a1d06d287", "comment": "Malware payload (Heodo)", "value": "49bb5272a0d0c25302c77b225f0415498ec7e5f9527866fe93ade22307164a00", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652444, "uuid": "a3e47152-5637-4a08-95da-cd160327fc91", "comment": "Malware payload (Heodo)", "value": "25e84e06b52c0decda531c3acd909fa420569f8e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652444, "uuid": "6f8bd792-9e59-4a5e-8df1-ed461c337669", "comment": "Malware payload (Heodo)", "value": "04ce884fc174f6da77bce82db6c8e45f435ebbc073a51f16ff1eec6f32e54b4beec6e318305db97049dd1b18e4a29c72", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652444, "uuid": "e7868632-cafe-470c-b97c-19562b0237d9", "value": "T1FD04026DD14C05DDD611137CACE90F3392FCF980A0262B5BBB70A6774BA4B96DB5B900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652444, "uuid": "6e6f502a-8859-4107-b8d3-7e9dbf8590f5", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652444, "uuid": "d14d9f4e-333b-453e-9580-6d47862f7b01", "value": "3072:rpjfFFcO4J8FYMh1PAzu8GmeR8dk5pL/rRn/02QBgjVcoe5Uy5i6zNL4ZNgzPKcQ:rRtWW6u8QKkXzN/09gjV/eey5/NsAziz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654652444, "uuid": "0c338a03-a243-450f-9256-073fb3a7c3ea", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654652444, "uuid": "d23fe8db-6290-42a1-92b8-c1601d27e3b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652444, "uuid": "08a99240-7374-4971-950e-1a95c0a1f562", "value": "a11f8d69fb487c55b1f6bf232f9123d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60dc4887-e738-11ec-93bb-42010a9c0043", "comment": "Malware payload (hydra)", "timestamp": 1654698987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654698987, "uuid": "7af9f726-579e-4620-a6b3-0015854ada80", "comment": "Malware payload (hydra)", "value": "53f04e56619e4e51f796e3d5185a2932", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654698987, "uuid": "ab7089d3-cd7e-47f0-8055-4b35a733baa2", "comment": "Malware payload (hydra)", "value": "49bc43a5b94d4a24f5561a98e3feac970fa37e9922a892f72351d5e94d77bc4c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654698987, "uuid": "88b4f09d-b7e6-4acf-8329-1831d8bd889d", "comment": "Malware payload (hydra)", "value": "86257b0d6154ab621726e97d35e0d8004604a780", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654698987, "uuid": "1e85d69a-ed06-49be-8aa9-b81b0d83f9c9", "comment": "Malware payload (hydra)", "value": "3546ec79f627a7af5ff799db7f6624606693f83b68ffdb5f0d0568687e0720ee2e9bf40b68fe9b59dff6eea6c5a75ab6", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654698987, "uuid": "161baa4e-a55e-4d56-9885-82ac2e785a13", "value": "T15A27127AF75D6D0ED837B0B18EE9187500B91C20E7765B126EA8B33B56334886F61BD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654698987, "uuid": "b3d1e089-cb9e-47ed-958b-6f23fb075b0e", "value": "393216:JlBzjs3PGxwpVolP3eVNqh53vK2y3R082Edt51D1nfE6r3ZdF8pPINu31dX0ZaTE:JlBPseRP008Jd91l3ZH8pPf31Z0Zp3/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654698987, "uuid": "d55ff93e-7dc2-41c6-88aa-812388d68a35", "value": 21947465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654698987, "uuid": "b850f316-8cbf-4c4e-81b0-00d146bfda57", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654698987, "uuid": "8d8a5460-3bae-470b-8527-3d53ae8b34e7", "value": "Document Manager_8.8.4.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67e16c99-e710-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654681818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654681818, "uuid": "dfb07e48-e660-4ac4-a04e-14ea76c5da3d", "comment": "Malware payload (AgentTesla)", "value": "0d5a344849daeb333e0c30758540d424", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654681818, "uuid": "73c559b3-9356-40bc-8ce1-e2e102205573", "comment": "Malware payload (AgentTesla)", "value": "4a6fd916d6b46a2edddcb8b0a9c47bc81726548a88b507866f34e121dcc6bc66", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654681818, "uuid": "6e2bcc4e-8ecd-4a10-8bb6-c3295686e10d", "comment": "Malware payload (AgentTesla)", "value": "9a64a072c31237a340ae23e1415d64e3ac0bcc2b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654681818, "uuid": "6960f5bb-80df-4e15-9983-2041417500e0", "comment": "Malware payload (AgentTesla)", "value": "4769bd787b84e1d27821f540a487830d2bf3a86cc9fe5ba03bafea53644ad13246b8cecf7d8e12065610c9e7253fa4b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654681818, "uuid": "0cd46f4d-5f2e-45cf-b46c-ab032bb479a9", "value": "T194E4C5D5B20D6D8DD832C7F68531DC3952272DAE6636911B40BB7867FEFA2834D20863", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654681818, "uuid": "fdd192f6-6772-4915-9373-8ae85e0823ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654681818, "uuid": "0fc6f2dc-8404-41a1-8cbc-1058061d3a39", "value": "12288:4HWN0HXlsgPXNJY+2bqluUY5PR+J9okNjwYXszFYTFEar:cu0H1TXkXbWuUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654681818, "uuid": "bdad4fa2-c12c-4a4e-b8e9-d2d18e3ae570", "value": 708096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654681818, "uuid": "d397385f-1a4c-4111-9a93-923572fbb5da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654681818, "uuid": "b1963dc1-20bf-411c-bae6-4b123f973550", "value": "0d5a344849daeb333e0c30758540d424", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "704b342e-e76a-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654720487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654720487, "uuid": "8964f889-5867-45a0-8ea1-bf291679a36e", "comment": "Malware payload", "value": "57a430db3a36380fc43a785dcc9dc193", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654720487, "uuid": "051c300e-2e8c-4784-978c-bf75939927a1", "comment": "Malware payload", "value": "4af18548473d4d52ae16e402b3f5a780de5e7b9fe9a0e7f555ea0492ae82887b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654720487, "uuid": "4f8f2c49-20eb-457b-a69c-282a4522c53f", "comment": "Malware payload", "value": "34c8411a5a5a17d6abbe4b5de7b844a4dad10890", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654720487, "uuid": "ef008be4-6b03-4ec7-9794-72024efce75c", "comment": "Malware payload", "value": "c7dc9c8dca537f4879d4f522d84892ee224ca8b02201bcf3da1f793aeef981186e922f12be3fa07ce40c21907048434f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654720487, "uuid": "6b2775e0-4f8c-48ac-a062-4d108e6706e6", "value": "T1678533119D860F9BC7AD94B4DCB2542C0294BD6CAF8168BF6298776F23BF32502D760D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654720487, "uuid": "e665c68d-4e5e-4a05-af59-2d619e9bec54", "value": "24576:0T1XLkYood3b20nqzGf/xaPh0jbliJ5fn9o483syZHYWA1dn42KeI929OyxVTqRz:u1bUcbGjWbligud4DZlvpSJWv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654720487, "uuid": "e6305813-3a20-47cb-8011-910b1c9e4a52", "value": 1865728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654720487, "uuid": "0d57ade7-c90f-4b61-9d31-fef77097434d", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654720487, "uuid": "e215d2e7-af14-4ff6-9df8-805611a79716", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.18429.22976", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9092f4b-e70c-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654680237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680237, "uuid": "68c618c5-a051-44b6-b73c-f627a2b75a26", "comment": "Malware payload", "value": "b6bb67d219463cbfb3897d2d6146d13b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680237, "uuid": "84226741-4193-474d-b505-b07d493957f8", "comment": "Malware payload", "value": "4b5e4486d5142ef4acd0ab6c0e9d9aca3615993f8312f2ec9e3617f8cf966aef", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680237, "uuid": "f1552d46-dc51-46c0-a4b0-37ca3dc96836", "comment": "Malware payload", "value": "c0c8bedd1420d0a9b6f1f23069268ca8cbc57601", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680237, "uuid": "23599f5c-9d7d-4cb8-80c6-8224ab24a3f9", "comment": "Malware payload", "value": "b6ad111556381c429c61e0f41e60b2f2299cd85a6f84bff4d6a4b06c7a07edd46fde2ca1b6873cdecb97d114eb5cebc7", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680237, "uuid": "65f1b2d2-8031-4878-920f-2ce8f4f55acd", "value": "T119266C16B284A13ED0AB1A374937D668A93BBA713A23CC1B1BF4494C8F355417F3B647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680237, "uuid": "4f82781d-2652-4c76-b6d9-220e27e49a8b", "value": "98304:mHNgn1rC632itQQxhJ01uJso/WHvz/XOYiA:mmhC63BtQChJ0kJsoyz/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654680237, "uuid": "58926f2e-e290-4b42-9601-0dccc5d8732f", "value": 4802048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654680237, "uuid": "27a258a6-831a-4aac-a56c-f942fa951106", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680237, "uuid": "217a431a-24d1-457e-9e4d-17c4f50eeea5", "value": "NTFS.Iplace.AppleProdutosLiberados05062022219.MSI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f192692a-e773-11ec-93bb-42010a9c0043", "comment": "Malware payload (SystemBC)", "timestamp": 1654724570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654724570, "uuid": "e2a9ee26-6f90-4533-858e-dbaad6201a5e", "comment": "Malware payload (SystemBC)", "value": "7369756b998c690d8a2b7740a574c274", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654724570, "uuid": "42e97495-2e81-47ae-ac13-2a4e05d477f7", "comment": "Malware payload (SystemBC)", "value": "4ba198c54eb157e1ec0b515c241d7c306d58ef915ab8b24339ace5e00b1a348a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654724570, "uuid": "5b9b10c5-a761-4e39-836d-6fe39237d18c", "comment": "Malware payload (SystemBC)", "value": "fe58cb87bb8e5c148a4a571cf7a0711ef7218568", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654724570, "uuid": "547c56e2-3d22-4d1e-ab62-fb2825c81e02", "comment": "Malware payload (SystemBC)", "value": "62dc52099ab92c98bd0f627073883638dfaeae944808596d39148f0c2a14ea013b7732d6fbea7d33e7dd882ffad769ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654724570, "uuid": "aa1b7037-8a34-4fde-befa-4dc090470baf", "value": "T14724AD2277A1C371E0A31534B875B3B11A7FB83266B5848F6BB4272E5E302C19AB5357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654724570, "uuid": "d96b4ab2-783f-4863-bf32-8f660a8b2815", "value": "ec96dbb607777414f4c78c81ef4029da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654724570, "uuid": "ab96e120-a756-42e7-83b5-984d11d29a42", "value": "3072:VZvf4jNn/GaRKNOzRwmXrCsvOG8yqMgEAOwZAoNr:voN/Gac4zRtesvOeqMtuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654724570, "uuid": "4a82ed41-b9bb-4abc-b15b-0d81203befd6", "value": 213504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654724570, "uuid": "f37e2c42-b26a-45d8-a1cd-d4d427a7f150", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654724570, "uuid": "9c749eb9-9e02-4073-acff-0afb51401ee2", "value": "4BA198C54EB157E1EC0B515C241D7C306D58EF915AB8B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7231c1b3-e6f1-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654668521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654668521, "uuid": "473f3840-eba3-48e1-9a9c-0ff6335f8132", "comment": "Malware payload (AgentTesla)", "value": "836cecd8d1e2e7c9146f9349209a9556", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654668521, "uuid": "90116e8a-9404-47c7-abf2-b69d05b34edf", "comment": "Malware payload (AgentTesla)", "value": "4c0f2de97826d56bae2c4af31cd01c4b68515433943918af1f28889587fa13f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654668521, "uuid": "e5ca7efd-c2d2-421f-9162-e71006d09d25", "comment": "Malware payload (AgentTesla)", "value": "ce59437da47303a25b606870fa8fdf0568144efb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654668521, "uuid": "69aaf84d-d986-48f1-8003-4c91dc0dad91", "comment": "Malware payload (AgentTesla)", "value": "8f952df6291c444fd995f5163cafaa40a61ba56d21c1bee599f281bb2feaee7e7b8154ccdc9e29445b9fdf3912eab8a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654668521, "uuid": "bde0e2c2-4434-4cb1-8b2e-159c25224f72", "value": "T180E4121933ED0B63D67D6BF988A9004087B0A62B6927F31E0E8535DF4AB77C4C666713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654668521, "uuid": "ea41b647-59b1-4588-9b3b-2bb32cc655c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654668521, "uuid": "2992ac45-d1ba-4315-ae8e-f2d8df54898c", "value": "12288:xqS+HBYnr6aWHNqXUEpEetujg6rOU+cCBq9yhPe1kgJp71GVCbo9q:chYOaWoUEpjtuk6rObcyRhPe1kiqkbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654668521, "uuid": "cb88fe0f-87d0-4681-a762-05538a72d730", "value": 667136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654668521, "uuid": "e5416b0e-35e7-4dee-8e34-994bd9faffd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654668521, "uuid": "0fd20226-be51-407a-831c-648e969edbe6", "value": "06082022,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702d28d1-e729-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654692570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692570, "uuid": "7896a053-c96b-436d-94c1-f5765a62c4e2", "comment": "Malware payload", "value": "23a716374225404bbad23bc592f0065b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692570, "uuid": "3016faf7-af57-4d15-a3dc-4ff6aed86373", "comment": "Malware payload", "value": "4c79b2fc7139ae69b0279a6aa282f248c0b4ed2604bb790d8c38e246aa33ca3d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692570, "uuid": "3f4bfd09-822f-4c36-8c5b-eb5e2860908c", "comment": "Malware payload", "value": "29416bec59e449f2d84153d2105b487912845f4a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692570, "uuid": "b003bf05-7534-499b-9f76-ec196c89b41f", "comment": "Malware payload", "value": "f15fa520b54ea429fd2d2de938077a8a7626463424a21dde93f91b3fa862339660184dca515da008ce2a00153fc2c75b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692570, "uuid": "e3a28c14-95d5-44e6-8213-a1822f3be471", "value": "T1C72523B0EDC51F57CF2E82399217CF4A248DFE9DA76883BA4795788F10FDB9000A6911", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692570, "uuid": "85fcffc1-701f-4bc2-b13d-6481462d4c63", "value": "12288:XPdWpKu9QHTgY0esLawEIylJ7JKJGLclHep/GnT9YzWHkGY:f4mzgY0ezXvKJGLR/GnhYzWHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654692570, "uuid": "a665d6cd-2622-450e-a158-57505de9b337", "value": 975872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654692570, "uuid": "e05e2d9b-10d9-4a57-bfc2-fba1d1a4f124", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692570, "uuid": "bdec8189-3beb-4e2d-a9ab-c9b5cab3eeb7", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.20923.649", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc0af3d-e736-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654698362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654698362, "uuid": "f206aa28-4967-42c7-b6c8-3f037554ace6", "comment": "Malware payload (AgentTesla)", "value": "dbc96eb98a0b0183312f67a0309ba9a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654698362, "uuid": "5dd056d4-1820-49f5-8191-c50b7106a5d6", "comment": "Malware payload (AgentTesla)", "value": "4cf471f3821a869df9c21fb788820669886d5dcf25a13c42f0ba9bdcfebca6ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654698362, "uuid": "b9cc2b9e-8783-4cee-9480-a26ada828cf7", "comment": "Malware payload (AgentTesla)", "value": "e91fdf3d8ea5039d3dce69e038d606e92840d852", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654698362, "uuid": "4f671c64-f334-41bb-93f0-d7c942960d07", "comment": "Malware payload (AgentTesla)", "value": "762be6ec9859733de6d1845763a6e2c2964847f74adf5595740ec031522e03fc15c50f42f053da4b62a42f572e0c8aef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654698362, "uuid": "9916c6b1-4bcc-4383-8baa-e3c405fc67c8", "value": "T19444BF6721838811C585697D81A4E3EC837C9F615E2B72DA706E3235C9B2D8F3B4CDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654698362, "uuid": "053f8406-04ef-44f9-991b-e321089defef", "value": "6144:ugOPttQJNmb6SLB1iuKvIQJGbqzhNnFnvhydhcoKQQ:StQ7mb6SLBcdwvbqdz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654698362, "uuid": "55fcfeda-92cd-4b18-9c42-9834bde57314", "value": 276480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654698362, "uuid": "53ea7ba1-b322-4c62-ad36-dcfbb187b475", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654698362, "uuid": "fbe74bef-7817-419e-bf3d-367531d30b16", "value": "VISA DOCUMENTS FOR YOUR APPROVAL PDF.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02627f51-e6e3-11ec-93bb-42010a9c0043", "comment": "Malware payload (Joker)", "timestamp": 1654662321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654662321, "uuid": "889f2b0a-6816-4db6-b85f-3d2d10d1dcab", "comment": "Malware payload (Joker)", "value": "d7fa2db69a2e37b9441faa7d97b1d0c5", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654662321, "uuid": "4794ba72-2e9b-4db8-b0ef-7629799effb0", "comment": "Malware payload (Joker)", "value": "4d13b196122120101923658bcc0e8ce2324379f6cd7e12f508eda1c1f864d140", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654662321, "uuid": "abdc9d3b-20b0-4aaf-ac0e-c4465905e3bf", "comment": "Malware payload (Joker)", "value": "30ba12420577bef67a6aa73107a2d0b225daf107", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654662321, "uuid": "b768b6f5-9009-4438-933a-6d2c3e6a85cd", "comment": "Malware payload (Joker)", "value": "9cd95fb9040907ca78825ba974a1258ec9c3eb8ee576e31ee45dad16ff5a9d01515623938a4ca4a0f4b85741f5e18054", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654662321, "uuid": "88ec8763-862b-4628-aaf3-53d00c3e2e0c", "value": "T1D3D6F197F399EDDFC4F28331893A112230574D60674397A66A18B37828B39D94F4EBC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654662321, "uuid": "b6f5afed-04fb-4b07-abf7-0a70a0267248", "value": "196608:hEZwUecykyQOyIGtxF3KzvX79ufhf19zSt8r4s6rKjharRXuVeVK36bViBzfM39:uwUPyItDsX79w190s6rKjwN+Vj3Oiu39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654662321, "uuid": "7f9df736-f61d-4553-b56e-c851a19b1ad8", "value": 13065555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654662321, "uuid": "0f80e880-eeff-408b-86b8-ca4453dd698e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654662321, "uuid": "6abfbc46-2055-4e5f-a0c7-860b35408983", "value": "Multi Language Keyboard_1.836.00.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0afdf89f-e784-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654731484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654731484, "uuid": "807ab7c4-0c0b-4d0b-9bcc-71f807da26f9", "comment": "Malware payload", "value": "bedd102705b18c32efaa5f6b95151c44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654731484, "uuid": "9f9ae011-12f5-434d-8f42-f369eeae9339", "comment": "Malware payload", "value": "4d26421ffb50624467c0a1772e1f5a1312c8b2f5462c29620e1010a957086274", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654731484, "uuid": "92c300a0-0b9c-4a83-8f17-9be83555166f", "comment": "Malware payload", "value": "a8b72bc6c5dfb4faa6f7a3130c4cbe97dcb94868", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654731484, "uuid": "a9e28a42-b50a-456d-b09c-4d03d4a00ae2", "comment": "Malware payload", "value": "22b5450c624e466d46930783ea775032ec97b05672aed90cd178fd56c4dd16aa62e1c31196d1c21746977e3c3b38b04d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654731484, "uuid": "8181501b-d60c-4b2b-9fba-e34d47bd8cbd", "value": "T1B784F147E7D4D08AD0017A3B56E20AA4E274FD187C16D753198CB6DE5EF6B44A8C22CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654731484, "uuid": "72150fb0-1e6d-4a10-9f38-12c4d7db9cbf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654731484, "uuid": "d7cbd7a4-45b7-49a8-9b4b-6e7d3319715e", "value": "6144:eS2dycefMidbBlIS89eQuNW4PfYVrU5HasQ3WYTb7wY51KVJJCGU5yMeS7i:e2D9Blv89eQOWWQUIxTHw8KPU5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654731484, "uuid": "c3a4d264-adb8-488a-8ecd-d099b33c4633", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654731484, "uuid": "f7eed45c-4435-4125-8b08-a850652bca0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654731484, "uuid": "67a3055f-039d-4aca-a75b-8aa49256f1c1", "value": "bedd102705b18c32efaa5f6b95151c44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24472aa7-e6ca-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654651640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654651640, "uuid": "f535f042-f8ee-4e84-a3eb-5bdfdfb14d09", "comment": "Malware payload (Heodo)", "value": "2531ab307c2fa7096e1bc263469b2f5e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654651640, "uuid": "6994bcfc-e56a-4511-9539-3587fb424511", "comment": "Malware payload (Heodo)", "value": "4e97a88f618c2ae6e33a18768d07045bb3cfb251c90075ce1615573123cea43a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654651640, "uuid": "b252c1e8-c1a2-46e0-ac85-0a7040fca967", "comment": "Malware payload (Heodo)", "value": "fb8c5f971e5a8a956719d719628dff2795c5a1a7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654651640, "uuid": "8dfd7b10-1f73-4632-b879-0798b8730ad6", "comment": "Malware payload (Heodo)", "value": "922d146097b964445b18f3ee9948ad0fbf2547ae4f5920a1d55516a71f23e9fafc1693f58f3182506a248f49421cba49", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654651640, "uuid": "d03905fe-a495-42f0-9135-9f59b0816c68", "value": "T17704023EE5031A98C22ED8FC58EE6DF9D5F634006268063A1BA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654651640, "uuid": "f0cad686-31df-4884-a6ce-fff8326043ea", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654651640, "uuid": "24978ebe-cfcb-4905-acdd-4e74fe6b7aec", "value": "3072:VpjftGFs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VRwi1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654651640, "uuid": "4cc862a4-d65c-4eab-89fe-7aa2946c7410", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654651640, "uuid": "c1254d75-4c26-4390-b084-40a7c85ef7c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654651640, "uuid": "6e116f4b-a49e-4579-a57a-89ab7edd3c72", "value": "2531ab307c2fa7096e1bc263469b2f5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa2501ba-e70b-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654679782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679782, "uuid": "ba33be28-9efc-4e20-8952-84c70135c115", "comment": "Malware payload (RedLineStealer)", "value": "25c51d162c219b294eb1e192f8be39e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679782, "uuid": "fa558351-43a5-4d6c-8bc4-493c724a382c", "comment": "Malware payload (RedLineStealer)", "value": "4ec48ad617436875ca9ae52bd21df6cc068b2f8765c7cfbfd5b8f45fc9a67886", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679782, "uuid": "a7d8d546-06a3-4537-8454-bd86cbac5876", "comment": "Malware payload (RedLineStealer)", "value": "d4502f782b452413d5f4ac3b18d54c7260b9e92e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679782, "uuid": "75da11bd-250f-486f-8ac0-d929854c7f7c", "comment": "Malware payload (RedLineStealer)", "value": "01b190a92c824b514e55f24f3f7792268b54db9433eb724b48d981ae5756da044491449a2f73ae6c666df745df74f5dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679782, "uuid": "e34636c6-3919-49e5-9f73-9455453bb927", "value": "T12A84AE10B790C035F5B756F449A9C3B8B92EBEA09B24A4CB62D12BEE56347E4DC31707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679782, "uuid": "c146eec0-279d-4180-a253-4fb1fcd3751e", "value": "607cfdc59e2780cc2ae53752d9fac363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679782, "uuid": "750f7725-16b6-44b8-a9f9-282c88b1cb3d", "value": "6144:l+HIhPia8S5wP8dvKUp9pkmMIqhC4VgrF8BXcwd3H6IJUTc4G+s6bDBXab1BP//w:l+okavwUdCUp9pZZqhC4VgrF8BXcwd7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654679782, "uuid": "af73976a-836d-403a-9631-65aeb501faad", "value": 390656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654679782, "uuid": "4862c2ee-3ea8-45e4-be6e-12d8b5aa7bf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679782, "uuid": "a6f20677-9e0f-484a-9546-c71224c7b2a9", "value": "25c51d162c219b294eb1e192f8be39e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9209161b-e6fd-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654673729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673729, "uuid": "6cfdab09-7c2f-4128-ba6a-7c2da42e63d2", "comment": "Malware payload (AgentTesla)", "value": "61718bfe111eb401852bf6e29a4d713d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673729, "uuid": "d9394d3b-fa9b-4766-adad-22825634e760", "comment": "Malware payload (AgentTesla)", "value": "4f948bed4dc0c7a6ef9c8e9f3114afadd392b2911b5cea51a86977089f2ebe38", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673729, "uuid": "24ffbc40-8d97-4f3c-8c26-5c3d841688ad", "comment": "Malware payload (AgentTesla)", "value": "fe3844dd00288ab1c63dd1c07c88251110cd40b5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673729, "uuid": "f347a8a6-6598-41d4-9414-aae9d63e49f0", "comment": "Malware payload (AgentTesla)", "value": "0bcce3dd6403408ea09dddd55b8084f21bccc0ebe5ad066c24ba0f0ea3dc0a088107b6ac27fc8b25a4095bdabb5ad1ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673729, "uuid": "72116cd8-9d0b-4440-b1b5-74f387f10f88", "value": "T174B47C9C366C75DEC857C972CAA45C64EA6078AF771B9207912309DDEE0DB87CF201B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673729, "uuid": "16cf73b5-9fec-4a5a-b615-e282437b8eab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673729, "uuid": "0ff87461-097d-4f35-985a-81fc8d6ddf5e", "value": "12288:L61MZbKzioBLDjGoqyyN4Cf06gh1T95u0ezYUh1e:O1MdCBLqyyOC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654673729, "uuid": "04ea68e4-8e34-431f-8267-17bccde22b67", "value": 518144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654673729, "uuid": "dc5c0d74-fb50-4b95-9b53-20632e576817", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673729, "uuid": "9431a4fe-2b59-4156-a65b-2cb59a3bb29b", "value": "OUTSTANDING PAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e181dac2-e6d6-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654657112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657112, "uuid": "267ae524-1b0c-49f4-a420-be6232744366", "comment": "Malware payload (Heodo)", "value": "130b1980896a5d3d9ca3fc048a5305bc", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657112, "uuid": "0a863aae-650f-43ef-90d7-9782e8e50b5c", "comment": "Malware payload (Heodo)", "value": "4f9b82bcc506d9e412f8a90ff0aab3afd723a8615af73588f29fd00f8cced7a1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657112, "uuid": "6a046e2f-4b60-4b41-bb82-dc15743f7a91", "comment": "Malware payload (Heodo)", "value": "1d36e6f29c8ff5534b1c9fcb4eb946fff95c5d73", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657112, "uuid": "6cd45ea1-c66c-4d3d-97f8-6743ac19a031", "comment": "Malware payload (Heodo)", "value": "85c99f9d595e51b31998070cc1a985ba80641177f9177090f48acaab97e37a82a094e4c3b4666d2cbfd06db851f7582a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657112, "uuid": "054eb2e5-2233-4f56-9fb3-e76452ea5629", "value": "T1AB04023EE5031A98C22ED8FC58EE6DF9D5F634006268063A1BA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657112, "uuid": "f897c090-e70b-4fa7-a97c-2194dc972423", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657112, "uuid": "0bd956a5-ba43-4183-8e38-34ab1711cffa", "value": "3072:VpjftDFs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VRdi1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654657112, "uuid": "2dd9490f-8716-4154-98c9-775d7ac39c3b", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654657112, "uuid": "5298d5e6-7d74-4fdf-a335-bc19ff4182eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657112, "uuid": "470bdeb7-aba6-4fdc-802d-9ed2c1b05a37", "value": "130b1980896a5d3d9ca3fc048a5305bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc8b1ef5-e77b-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654727944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654727944, "uuid": "a4a47697-38aa-45e2-9529-54b7d23ebba7", "comment": "Malware payload", "value": "e373859a99003b78e9a14c0e1c2e4ffe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654727944, "uuid": "42383c24-fecf-4a44-b61a-b1c4aaff9f65", "comment": "Malware payload", "value": "4fb50209a274456e05b6c1ae9a8ed80af87616e8763816c8fc413880f274fc5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654727944, "uuid": "d75f76b3-05ab-4354-a6cb-58657f7808ca", "comment": "Malware payload", "value": "90b3bb5a5d58df5e958f73059ab4277c0441ea9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654727944, "uuid": "da287e4f-c562-437a-a717-4f0a0050220a", "comment": "Malware payload", "value": "61a4bc0a83213894257e54fee8e476ac7f19e459cbb2acf9cc574b385fe4747bfe3b7fc5062dd0bd9cff10d624f50057", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654727944, "uuid": "3e9655f8-350d-461a-89e8-dd58b3e4d94d", "value": "T1AD15CF84EA8495A0CD599F716A36CD305633BEADAC34D51E28CE3E2B3BFB7931012517", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654727944, "uuid": "af70aac1-7994-4ca6-9541-6ddc9b5ffb0c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654727944, "uuid": "68aaf053-2740-4ad4-aac5-4208c55723ba", "value": "12288:lE8KBPQgpvdeTLVtZUAesK34SMk9V8gUbqSCI+orGUgd4BOjWP7r9r/+pppppppn:llg/wtyAetZDm+pIn1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654727944, "uuid": "990c47c4-c642-40b7-9b05-adb4539f9315", "value": 879616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654727944, "uuid": "bc76c702-5c5c-41b2-907b-34b5f36ead1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654727944, "uuid": "fb400513-7077-4ef6-ada8-bfce8e001261", "value": "SecuriteInfo.com.Trojan.PackedNET.1159.1005.7634", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c2de0b8-e72d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654694308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654694308, "uuid": "efff8b61-e0fa-4fd9-88f7-5137fb81215e", "comment": "Malware payload (Heodo)", "value": "963a1d45348f7ef732b4ed12bb19f9c0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654694308, "uuid": "cc0d768d-df1a-4434-9664-2f319b5fdf4f", "comment": "Malware payload (Heodo)", "value": "504e7423a86717bb17bc0ee49bc58fd00088e0a6985e2568b22b9c4159a1aa89", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654694308, "uuid": "ffa915e9-787c-4968-ba17-27046ce01b33", "comment": "Malware payload (Heodo)", "value": "5cca80c8b13951d9ca53e260d72fbac53302e325", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654694308, "uuid": "77ca1679-37e4-41cc-b586-15e0da7156f5", "comment": "Malware payload (Heodo)", "value": "7a4a7dc88d2b5599bbb853af0b7665c3a1cbf270b367c3fdb0ba2a60452fcf593dcd98b35f7e5f95cec97338d2df774d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654694308, "uuid": "6847b5f9-79d1-4e09-b1a0-e24938372510", "value": "T1D144C089ABE1ADDBD51407798DD6D324333EF2814B8387076B2598390F23BA4BFC5A45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654694308, "uuid": "e3f578f5-de7d-4d17-8a71-0a7cccf80cd5", "value": "963f2e88a5b03877d0583808b2526c1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654694308, "uuid": "bc9b49ff-089a-4940-9627-afd20795ab2d", "value": "3072:7R7Se82w+Oh+UjuFJrfr7CS/FmikytkqroMdjaWtHCqPZ4PEx2ES2vZg3f4L5ZJi:7lVJuk4uFxOmFwytLVxDtfPZ4PE2sPs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654694308, "uuid": "3d6610b0-f722-4105-9e58-0f961fbab8c8", "value": 270403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654694308, "uuid": "ededfe7b-a0df-4ee9-a285-fd65e54b7b2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654694308, "uuid": "18f251a8-7649-43da-86b5-73f6333b8ae1", "value": "963a1d45348f7ef732b4ed12bb19f9c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90843170-e749-11ec-93bb-42010a9c0043", "comment": "Malware payload (BitRAT)", "timestamp": 1654706368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654706368, "uuid": "de52655c-0978-4879-8f2d-d56a4e83329b", "comment": "Malware payload (BitRAT)", "value": "d347fda223555138eb73eb0e2f33ac7f", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654706368, "uuid": "71ed1466-64f9-4088-bdba-137321c52cf7", "comment": "Malware payload (BitRAT)", "value": "5102f1d892157a64945c982ff4e6834dd74d15180230e82478062f39f4cdd89e", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654706368, "uuid": "18d18d40-f3d1-4af9-a995-e39a6c2b1312", "comment": "Malware payload (BitRAT)", "value": "6e08cb33f447ba90898d4ccee74627de3bb00419", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654706368, "uuid": "8f76d2f9-5a99-4f87-8052-c182ee7ae517", "comment": "Malware payload (BitRAT)", "value": "3449607971a43e69a785b58e93798ae7385fa7ba2a31323ff0e0154c441cb48752e65922f1d6d89a0231f4f840feb33a", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654706368, "uuid": "60491ef8-7a7d-4756-86f1-46a1d011409c", "value": "T11D25BF22B2E10437D4262E395D5B7B55A86ABE513C28784A2FF93D4CCF35382793D293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654706368, "uuid": "116cdce4-85de-4635-a536-e967966ad9cc", "value": "c2e2698247bc76cf8ea24c335c2f1e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654706368, "uuid": "339b41a8-fc23-4d2e-9ee9-cdd39845fe82", "value": "12288:mUdrBgUSaYsGytw7zQKKV0FlnOcf/GkMTgIGuURWCXCEUaW+6LHczdQ:mceazGytwXmWPn/fekMsTW+xdQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654706368, "uuid": "3efd1da3-9e5a-4b40-ba8c-b1359c9c3324", "value": 990720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654706368, "uuid": "dcd5156f-4292-46d8-81db-ee4654f9b437", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654706368, "uuid": "c9a9b6a5-d42c-4f5c-986c-98d31d26d92a", "value": "SecuriteInfo.com.Fareit-FDBID347FDA22355.10510.6791", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c8ea31-e70c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Quakbot)", "timestamp": 1654680183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680183, "uuid": "1dcea16f-095d-428d-a3d5-0fdc1ddf64f1", "comment": "Malware payload (Quakbot)", "value": "d715d0ba5bf6142888b13c40b431a8c8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680183, "uuid": "9e571908-1015-49d2-917a-5c4a5d3ebc8c", "comment": "Malware payload (Quakbot)", "value": "51568a69c9d36ac7b322b73429e61fb11e89349088a0fc0c0245f810c8815a67", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680183, "uuid": "d00b8aa6-2cd3-4d6f-ab92-ec5bddf117e4", "comment": "Malware payload (Quakbot)", "value": "5b44fc16e2e8c3a09ac7b8308358dfb676e2a059", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680183, "uuid": "bb9cc12a-0e7f-411e-b1b0-599b925a4dfe", "comment": "Malware payload (Quakbot)", "value": "b81bca8e6a0da96d667f390e839bcc948bd269151e968ca16c3464e4a5343a880c8ce1ab5e5155b9a8c93ab7041ad305", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680183, "uuid": "8658ac86-9e09-40b6-8c52-2c9292d8fb26", "value": "T1AA656C21B2CEC737D4F3267C8D6FB659942A7D111E38945A7AE40E4C0E3A6813E2D6D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680183, "uuid": "299153e2-5148-4b18-ba47-a9f43099a8a6", "value": "ba3f74b1c1ea8ef5b9ede9dc13ddf9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680183, "uuid": "755abd37-1e3f-46d7-8ec5-a7844718a558", "value": "24576:a80Ra7rJwVXWqZLSPZF5BQjaM+R4YENZrfrzfQcD6CJ0:at8kRKZ29+I4cDLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654680183, "uuid": "77f54c39-76ba-4e21-b961-76834acc2b83", "value": 1437696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654680183, "uuid": "d00b6128-2daf-409b-83cf-afe3b4cbcffa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680183, "uuid": "f3409ed7-2700-40b9-b40d-2f5c86f54b36", "value": "019338921.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6237b29-e6ff-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654674622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674622, "uuid": "02320583-11dc-45d6-9074-598c9146b18f", "comment": "Malware payload (AgentTesla)", "value": "33546dca33a9578951dacdf03f7344d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674622, "uuid": "39af2570-3cb8-499c-96f6-f865840a37f0", "comment": "Malware payload (AgentTesla)", "value": "51a28140eb38dc879d567ab3909ba4b555f861ce1f5b603d2aeff4b47baedcd4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674622, "uuid": "c4f9b8d0-f04d-4010-97cc-692095e9a927", "comment": "Malware payload (AgentTesla)", "value": "f2ca8a34338558ffbab9e07d4acf20346c64c1fb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674622, "uuid": "e7794b22-b1ab-4ca2-acbb-bb45ae526534", "comment": "Malware payload (AgentTesla)", "value": "c02e8361e7afe949256c794014ad120fa99f1158ffbb8c572771919f1242e3fb19e8bdde7991df503266c99535b75da8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674622, "uuid": "5e51106a-5634-496f-a641-6a9ff8d45019", "value": "T1CCE4122533DC0B22DB7D57F9582A584057B0A33A260BFB1D5EC021EE1E7AB92C917727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674622, "uuid": "297805c2-6976-47c8-bc10-7c611f9261dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674622, "uuid": "8c7e9e9d-9681-4612-b9ac-d4ff0de4d172", "value": "12288:qek7C5fcFrEFE4snfGclzQEccA8adrF0/hUqWS87ukimUOFink9q:e+kQA5fA8KZ02qWS8Zink", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654674622, "uuid": "387705ae-136d-46a8-8e8f-8d7029c0ca35", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654674622, "uuid": "aaa60764-e184-4d9f-bc79-ff0000a0f0a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674622, "uuid": "c91809da-4b6d-4585-a7d1-fa64e32fdc68", "value": "Scan_69660758.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b57f393-e76b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654720828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654720828, "uuid": "b0dd86c7-b20a-477f-8d65-8de57e89f1b4", "comment": "Malware payload (Mirai)", "value": "1de24beaae22cb76c9afc604e174974f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654720828, "uuid": "d0ef2b5d-4148-464e-a3bf-26090df821cd", "comment": "Malware payload (Mirai)", "value": "529c9d86c796301f0155f32ada19aaa7416005052ec6e9b21e15d4bbe82e41b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654720828, "uuid": "a97a6314-0aec-458d-8f61-06cf256af017", "comment": "Malware payload (Mirai)", "value": "f3884ba955b0ccb03ee11a55321430395cc67987", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654720828, "uuid": "ef4c6f39-bb73-4b90-b399-1785a3ead702", "comment": "Malware payload (Mirai)", "value": "3bbc0a25df13312555d42e998728bc1025306562fcf16b6210be63f0957629f4bb9f4032ee6eee278c9ed2d88ef30d75", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654720828, "uuid": "40c4f8fa-8234-44ec-99fb-eb9926a7e3a1", "value": "T130535C34AD392E26C0D4A57E21F78365F2E6234E65B8D61D3C760F8EFF14A8068172B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654720828, "uuid": "9b91352d-cc62-4441-bbd1-a5b79062f830", "value": "768:+VoUo3KSybT7h6pbaeoH4+Y5ZcVpKcogAWsyoU9twd8U4EO3mO+WGLz:+Vno3KSybT7h6pbaKcVpKBgAvyHfZkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654720828, "uuid": "e5c4fb4f-fbbb-4845-8fc1-09834decbc12", "value": 62616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654720828, "uuid": "b48c9a2b-45c0-452a-a86d-f172e4555e14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654720828, "uuid": "a88ccdad-b583-4eb5-bc9f-2b1ae966b347", "value": "1de24beaae22cb76c9afc604e174974f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb68f46-e6cb-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654652431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652431, "uuid": "c387d9ba-c0c9-4050-8320-25cfdf5cf24f", "comment": "Malware payload (Heodo)", "value": "0793a6a8472b87cccc3de06b568d3ba0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652431, "uuid": "d50de109-e8ec-4f8c-9b61-49269a022089", "comment": "Malware payload (Heodo)", "value": "52c726344aecb5bb6e870449d148f80c3816680d96ea2e5e883f03e8b2bc2882", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652431, "uuid": "03f5234a-ab81-49fa-98c9-3331143e2769", "comment": "Malware payload (Heodo)", "value": "471b3b35949c534915ed7ac825f2c2e2285b0403", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652431, "uuid": "42c6f873-d5e4-4159-b27f-2bab2825b564", "comment": "Malware payload (Heodo)", "value": "4c4fedb33dbd90f3563c8289501a258c5ed9bba0ea9f3db8cbcc95221f7f23aa536fb95bbd8bae217416efd36f19177c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652431, "uuid": "ff094eb5-c698-4882-afe6-dfac7444bde1", "value": "T18604023EE5031A98C22ED8FC58EE6DF9D5F634006268062A1FA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652431, "uuid": "7c97dad1-9dec-46af-99ad-824429959863", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652431, "uuid": "ce70a607-9bdb-4954-9302-ebcc5980e0ff", "value": "3072:VpjftHFs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VRdi1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654652431, "uuid": "d767a98a-8666-4dc0-8f93-9b65f7fa0222", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654652431, "uuid": "323693d5-cb47-4c48-9d6b-257fa2509e05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652431, "uuid": "0791f098-3893-411b-8189-1858367aaa34", "value": "0793a6a8472b87cccc3de06b568d3ba0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "677465f1-e729-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1654692555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692555, "uuid": "861cb3d5-5738-4648-9c56-eb6c7787ee10", "comment": "Malware payload (GuLoader)", "value": "2f43eea209d40f00f7f0af8702b81916", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692555, "uuid": "99552b07-9875-48e1-aa55-dc3a054c92a5", "comment": "Malware payload (GuLoader)", "value": "532ce56ca5291f010432afc63e82c07f17479f45b74a95954a3f93c25a780ce1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692555, "uuid": "15e9795f-626a-4c2c-b15e-367558b6ac5c", "comment": "Malware payload (GuLoader)", "value": "d02e14f32d5205fdb64b8a65d912d0a574b8c3ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692555, "uuid": "a31c9cd7-8f5b-403a-9f66-e48a3df6fc32", "comment": "Malware payload (GuLoader)", "value": "557087cd06d6d21f821cdbcf169d89d1b95945a45cfa8a3cb7dee9ca159e9ebc6f1836e20b7077fa2d6cec2ccebc0262", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692555, "uuid": "873b7064-e952-494c-aaff-5e1d6fc13e4c", "value": "T1D493E01166A4D827E4B203312CB9677B9FFA9920A5704F4B17406F6D3D336C2DE1E362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692555, "uuid": "3f03d472-05ed-4b47-954e-07c6f99b02c7", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692555, "uuid": "40d71259-5b85-4ce8-b2f3-d29e7d1daafd", "value": "1536:U/T2X/jN2vxZz0DTHUpougdbm1xE+1d1SDUa0HZmbTsYCuoriBKxn4ULN2d:UbG7N2kDTHUpougdbmPqv0HZkCu6x4Ue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654692555, "uuid": "bdd2f2de-e692-4c2f-8e9c-a05a3ef8a066", "value": 96824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654692555, "uuid": "e613b33a-20e2-49e5-ac86-d026d74951f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692555, "uuid": "6189623d-538d-4c37-a5bf-92a1ae3e72ce", "value": "SecuriteInfo.com.W32.AIDetect.malware2.29982.22037", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e94c28a5-e6f8-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1654671728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654671728, "uuid": "820735e2-f1a5-4e05-a197-af0d84ed68fc", "comment": "Malware payload (RemcosRAT)", "value": "fa458f17fc9489775b7a98ae4f22ca62", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654671728, "uuid": "b5ebd2c2-cc05-4817-9394-47d7c555c376", "comment": "Malware payload (RemcosRAT)", "value": "536102e06dac1439b292349e1d5873f18b6dd9a5a23f44666c4d9b77ddea0555", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654671728, "uuid": "7c17df94-137f-4fe6-9eed-556208a5c5f9", "comment": "Malware payload (RemcosRAT)", "value": "9324450aa2fa886585259c5b7d927b3c4953c91b", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654671728, "uuid": "7162a8f2-ded1-4101-b898-d8ccc411aaf2", "comment": "Malware payload (RemcosRAT)", "value": "7b8302da0d798f1e5243c42ba7596b3fa2468049cbac213e294a03bb32f632a2382a8714f459fc582d20dd03d0cfb695", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654671728, "uuid": "06386463-cdc2-443e-bfae-1104dd27aeed", "value": "T10E5533705DCE548268DF532AF817F763368CF19AD8E480032D943BA3B3D8D5196E6E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654671728, "uuid": "88206f3c-7fa6-42d3-95ad-f12dc2f96111", "value": "24576:aF8Lfk+15QepizCuVsEPFUCtBZ96KfzGsgeERYBWbW6h7VqjxkL2:FL8+1P4G+sEPfZ6KfzGnXRYgbWY7Vq+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654671728, "uuid": "d0c76ddb-0545-4d4e-b144-630f8a996c26", "value": 1334866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654671728, "uuid": "23be955b-f598-4155-b26f-1861ff2f2e3e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654671728, "uuid": "0f1a6b01-ae06-4802-bf95-7592cf8f1fa5", "value": "HBL+MBL SHIPPING DOCUMENTS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fde32474-e6c4-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1654649428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654649428, "uuid": "6af69801-085a-4349-bae4-c90a7d54f0dd", "comment": "Malware payload (Loki)", "value": "055a62e1ad259eff8a6e1adae55b129b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654649428, "uuid": "c3219cb2-37f8-4103-a451-82eed6bb0f74", "comment": "Malware payload (Loki)", "value": "539f3611c24f1b607172efb5e23ad7d726850b24ca6a2f5fa6125fbc757efea9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654649428, "uuid": "0fcdec70-a469-4264-8a39-6de7c720d032", "comment": "Malware payload (Loki)", "value": "84dd34cfc478c6a75f849e1745d87792e273a96a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654649428, "uuid": "56873f9a-1b1a-4061-bc71-b6cdb7836e4e", "comment": "Malware payload (Loki)", "value": "d56ae7beb4c243852fe849faaa60aef5ef235f7e7738eac16bfebe8fd335951acb79152bcf45be0e801964dea8e3fe34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654649428, "uuid": "43d67f82-2bde-4f25-902e-6b9b45df27fb", "value": "T1C605D004B717EC7EF0295E335CA054002B70565E86ABEB6BA58932CE245F7CB0AF1B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654649428, "uuid": "7ad4533c-9590-4543-8fa4-70f5cb1331fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654649428, "uuid": "88c8e94d-ed8c-4a7a-a5be-bcd0996ae2c0", "value": "12288:qnmtC1SONVC0t9JWkUi/NpmH9o2iNd9qfwkfXncdiagS1630KKnpib1X774yACYK:Ua0tzpIo1newkfX+yW630xkbAehS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654649428, "uuid": "2e3aafaa-3555-4d61-8b9c-1b71c2b429a2", "value": 798208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654649428, "uuid": "51e8e62d-01f0-44c8-98ae-543a6a885f99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654649428, "uuid": "92daa18f-2777-4c98-add7-448dfa27e3b7", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a09f61-e703-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1654676077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654676077, "uuid": "cd784186-f4dc-47f9-beee-11b77011d0c8", "comment": "Malware payload (GuLoader)", "value": "e2bb37471451ba2677bd7717886c62f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Femkamps7 Efform1 alchem Hensigtmssighed7", "colour": "#B08E4B", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654676077, "uuid": "04b7028a-e99b-48f7-99a3-f11e69bbd402", "comment": "Malware payload (GuLoader)", "value": "5466ad64faf97ff2f6cf88872406ce7891f2518c11101c0646575ef08bc9f6be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Femkamps7 Efform1 alchem Hensigtmssighed7", "colour": "#B08E4B", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654676077, "uuid": "136231d7-cb1d-4e80-99b2-18aaf87795eb", "comment": "Malware payload (GuLoader)", "value": "891215630974d89567b46f85afa4e4edd9a5c6d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Femkamps7 Efform1 alchem Hensigtmssighed7", "colour": "#B08E4B", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654676077, "uuid": "e65d0597-71d4-4eef-89be-a6af6d17808c", "comment": "Malware payload (GuLoader)", "value": "34d331c37b48e0ee933bc90ea9fb81ec69d8c7322d78a4203f1d43a70a0c5ed6c3167ba8c75017c386971d6f3d0c016f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Femkamps7 Efform1 alchem Hensigtmssighed7", "colour": "#B08E4B", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654676077, "uuid": "5064de57-4a5b-46c7-977b-6ce49948fede", "value": "T143B4234A3614F51AD4515B38AAB16A37E97ECE2176912F2707003BAE7D723D1BE3E304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654676077, "uuid": "1ad083ae-f2bf-4ceb-8084-d96a2b6899dc", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654676077, "uuid": "216fa5b8-ae4f-4c4b-b620-0dd4c398ee35", "value": "12288:xbnC+dkM7nE2G6Wl+k/NE8Lct+V65zsA9lG+gS:xbnCCXA6s+k/LLcgsNsAzTgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654676077, "uuid": "abef8612-3083-40b4-acee-e209ce798b89", "value": 515104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654676077, "uuid": "9d9720f9-e1e3-40d9-99ab-9774b852899c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654676077, "uuid": "4c880eb3-00c1-44f9-9d59-5470cd3e5853", "value": "07.06.2022 - UAB TG Air Waybill Number 2901365211- EC650SX3-36AT - 1.05kg.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f04e655-e6ec-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1654666369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654666369, "uuid": "f44f3193-316b-4123-91fc-d996099179cb", "comment": "Malware payload (GuLoader)", "value": "49580bbc3ea5bf433bd6c71b721253f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654666369, "uuid": "4be8e9bc-a0bd-48cc-950c-d29596f95771", "comment": "Malware payload (GuLoader)", "value": "54f1684580713bffc0a28ee35b65720da0d7b850018c1b007159dd185311d437", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654666369, "uuid": "b955b70e-6597-4b3e-a365-af4df0d1769e", "comment": "Malware payload (GuLoader)", "value": "9ab58ea7ca1408846b4d1aa694227eeedb330fc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654666369, "uuid": "9d78c664-deba-4144-ae24-f6735cd2cf08", "comment": "Malware payload (GuLoader)", "value": "11f2017a6469782f14b45ebb1a2af830cbb5159f7a76a043cd99d0fbde65876be5f67ff6c441ddb50276fc1609a38539", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654666369, "uuid": "a48086eb-77a7-465f-a155-0ca2ab9efda6", "value": "T1D4C3F040AB70C467E1B247326D7A27BBAEF9E515A7A0AE0B03241E0D7D375C29D1F361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654666369, "uuid": "925821e1-fbb7-49ab-a56c-279303b9c2f7", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654666369, "uuid": "64badb09-c6e4-47c3-bea6-efa907f2ab8b", "value": "3072:ebG7N2kDTHUpoujb2MrANdgsYCGDZBrVNK2qloHPk:ebE/HUP2Zz3YdjrzK2N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654666369, "uuid": "8047a489-3fff-42e0-8ecb-e754b65a98ba", "value": 129543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654666369, "uuid": "aa215a31-19b2-43c9-99f2-3ec0e118d1a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654666369, "uuid": "cb2944ef-df36-4afb-8768-6be492475b82", "value": "SecuriteInfo.com.Gen.Variant.Nemesis.7854.11080.12419", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3675a1c5-e6e5-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654663267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654663267, "uuid": "72a50eee-8b55-48b9-8c61-4a6f1f8ee332", "comment": "Malware payload (AgentTesla)", "value": "28871b106b1ac2a889a134dca8607762", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654663267, "uuid": "21d56668-f095-49bb-8582-4ee6b2775a1a", "comment": "Malware payload (AgentTesla)", "value": "554bf783cd947c0743e81f65c550a45eae8a4021b1e1700b590939dd3cae3321", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654663267, "uuid": "a3eb5047-0799-4b3c-970d-0ab72e232350", "comment": "Malware payload (AgentTesla)", "value": "165f99fce95c8fc01ecc6700829d4947c234bd01", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654663267, "uuid": "c8c81c74-2562-4e02-97d5-1fe42335b37e", "comment": "Malware payload (AgentTesla)", "value": "3a31b2a1da130827a618f4b65f2eeaa884c5e01ce72c558bab1bf2bf5853d81829069193f41957f61b1635aad0889bfb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654663267, "uuid": "c7da4d04-ae99-4ec9-9ff0-2d05a8eba193", "value": "T1F8159C9C3650B5DFC86BCD76CA941C60EA60A4BB470FD247A45316ED9E0EA9BCF101B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654663267, "uuid": "fa5f5806-1d92-4a6c-ae62-5da90f6e60eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654663267, "uuid": "43554e31-a7ba-4aa2-9793-87452be9a550", "value": "12288:JpQWCqgpJslMfkphAE178P3tutrA7ZEWRQ3q1PCFm6P6bo9qkCPPGGEDP6COvGhq:Js9grPADPkt0lESpClCbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654663267, "uuid": "de5ab14e-60c4-4abb-8014-391a3911787e", "value": 876032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654663267, "uuid": "fad2a4c7-8b88-42bf-9ec9-9ae6a3b2f56c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654663267, "uuid": "c0799515-3569-4799-8b42-d6173078352f", "value": "SecuriteInfo.com.W32.AIDetectNet.01.22641.30093", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0897652-e6c3-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1654648950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654648950, "uuid": "13ad4e34-472c-4049-852e-927b0c051808", "comment": "Malware payload (Loki)", "value": "5d812cad1b8dd715ec8fe9ce26041703", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654648950, "uuid": "b1bb7491-8004-4e46-b6e0-367d65830eba", "comment": "Malware payload (Loki)", "value": "555cf5e6e5c6f8255c059089408854453aa4bd4f9250acf1f701c9c6161ee370", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654648950, "uuid": "114f6352-b753-4ba7-baf2-deec59312552", "comment": "Malware payload (Loki)", "value": "159b98e08d4883f0d12d69769f2471a34dbd3deb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654648950, "uuid": "9476b567-1d1d-4c44-9979-5d1ea84afd7b", "comment": "Malware payload (Loki)", "value": "7d61682fd7c77dc69dd5d705a8dc752c95bd9bc6d664fd775fac4cc8577d47d0c0688037f2b4889955d69cf47f228ab0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654648950, "uuid": "297c3e7b-0eb7-42d8-a982-f66d5768dd93", "value": "T127F4E0007712FC7EF12A4E379CA044006760525E82ABFB67A5DD36CD645F3CB1AF6A92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654648950, "uuid": "f376a573-268f-44a4-bfa8-31101235fbf3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654648950, "uuid": "08c2dbc7-99bd-4a19-9121-6d29845dfe9f", "value": "12288:cqX4UdELJH4Gd9riM4wn22iNd9qOgotxw2Nun86mBodD0oXh6PMyt710cf2gj:XXrkn21nxZDVNuDmmdgoRmd71L2gj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654648950, "uuid": "75030c91-6706-459d-a0ab-0991c8f08d45", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654648950, "uuid": "11eb6a6f-e305-4dfe-a174-52e1baa33093", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654648950, "uuid": "6666f65a-71e9-45d5-a666-fb15280020e6", "value": "DHL-08-2022.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceb3f15e-e705-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1654677267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677267, "uuid": "df9b94e3-6c84-4eb9-a76c-3d1feeab77d7", "comment": "Malware payload (SnakeKeylogger)", "value": "a45cf282596ac9dd6f07ee97a14ee46c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677267, "uuid": "6f6b0580-8f97-479e-bd43-55b6095b4a08", "comment": "Malware payload (SnakeKeylogger)", "value": "55cd81b9fba9571714d1a13ec08dcf84677c0b2ec408f06e568158aa4959d515", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677267, "uuid": "07e85f2c-74bf-4a0c-b804-5fca157c3eef", "comment": "Malware payload (SnakeKeylogger)", "value": "dedfdab6eb1f9d42e1fa7b348b31d89057a23952", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677267, "uuid": "ba612146-78eb-428a-9756-5995b21a7b6f", "comment": "Malware payload (SnakeKeylogger)", "value": "696d3da458ba94099a47100f13c99afc2e2dd10198b9974bf7442b0515e4bcead8f91d0ac0557e2eb4606c5d60c81e69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677267, "uuid": "cf4da12d-d7f6-4b19-b477-e0d81c3ab1a1", "value": "T1BA156B8839D466DFC4A389F29D94FF10B62D795E834B8E47BD131648A80D1D28B352EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677267, "uuid": "a344be2d-fe29-4db3-b452-2708ade24555", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677267, "uuid": "cb090e80-ba4d-4f02-8452-f8f46cad9453", "value": "12288:imgi2AalxkJwr+j1iEMwNLYJffgfEtiY54d3oIDkTt1PKstGhR3G2qXYZ6bzBReT:i9i9dN1JsffgfEtiYooIDkT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677267, "uuid": "a6f5eaa2-e12e-46b5-9c10-e55665cc5991", "value": 886784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677267, "uuid": "3764a0df-274a-48fc-8936-7852fc49a0cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677267, "uuid": "bd50ca6f-1e74-4c3c-b3af-6142d53929f0", "value": "Sun LPO.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fef1b2d5-e706-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1654677777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677777, "uuid": "2f93a463-3b70-489b-9a90-725ac3252183", "comment": "Malware payload (SnakeKeylogger)", "value": "018e377e68404c42b735e0f9c3aa64cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677777, "uuid": "389642f8-6418-462c-9f4c-28e8e12bb11c", "comment": "Malware payload (SnakeKeylogger)", "value": "56d2ce247209a1f69293c66166acebffded573cb28dfc39437264c37eeea1b96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677777, "uuid": "75044500-3cf3-4e64-b142-b0f14148499c", "comment": "Malware payload (SnakeKeylogger)", "value": "a18d1d68320a59b7154e58d93379853f433bf1d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677777, "uuid": "1862190c-4197-4354-9405-401116bdb056", "comment": "Malware payload (SnakeKeylogger)", "value": "cc9cf696e8be615962ee956f2db61271d7bf0d6de531442c3448d1864dd0e344cfafc791423e598e86d7530b44bfeed1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677777, "uuid": "325cdff6-5779-42c4-a1c2-4d69e1e78da7", "value": "T1E5E4F1D26D68BB66C83A97F83172947C53B37E6E2610D34E8D93F8C92470F444A26D93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677777, "uuid": "a3d44164-c53d-49aa-a5f8-d625373028ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677777, "uuid": "ddc45e0a-6beb-4b15-80c5-8055914eae0c", "value": "12288:sbejtcAa9Ss5RfuV+o0oaIpqKpTUfb2/yK5ojnKZtqmq0:1t8j5u4Ipq7b2z5ojnF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677777, "uuid": "5d9fb3ad-3b34-455f-ae91-3c98504610eb", "value": 688640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677777, "uuid": "d3cbcfa6-4bca-4acb-842c-cb6ade5ffad9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677777, "uuid": "9c1691ff-ee01-4f08-916e-5f31b076bf62", "value": "018e377e68404c42b735e0f9c3aa64cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1acce224-e6ca-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654651624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654651624, "uuid": "5cef9291-0f86-4c54-832c-3e3b58fc1450", "comment": "Malware payload (Heodo)", "value": "891ebc1a1418b6cd52cf5dc6e000ddd9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654651624, "uuid": "50639174-4077-4ccb-b897-6c5b9093761b", "comment": "Malware payload (Heodo)", "value": "575387155ba18497f83b4950fcd1f9b3ed91dbfefeb2023a88e5a6c4752fa72f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654651624, "uuid": "47855865-e2b0-4318-9c64-1bebe4aacaf4", "comment": "Malware payload (Heodo)", "value": "73594a4d86f642a15a9a53627b538bbc65b292f9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654651624, "uuid": "6ffa707d-379f-43ee-bbce-b21ff578567f", "comment": "Malware payload (Heodo)", "value": "df81ae845fd13d142f523de3de7b948f46d21a7c879de9cb2aed4bbdbcb7cb78b6663f3798173df3340d845db6538f0b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654651624, "uuid": "b4000a4e-12ba-4522-b471-6dd32c17942f", "value": "T1D704023EE5031A98C22ED8FC58EE6DF9D5F634006268062A1BA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654651624, "uuid": "25184136-89f8-44fc-bbba-c2d0db9e4503", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654651624, "uuid": "34878e24-48fd-425f-8793-4038c957b761", "value": "3072:VpjftSFs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VR0i1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654651624, "uuid": "8982987a-31b6-4cfa-a2c1-dad94b6270a1", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654651624, "uuid": "70bfe019-b679-4b1e-b35f-82d25bcd8143", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654651624, "uuid": "65f87a84-52b1-43a4-a4c8-786411681e3d", "value": "891ebc1a1418b6cd52cf5dc6e000ddd9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9328ecc7-e76c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654721405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654721405, "uuid": "d9652df0-bfc1-47d7-96b8-d755f74a6790", "comment": "Malware payload (Mirai)", "value": "b06230367aa619daeeae1602c29443ef", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654721405, "uuid": "d3f3f521-a06b-4975-bcba-667d1f5eedcc", "comment": "Malware payload (Mirai)", "value": "57eed917c6ba5cd7c0f842f9e1fa287c534a6f1b81fdfd1d96454f99013bd9a4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654721405, "uuid": "3f2338f1-6018-4b9a-b2c9-96fa483c3870", "comment": "Malware payload (Mirai)", "value": "04462cf14f313d8e5aaee1b02aac1932d9ba10bf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654721405, "uuid": "83b8a8de-d964-4cba-8cf4-fcf776829bb4", "comment": "Malware payload (Mirai)", "value": "a03152a5ff31c18e303ea5fbc4332c6ebb7f390b890b2c07686e2269aa0c72f0009949f75ad199aa5ba2a634aba5c9c4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654721405, "uuid": "429a5fd4-9b48-4ccc-a360-6bc9630a202f", "value": "T1FDE33B46A6408B13C1D61B76FA9F42453322DB54D3DB33069928AFF43F8779E4E6360A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654721405, "uuid": "98dc3fc3-bb26-4fe4-814f-2992bbefcd3e", "value": "3072:6sBAZshMAREoNaUxqTbcYXxlVHWDdpuo/PvaM/9whaZ:6sBabOvNaUxqTbpXpQpuonvaM/9whaZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654721405, "uuid": "139d97f0-1fc6-4d5f-a627-f09f2c37899c", "value": 154210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654721405, "uuid": "685a419a-30ab-4e4a-8fd2-9c39f26797f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654721405, "uuid": "c468f619-695e-4b7d-97c8-35b76693e591", "value": "gatoarm7-20220608-2050", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "186d4265-e74d-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1654707884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654707884, "uuid": "da446c74-8eec-46f4-8d0a-a0fa224151e9", "comment": "Malware payload (SnakeKeylogger)", "value": "0fc8af155a3e8c38d3432188ed5bb73c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654707884, "uuid": "a9ed5dca-e1f2-4963-995e-21e129ea2a01", "comment": "Malware payload (SnakeKeylogger)", "value": "58cd0e141b0130d367c7dbd9ed379bde94fecfa86b1989f107cc95de80ca875b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654707884, "uuid": "bd369ce3-330c-4c12-a0d9-8ddae2c479d0", "comment": "Malware payload (SnakeKeylogger)", "value": "c094606b57da6359fc7468e039f5461920f5ed00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654707884, "uuid": "bcbc6a37-5840-4567-81e2-7794d85d559f", "comment": "Malware payload (SnakeKeylogger)", "value": "4b1dedf43875528442864e2282ffcecc419a345d3c2567d00c2a19613f24dfd55b8a73567311cc47ba32e99d720af093", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654707884, "uuid": "e5bb8abc-6077-45c8-84a1-28deadb2da9a", "value": "T123E4DF307696A24CC82B4F724C7149C067B63A777F09CB5E285A139CDD6BA438B126F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654707884, "uuid": "4bba2d98-1ad6-4ae3-ada9-f4aeadb74a84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654707884, "uuid": "569881f4-bdcf-419c-8f7a-ab658663044d", "value": "12288:DLVZb/bpY5i+OS3FDdpbSxJ7leKWeMkwo/PBilaGocl/r1oFDusJrzQ:DL9S1HbKkeioHIlXlra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654707884, "uuid": "b6420602-b34e-4898-b753-f3d7efc0d44e", "value": 716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654707884, "uuid": "ca09014d-2d96-4936-9145-64c37c8d944a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654707884, "uuid": "3a6ba900-36ae-4150-bb26-8516695c1e7a", "value": "MY CV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0f4474c-e73a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1654699953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699953, "uuid": "daf0ca5b-903a-4509-8a1c-29a1ca92d8be", "comment": "Malware payload (Gafgyt)", "value": "8d5fbd80a842c8010b3c236e149d91e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699953, "uuid": "6c555539-3879-4415-8eb8-d545bcaef1ed", "comment": "Malware payload (Gafgyt)", "value": "5986c622305289fd869780547799830b8dc03e91235f548f86ef9aa35fdb02ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699953, "uuid": "6c8fb8dd-0fba-40d8-8a61-6f661a3f56a8", "comment": "Malware payload (Gafgyt)", "value": "bd27cbb1bc7a2607d414eac4f7eba9df641f1378", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699953, "uuid": "8e671c4d-a6f6-4947-b792-31eb9bac125a", "comment": "Malware payload (Gafgyt)", "value": "1e0e743a8413443b1de1e451ee2fd5c06d3bb587604cd976f5664c49aec52e6804d0f43e4bad2e82efa7657243cf383a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699953, "uuid": "492fd043-6530-4cdb-8b40-6b94a6519930", "value": "T116A32947A9218FB7C042AAB525BB5D740B23BD911B4B1A953428B7F4033B5DEB80FF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699953, "uuid": "dd18a246-5bee-46b5-bd5b-d19347fb9653", "value": "3072:DqimxaqDtXh/WMDLy6LiYmHepbbqEn/6NS:DqiCaqrO2y6L/mHepbbqEn/6NS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654699953, "uuid": "a430f965-ed06-4f51-82a4-3e0015bf2a55", "value": 104485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654699953, "uuid": "c74bc517-4a2f-444e-b955-8c889db79eb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699953, "uuid": "7f83487c-6a9b-4157-8890-60aea2879f76", "value": "8d5fbd80a842c8010b3c236e149d91e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2148136-e705-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1654677245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677245, "uuid": "5e149cd5-3867-4468-bc6b-e698be96ad2a", "comment": "Malware payload (SnakeKeylogger)", "value": "5e7397d209ad1dc4a9e98af24cd8679d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677245, "uuid": "7a7ecc8a-77fc-4f5b-af66-8fd5cd217fbc", "comment": "Malware payload (SnakeKeylogger)", "value": "59d85d6c04ae6e9d2bf0d4aec51de85cbef454fcf4431e4e59bec8be4b9cb901", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677245, "uuid": "8425ab1b-75a2-4c79-b746-8969445e8b80", "comment": "Malware payload (SnakeKeylogger)", "value": "cebbd8ef633ce4c53bb10ad6f397b4d9e07183d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677245, "uuid": "be82fcf3-6398-4008-a899-bba5009fa7a1", "comment": "Malware payload (SnakeKeylogger)", "value": "8aa2637ce2a2f7172925c62884282a34d02c0300e70647c2f9b84531ec3d02a85ac392e86b885fd4828298d6e48bf1e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677245, "uuid": "9f177100-6753-4548-93f0-1a34dbfb264a", "value": "T163F49DAC765076DFC86BC876CAA82C64EB2064BB530BD203A05715ED9E0D99BCF151F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677245, "uuid": "de7f095d-c745-4e7b-98d3-fc9532468af3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677245, "uuid": "976f01d4-4308-497a-8b8e-dc6889da3021", "value": "12288:AGVgZI2iNQAaWFMiFpc6sNpFVUgQ5l5GAxq6EL2euxWGfB2fglKkrbcqn3U6jtT+:11xBFM+SFVzQ5l5lq6EL2ca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677245, "uuid": "10d24ee5-0fbd-4530-b828-3bca0346a820", "value": 755712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677245, "uuid": "07be95cc-ec89-48a7-a8e3-a8b5a64b9a9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677245, "uuid": "614e46dd-8ff3-47c6-80be-af752f976485", "value": "new order 20897341.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50c0824f-e73b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Quakbot)", "timestamp": 1654700248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700248, "uuid": "f05ed32b-5651-4e83-991b-896ca86e42aa", "comment": "Malware payload (Quakbot)", "value": "9a89143915e5b62674a6f32217ac3085", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama187", "colour": "#0BCF63", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700248, "uuid": "1c393d9e-9858-4d9a-a900-5cd615a2b4d3", "comment": "Malware payload (Quakbot)", "value": "59ddeeed7cb3198f3d961df323c314517a6c0ee096b894330b9e43e4d1dc9c5b", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama187", "colour": "#0BCF63", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700248, "uuid": "498b10e3-a3d8-41d6-b4e9-af63a2fe403f", "comment": "Malware payload (Quakbot)", "value": "a2d4cf1a9f498ff1ebd2363015dc49ecaa0750a1", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama187", "colour": "#0BCF63", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700248, "uuid": "1f02f04d-b213-4729-86a5-f99ef1bb652e", "comment": "Malware payload (Quakbot)", "value": "77ca2cf4aab015371322d699e7c2aebf39eeaeca4fb4356a92faaec5ce7a75e2962995137040820136ed74311acb1ba0", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama187", "colour": "#0BCF63", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700248, "uuid": "8eee2e91-9de1-44b8-8e12-d05ce61c248b", "value": "T193D423314D47EE8D47BD760564BB3A1D1FB079CB29C4E8C9621A93A2101F78FC8A9DC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700248, "uuid": "f64c7fe4-2f6b-4062-9da4-05fba146109d", "value": "12288:NeqnlRZ+vFb8lw0jMhlQ7DZSFZ6GkcTEVx6a9qX7UzY:EUbsFD0jMhl6DZU6GkcTE6GAp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654700248, "uuid": "4be94d06-2fad-49f1-98dd-db769e801ea9", "value": 647640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654700248, "uuid": "8fb6cfdf-eccc-4139-83f7-ca3b31a3e481", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700248, "uuid": "f1723338-d098-479e-a085-a7617c8ed992", "value": "ScannedDocuments_7003402.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0df85c7-e6dc-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654659634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659634, "uuid": "0f7e1c2c-90d4-48d6-9984-645ff5e78860", "comment": "Malware payload (AgentTesla)", "value": "2023e4a74a791a31433526487a46a7ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659634, "uuid": "013bb582-ed1a-45a6-b6f7-15998616213a", "comment": "Malware payload (AgentTesla)", "value": "5a32cc367669d0ab7fd55f6262fddf6395bfe71124683f15bf8f1497eb5d4a42", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659634, "uuid": "6a08ff0e-deda-48e5-909b-8fe1286e4f56", "comment": "Malware payload (AgentTesla)", "value": "e50d3b30b6e7c0009f469e5ea9ce0ba17b543b98", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659634, "uuid": "1d0d3f4d-5c0a-42bf-a659-ef7e331b2291", "comment": "Malware payload (AgentTesla)", "value": "5a784a06f21bfd1ffae7811c3d1a598454e2a6723980f7bfcd27200f369b7de2f6244c9b5b5ca1f646d245f652b17c97", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654659634, "uuid": "bf6b1562-6b09-4dd2-8968-b8263e0cc933", "value": "T12FE4122476EC0F62D53E17FA84A4144143F8EA2B296BF30E1E8525CF1D7BB91CB66253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654659634, "uuid": "8be6396a-8e7d-490b-b10c-d49c97a4dab6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654659634, "uuid": "fc221964-3dc9-49fd-a8c9-e88b1aeebf73", "value": "12288:YxpyQ1cMGytHuUKdSsJWuZMhapvJDNRiTozFv/c2Bs1Oo4xbdkiqWqqy3lIIbo9q:O62KdxsuZMharNR0ox71xbXqWqqUlIIM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654659634, "uuid": "dd58f1c1-7c55-4d49-a2ed-21b811c262c0", "value": 691200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654659634, "uuid": "2220ddda-0be8-4308-bf16-56030f246442", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654659634, "uuid": "07b1bfc2-9d07-4f3d-8165-249bdf2a7503", "value": "SecuriteInfo.com.W32.AIDetectNet.01.21083.3777", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f94eb72c-e770-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654723294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654723294, "uuid": "dadc6db6-2d5b-4cf2-bd63-a666244ea315", "comment": "Malware payload", "value": "e6347cdce7f0b76d63eaf7ed27ffc65e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654723294, "uuid": "f314712b-54cb-40cb-8868-38309293914d", "comment": "Malware payload", "value": "5b27a94d4bc1f2d123666bcbab54f08c42d736953e9189e9ff917a256c8657a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654723294, "uuid": "e34280ff-f708-433f-929a-ba954544b033", "comment": "Malware payload", "value": "7b1569318c0ba6c4ff9a78903b71535e2e20a32e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654723294, "uuid": "70d766b5-e75a-43ab-8414-3a674901e221", "comment": "Malware payload", "value": "41b2ac6f87f1159e4e4dbb134b383314f96e507fda666354d9b49a3a1c88604eddbc7bbd90cec29c3cf8c3719152d0aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654723294, "uuid": "5382e931-4bea-4d13-822f-7c36c6f0d95c", "value": "T136448D10FB90D034F5B716F449B983A8B93E7AA15B3490CBA2E91AED57356E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654723294, "uuid": "88fa9e50-313c-4af8-822b-e8d12b86887a", "value": "f3934bb0048d44387137e6b580143d69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654723294, "uuid": "0975ec58-fd53-4f42-995b-2af75058d583", "value": "6144:xaezxQdiIdPMeDfnbHFvTbMxm+I+fe50E1CLb6kha:xa9jxMy/bHxTmBK5FCLOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654723294, "uuid": "9f150bd7-5ca1-4f87-ae81-55566d2f7a98", "value": 273408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654723294, "uuid": "33105833-be1a-46de-b1de-a8b584a8ab0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654723294, "uuid": "bb7076c0-e148-4cf2-a944-fcffe42683fe", "value": "e6347cdce7f0b76d63eaf7ed27ffc65e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c59c4b1c-e72c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1654694002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654694002, "uuid": "fa5d509f-d519-4617-9881-078119947a7d", "comment": "Malware payload (Loki)", "value": "c58e35035e3b59825c2b63cae9095545", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654694002, "uuid": "f6266dd8-465a-4469-90af-cdef25ad7f6d", "comment": "Malware payload (Loki)", "value": "5b5bd50012b9848d1355f91c4f3efa38100c1a9363eef979e8f2b77e0251caaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654694002, "uuid": "0065ea39-3058-4186-8687-88b9ec1aecbb", "comment": "Malware payload (Loki)", "value": "05be15ddc268c5df9b647213732f67803d1a3c18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654694002, "uuid": "9e2012c4-b4bf-48f2-92c9-f66d65f2f1e8", "comment": "Malware payload (Loki)", "value": "2b540bdb786c1bd5179b3490177ab0811dc623525e60ceaf2bc98cb3ecfbfe106f3ff7a7e183dc0cd73078219c8dc6c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654694002, "uuid": "ddb3b84c-e431-4417-b3a3-a465e7889f8e", "value": "T17832F80637D88335D5B90A3648B363400B75F566D926EB5D7DC8728F6DB33408E62BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654694002, "uuid": "bb54d06a-b9d7-4619-a340-2d770b1fa8b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654694002, "uuid": "3cd3cbea-14fb-41a2-b3a6-05e3466929cf", "value": "192:tcO4UCWFZhFNIcsLs7T/XP4bWBhM9NouvzfPmYLfIC2aB:tb4UCWFjFmraXP4bgy9+uvzHm6fIva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654694002, "uuid": "a30ec52b-9b21-4634-bb9c-85ef4fa7c70d", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654694002, "uuid": "a6f16253-9200-425d-9489-dd36df9da29e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654694002, "uuid": "17bad105-3f51-4894-9086-806ece66a7a3", "value": "PO.SA Fresh Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f14a9e-e73b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Quakbot)", "timestamp": 1654700255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700255, "uuid": "0bd8a017-2827-415b-a7d0-f6981ac1a0bd", "comment": "Malware payload (Quakbot)", "value": "efb7bd0ce3ac847f3d145a55df5239bb", "object_relation": "md5", "Tag": [ { "name": "obama187", "colour": "#0BCF63", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700255, "uuid": "03171ba7-aac4-4453-90b1-d676329d6d15", "comment": "Malware payload (Quakbot)", "value": "5b99c3a4c9fd79a90fd7f2d0c743de73c4a4c053fb326752c061ce5ab6a1c16f", "object_relation": "sha256", "Tag": [ { "name": "obama187", "colour": "#0BCF63", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700255, "uuid": "ebd69a38-816d-4ecf-8789-e8511cbf101c", "comment": "Malware payload (Quakbot)", "value": "9e4dc53daf3874516a7f8cae823138cdfb11d3b2", "object_relation": "sha1", "Tag": [ { "name": "obama187", "colour": "#0BCF63", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700255, "uuid": "11cdeb01-98d4-4c2d-b86f-fc33d18fb6da", "comment": "Malware payload (Quakbot)", "value": "08de976cef3db4148f373eb20be2ccc3e02f4d4d2bb15221ebf8ea09967bfbce8503d7c766b3ac6c6860423a57a84d7b", "object_relation": "sha3-384", "Tag": [ { "name": "obama187", "colour": "#0BCF63", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700255, "uuid": "cf5faa52-f032-4535-8617-292328e5d9e0", "value": "T1E4A4239C716258C8E0D2A1BBD93A885858EBD4E3ECC36D2EA241771F9DDD4593CA00F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700255, "uuid": "55f0918e-7a95-4abf-95e2-e0aa31a6a845", "value": "12288:GKbIalhPL1Oqgd+KCGdq3VIWnK/ISXRQ0V8P/gJmGOfyeXlnXsmKpiQeU:GKbdPoqIUmWnK/ISXRSIJm+eVnXCiQeU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654700255, "uuid": "3d3561e0-6b86-44a5-8df2-cfc77dc1c331", "value": 484647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654700255, "uuid": "8e682aa3-79dd-4c2a-95bc-c42bb8fe5078", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700255, "uuid": "e21f42b4-90ab-402b-aa3a-099eab032ee8", "value": "ScannedDocuments_7003402.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6346ad1d-e767-11ec-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1654719177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719177, "uuid": "457eab7c-0a9f-444d-8590-3847dab83376", "comment": "Malware payload (NanoCore)", "value": "1301a9365d64e704e059b1af0471e44b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719177, "uuid": "fb42557c-88b6-4ac6-a9a8-f56fc034d99a", "comment": "Malware payload (NanoCore)", "value": "5bb3baf33d5d9c62f7be898e6f664a88de7dcd1f2d0142b6cb7bafc3807fa2e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719177, "uuid": "a2ebd9c2-1da6-43bd-8883-4743538428f8", "comment": "Malware payload (NanoCore)", "value": "9ceea7df79e2fa557b164aadfbfa1339ed2deaaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719177, "uuid": "d2605c5b-8d04-470a-9534-70a9c3637d02", "comment": "Malware payload (NanoCore)", "value": "27fcd3495264ec8be500a57fe280c7a529136db68e84be32808b2c0167de3bb7c84f4c23ee43cace2b2f9ac6016fe793", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654719177, "uuid": "28098bf1-6894-41b2-a27a-5981dffcc6bd", "value": "T12D24CF6677A84A2FE2DE8679612212528379C2E3D8C3F3DE2CD455B74F263E50A071C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654719177, "uuid": "d353f610-d1a4-44a0-a1d3-237186fc81ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654719177, "uuid": "2927efdf-f94b-4b9c-a5bf-f464c9c02ce0", "value": "3072:czEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HITDh6OwtcLq3o9kdKmLB:cLV6Bta6dtJmakIM5Eh6XtJo9kdf9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654719177, "uuid": "e58a4a02-a190-46cf-961d-0478c946d1db", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654719177, "uuid": "6dabe477-c336-4cb8-9b1e-9bba2a2a4f73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654719177, "uuid": "dc737c6f-edd9-4a3b-8224-2174de8d1234", "value": "5BB3BAF33D5D9C62F7BE898E6F664A88DE7DCD1F2D014.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91d2b00f-e749-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654706370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654706370, "uuid": "6c3b8a74-18fa-4d92-8023-8ae82abfb5c7", "comment": "Malware payload (Formbook)", "value": "7125f9e977e2fdf012ac976cfcbb39cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654706370, "uuid": "d6e02ef7-88e2-421a-8a06-d1621514c421", "comment": "Malware payload (Formbook)", "value": "5c36eef30cb810844a2ef2322935cef4816d62c72bf771d57b82ab019dcfbc91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654706370, "uuid": "a26bb73b-6bd7-40e0-8e56-716ab64a874c", "comment": "Malware payload (Formbook)", "value": "783627bd90a732371093c089f0cae24a8bdf9379", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654706370, "uuid": "c49438e0-e827-4e95-9ce4-634c0f78eb06", "comment": "Malware payload (Formbook)", "value": "73f3e727365715727c7c519218e384582f909cb40bd681e34204baa6bacfd1ffdbd74301c4af8d9955b004253fd26d0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654706370, "uuid": "8c3c3f30-055a-4da5-b4d6-91d6cee9516d", "value": "T1D1C4BFE06BBC7A60E17AD7723050912923F2584FFD22E42ABE97948E2545FC052F1E77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654706370, "uuid": "53c28970-b5db-415b-9f37-618f30068fb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654706370, "uuid": "9ed14d78-8bb4-4e6f-aa09-4b56d75a81ec", "value": "6144:jIW/sFPON04q0iglorQSwhvcAnSv1i15KoWVTHRjx2Vl6sEMXzt2wlvYJI91t6EP:jQiNiMSC9nw1kse6sEMzspJITt6Eia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654706370, "uuid": "920eb8dc-d551-472b-87bd-9fbb9414a161", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654706370, "uuid": "3368474d-521a-4498-891a-3884db5c093f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654706370, "uuid": "07498568-2b6d-4c25-b872-87cf3ac564d0", "value": "SecuriteInfo.com.W32.AIDetectNet.01.12168.20981", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29a08655-e729-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1654692451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692451, "uuid": "92595069-bdea-40d5-982f-aa88fb0dfe11", "comment": "Malware payload (GuLoader)", "value": "ae7f0da437e240ca0de0394891b33e72", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692451, "uuid": "01552a6d-eff1-4814-a47b-bf26e9824f3b", "comment": "Malware payload (GuLoader)", "value": "5c95eed03d9b4cb4110580ffc3b3564db8eb10f2d163bf6e842272fc645fa0c4", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692451, "uuid": "0009c41a-e2ac-4414-8ca5-84a3a5971d54", "comment": "Malware payload (GuLoader)", "value": "a835f8d0c29af09827305191d5263071015431a3", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692451, "uuid": "c7dac456-abf7-40b6-a941-5d82d4b1e830", "comment": "Malware payload (GuLoader)", "value": "db4176617a3ec54624b5cd44abe528625652af4d3b0296b84ed4dd866116b5bf0f7703d99f3433bc6c079e4fcaa67214", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692451, "uuid": "b9a1bb96-3c3f-454f-8670-bce339173510", "value": "T18F64F788736598458DBE2099795DC34A4F48124AA3E7E772874282F9C755033FB3BE8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692451, "uuid": "6133ee4f-f3a1-432c-86d2-4bce296a8eb7", "value": "1536:oMODKOBC67Og2Sqy5LWoGJaSjGLgYOXtaqT9l3Fr98TqxrZfHdS/2oneqsmci:zUKqp595v+jzDX7rJ9LBHWzNss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654692451, "uuid": "8ce084f8-a790-42a5-9110-61aaa3146dbe", "value": 332928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654692451, "uuid": "fd07a303-361e-44e4-849a-3877d3bfa712", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692451, "uuid": "5b0b7728-7f0e-4110-8014-a79ae23f242f", "value": "GEOSIDER SA OFERTA n944422 (2).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4219451-e750-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1654709488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709488, "uuid": "afa423e8-4f5a-4c4f-8e5a-d6f380a72096", "comment": "Malware payload (Loki)", "value": "a3698bf831a3eccf235c203156fb1e0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709488, "uuid": "3893b3d3-75a5-40c6-9e32-d095f7ef37bb", "comment": "Malware payload (Loki)", "value": "5dd694addc795f9b38e0092234321a589bf766697684b373df19c8ccaa8d8b24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709488, "uuid": "61cd76bd-33ef-4f5e-9e78-369ace3d9490", "comment": "Malware payload (Loki)", "value": "1934ff9253ed0dabb5ffaca1d64297a29cb6e403", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709488, "uuid": "086c1046-3aa7-44c1-a16c-5f9133f08b01", "comment": "Malware payload (Loki)", "value": "6a77c25ffee5cbfeaffec693dc4435ae2fb455092be306fb3be5f713145366546c0dabd563ccdc1aff8f891bf6812d2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709488, "uuid": "fc60a367-1ca7-4dfc-a926-65a889756bcb", "value": "T1AB359D113BFC4B2BE2FF5731A436451AB2F5F80AE766E79E1A40B6A91C537418C017A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709488, "uuid": "983e9283-d5fa-411c-b9ce-9fbf88898073", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709488, "uuid": "59ebfee5-ae1b-4056-b0f5-b0f5374917b3", "value": "24576:88jS+gqgozwcpR/Uo7biS/lpSOBs6jJIdkP:8sS+tDJvbBs6Gd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654709488, "uuid": "a92686e8-bbb4-484f-ae89-148ec2a86aa4", "value": 1095168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654709488, "uuid": "1a26b366-84b1-4f73-b61e-cdd34dff2c78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709488, "uuid": "ae630ea6-9bf3-4d3b-ac3b-470682726423", "value": "#Inv00087.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a67f77f2-e745-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654704687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654704687, "uuid": "a026a05e-a65a-470e-984f-abbb5ed344e5", "comment": "Malware payload", "value": "7b62c08943c3f7703b06e50c9ee5e3aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654704687, "uuid": "5a49e3e0-f71e-4460-9c53-284730852124", "comment": "Malware payload", "value": "5e2a11c445d66a7c1ae85966bbc47a87bbb20863260855d996564d39701ac595", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654704687, "uuid": "480c1006-40a4-4cbd-97a8-b8ce0065217b", "comment": "Malware payload", "value": "adbc2af279e6843e16db169463530de1d5f602a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654704687, "uuid": "f3934bbb-4078-4e5f-851b-923856a677f4", "comment": "Malware payload", "value": "d52b46544b7f1cac01081ff4dd1403a30830f7236d201e82af2bbdace2a7d9b4658227952eb153b1585436fae468e2a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654704687, "uuid": "a11805c1-bbb5-4b62-bf7b-44338f35ac6a", "value": "T13403F1509198C9E4E7DF6AF1B9CFCBA077E806C27661CFE63241E65A65201B33200DA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654704687, "uuid": "c2703b36-a53f-478e-8595-15b9ec390078", "value": "768:w2KTybqfE64OLdstD7qNOV4fKKee+X5ZnPdZ4uVcqgw02NWXrK4wTQmBi:uAqsjc6D9SfKKAhPdZ4u+qgw06WXrK4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654704687, "uuid": "a27e5b01-1c50-4d5b-9c7b-925f4e0f99c4", "value": 41304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654704687, "uuid": "30540e53-2500-431c-94b3-fc8d19882d7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654704687, "uuid": "b21b600d-f380-4cc2-9fab-304edb1e78ac", "value": "7b62c08943c3f7703b06e50c9ee5e3aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6028d93-e6d4-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654656207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656207, "uuid": "62a74bfb-df9b-49a4-a4a6-7e1aca572a7f", "comment": "Malware payload (Heodo)", "value": "aef3166920fa08460d7eaeb28cee626a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656207, "uuid": "33b6a23f-ea8c-4353-bc74-f792bd1fd68b", "comment": "Malware payload (Heodo)", "value": "5eb2634a630aa5c727b15a40db814d7fa0cf37d8d603d6949127a00e6af626bc", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656207, "uuid": "9013f551-6dac-4656-90c1-5e08ec5711fd", "comment": "Malware payload (Heodo)", "value": "d44f4d204906545608650a1dfbe4f3b5529eae16", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656207, "uuid": "90579ddd-2dd3-4f6f-803b-9173349ca17c", "comment": "Malware payload (Heodo)", "value": "30c02cdf63c6e73f131da96daacd19b7e58f37196e2efcd0b1df4a981c65946e9d417c0696e9700df12a58a2c2f0019d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656207, "uuid": "0275281c-1cd9-491e-ab17-f402768f384b", "value": "T12404023EE5031A98C22ED8FC58EE6DF9D5F634006268063A1BA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656207, "uuid": "f063394c-eb1d-45d4-81be-98917f529525", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656207, "uuid": "94b8e38c-b986-4e33-a15a-167dfeb7b8f6", "value": "3072:VpjftqFs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VR0i1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654656207, "uuid": "71ad988b-812b-40dc-906d-12c0d2af027a", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654656207, "uuid": "759697ea-d92e-4b7f-9e36-20b4c2f739b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656207, "uuid": "5416e211-98d4-483c-b4a6-572b102e5949", "value": "5EB2634A630AA5C727B15A40DB814D7FA0CF37D8D603D6949127A00E6AF626BC.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "767bc632-e73b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654700311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700311, "uuid": "a590ef39-9fc4-4083-a824-c597ee090163", "comment": "Malware payload (Mirai)", "value": "938038934dbfc7a7e68acece46f39c23", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700311, "uuid": "00523d14-54cf-4a5e-9d6b-b11458ff0fd5", "comment": "Malware payload (Mirai)", "value": "5ee21e8d17c67b72f2f47457d976db737f642459b6d087cebbc6c3f916762143", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700311, "uuid": "44fecde7-ebad-4c61-9943-5e9eea252d05", "comment": "Malware payload (Mirai)", "value": "66a9c00f7161867de53ae7243cc36ffb03a30817", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700311, "uuid": "606324bb-8482-4855-9afb-448ced72fcd4", "comment": "Malware payload (Mirai)", "value": "6774acb27ac50eeb7a7ecf8fb4f8f26e87b90aa5d73c62ad16e7e44ccffef9d48c70e689d493f45ee2340d33855d8004", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700311, "uuid": "4fca1e8d-83cc-44ff-99cf-c117ca01f3d4", "value": "T1D1734B42B2280E47D5930EB4253F1BD053BEEED031F0B684699F9B6A4635E372586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700311, "uuid": "3e24bcac-45ef-4b36-83c7-bfb9e9c3a0bf", "value": "768:W+VaVdlsRlRlZ14UME1hBefBM79HjW1LRSD4Sr4FQ4WPHzjnnIBRyd8zoAizmDIk:1lCE1hBQm7xWMMJ3RjEDCDIHkduMwO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654700311, "uuid": "36624676-e118-40ac-a4e5-a2a722d7b613", "value": 76524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654700311, "uuid": "c0191d4b-3cfd-4752-b88d-4aabf1908426", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700311, "uuid": "5ed20f0d-c179-4372-8e91-40d05cdd0fa9", "value": "938038934dbfc7a7e68acece46f39c23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1419eb1c-e6de-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654660203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654660203, "uuid": "d61b3708-b2ef-49c1-b8ff-8dceacb11461", "comment": "Malware payload (Mirai)", "value": "7d3eb1f1a3f431de53de75221fca7c77", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654660203, "uuid": "0a922f6b-361b-48ac-b9ff-0b125d4a1047", "comment": "Malware payload (Mirai)", "value": "5ffbfdb1afce7f11acfd860a940649f191241ce877c028b29f0ef4ff865ecde2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654660203, "uuid": "972b2035-a0da-4341-ac6e-e9be668b6498", "comment": "Malware payload (Mirai)", "value": "b747ed6617b8c19429859e2334087cc22bdbc1e7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654660203, "uuid": "6126ee72-c62e-4b38-adbd-867795fc5778", "comment": "Malware payload (Mirai)", "value": "c1f80c2c5ec15bcd95669b43fc67630f5968a0a06959c078c8dc30594e8522705e6a3e916042d23226c444d66806bf37", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654660203, "uuid": "21a63637-3418-4f16-ab88-66e97e340e6f", "value": "T140534AC5E5C3E4F6EC050839206BAB73AE73F57A6175DE9AD3D85133AC12702E21625C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654660203, "uuid": "d0d71028-4b96-4906-a42a-f04abad0781d", "value": "1536:e09VpBkbNoFMB0oOHItvjmiE0B5Wgh7xdvfzYTaFJSTi+bZ:e09VpBj3ok4vjmi3rbhFdDYmFjaZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654660203, "uuid": "06305990-f4da-42ac-ae1f-5d0550e56734", "value": 62544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654660203, "uuid": "e4ea5b35-72d2-41a5-9f2c-d24ecec8cd2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654660203, "uuid": "01cf00c3-3fae-422d-ad2a-4a26d37d4bef", "value": "gatox86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e690102a-e706-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1654677736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677736, "uuid": "d0b4916b-4d1d-4760-bd23-ac5692a6775f", "comment": "Malware payload (SnakeKeylogger)", "value": "ebe352b61274aa3fde064313d40b53ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677736, "uuid": "7b8983c9-5c93-4740-8091-cb045fc114fb", "comment": "Malware payload (SnakeKeylogger)", "value": "6010803fae462f5a1432a3c193ee4a00deac0c37dbbefec649201aad9824ef0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677736, "uuid": "610b1e22-6e72-4cf5-9569-286fd3b2bb8f", "comment": "Malware payload (SnakeKeylogger)", "value": "85e57eb6351bfb33cee9307f2c7b83ba7f61fcf1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677736, "uuid": "02235fea-a990-438d-8888-d0345a73de37", "comment": "Malware payload (SnakeKeylogger)", "value": "ec4a018cee8ccfad44d23f027181c1b9695732ae9617277be5d301186989cc7bd25a385f80b889dea5c8c16cbc4c5a50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677736, "uuid": "f5c5a102-e007-4dce-b7ae-9526a4619c3e", "value": "T160E4CF90B3BA9F71F27D63F26420A00807F4251E95A4D23A9EDDB0CE32B1B4259F5E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677736, "uuid": "5d886ea2-83fe-4e48-9a5a-0d0ce19d14a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677736, "uuid": "26d27823-718a-444d-84c1-e45cde590067", "value": "12288:xJj2I+n09qWH1YTeBdGiOIcpUeDlnVzbeV9/cexWNVTNTau8C:nKI+n04TeDOIc+MVXeV9/sLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677736, "uuid": "a6d8b498-45f3-4460-a8dc-d844cd0384ff", "value": 664064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677736, "uuid": "dd546242-dfd6-487f-b75c-b00f21114fa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677736, "uuid": "cd066ff2-b859-4ef8-82c7-ae0c3a5fd2cd", "value": "Statement Of Accounts.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bd0ec90-e738-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1654699032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699032, "uuid": "a762b264-5b67-4750-83a2-1ba4a3bd65d0", "comment": "Malware payload (Loki)", "value": "33c903a53ae822c5d6fe0478366d7e89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699032, "uuid": "be83c8a3-eae9-43f2-abf8-62a296667326", "comment": "Malware payload (Loki)", "value": "604de352cfc00690d2b3f3ca1dc90665f87f7f8274e30fdc2fb82532a578e84a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699032, "uuid": "13bdfe3f-cabb-42a0-8135-5973e4e7d04c", "comment": "Malware payload (Loki)", "value": "9e972fe4bcb024be6304e135d3827a7fd562e08b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699032, "uuid": "dbb63d4b-cdf7-448a-a97e-e9fc86ff402c", "comment": "Malware payload (Loki)", "value": "f7f53d1fb96dfbfc8252c91d370ed3aac41d25c5ffb8ad21efc9f5f1a08f6c75bb3eec2cdc6a306ecbd0bf7dae1ab51f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699032, "uuid": "ae4c55c9-ede5-4256-80e3-a6abb2fadefd", "value": "T13BE4E080A3AA9DB0F6385777647091042339352EE5FCCA29679D70CE24E678356F2F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699032, "uuid": "6ff1413c-a494-4b25-b396-d31db3f9ccc0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699032, "uuid": "356096a6-d180-4d64-8282-7996fe1c7fea", "value": "12288:hNlGgIx2iNJ9qFXR8X/BMIkfhRVenuVIbzTKK:kgIx1zqX+X+HI2K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654699032, "uuid": "138c06c7-0fcf-48de-a3d8-64dd1452814c", "value": 683520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654699032, "uuid": "fd8bb549-2a96-4727-8785-4afde82bdb92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699032, "uuid": "24ee8062-c550-40ac-8b89-d5a275cc7471", "value": "33c903a53ae822c5d6fe0478366d7e89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1354a8fd-e6ca-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654651612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654651612, "uuid": "8f43ca82-9693-4b8b-ae1d-1a3556ea630c", "comment": "Malware payload (Heodo)", "value": "59154368c75a8f5cd04a15b7cca2c004", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654651612, "uuid": "e258d8e4-93a1-4c92-8731-ae409f440fbf", "comment": "Malware payload (Heodo)", "value": "612fdb809a7555dc94efda7a5135ef8bf2925580e292426a7445dfb40e1f36e4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654651612, "uuid": "f997461a-d7fd-45eb-a3ec-afea104817b3", "comment": "Malware payload (Heodo)", "value": "dcec4ca3ca020fe90268436c9af3e1a5f99805e4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654651612, "uuid": "b1b15b1b-ea73-4e63-bea2-f02fe68416da", "comment": "Malware payload (Heodo)", "value": "0538a80e8c645581d0865e88584d538128027b1d57e9ab319a27f4d810deffdd364878990ea677044b4dc2f585bc7074", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654651612, "uuid": "449e6d6a-d9b7-439c-9ace-8c9b1e16aa43", "value": "T18004026DD14C06DDD611137CACE90F3392FCF980A0262B5BBB70A6774BA4B96DB5B900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654651612, "uuid": "75513dc1-c3ab-4981-b459-1ad6cb242f7d", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654651612, "uuid": "117ab9d5-c357-478b-a5e0-eca6aa6c257d", "value": "3072:rpjfUFcO4J8FYMh1PAzu8GmeR8dk5pL/rRn/02QBgjVcoe5Uy5i6zNL4ZNgzPKcQ:rRsWW6u8QKkXzN/09gjV/eey5/NsAziz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654651612, "uuid": "b217b42e-29f7-47a0-952c-d9ed46ccb527", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654651612, "uuid": "b0133bb2-2d39-4dbb-bb07-a3db63e42c5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654651612, "uuid": "46664034-f0bf-489e-98ab-0cfd4cd8be8d", "value": "59154368c75a8f5cd04a15b7cca2c004", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa7e948-e745-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654704702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654704702, "uuid": "e560d2d7-c665-41e8-be8b-3a39c80b6eb3", "comment": "Malware payload (Mirai)", "value": "450c65d0ef508270ad771347dbe1f03a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654704702, "uuid": "d1b07d70-f931-4590-b6e9-6b5b36ca4308", "comment": "Malware payload (Mirai)", "value": "6139fb7343b16a605e55253aa5bae393ecf0bd71f9513a79947f0fec4aace330", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654704702, "uuid": "b4184c1f-fc85-41dc-8008-216566ba1bfd", "comment": "Malware payload (Mirai)", "value": "3e00dfbdb9c3b2f02250d4a9f8587d5fa0a982d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654704702, "uuid": "2a0e3f43-cd48-4889-b5a2-f78d5433f965", "comment": "Malware payload (Mirai)", "value": "84751c712d1e77d74d3cc68e03831aeef97d77807bc2e18c2780010be533b51d5b524cd831453c08f17a01cf55601246", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654704702, "uuid": "a6a89a93-b2b9-4a8f-9ad7-222c69963311", "value": "T1C0535C34AD392E26C0D4A57E21F78365F2E6234E65B8D61D3C760F8EFF14A8068172B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654704702, "uuid": "901c4c48-7e86-46e0-96ac-8e373ab0c906", "value": "768:+VoUo3KSybT7h6pbaeoH4+Y5ZcVZKcogAWsyoU9twd8U4EO3mO+WGYz:+Vno3KSybT7h6pbaKcVZKBgAvyHfZkI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654704702, "uuid": "c203a347-0752-49e1-a461-0c9e56de769a", "value": 62616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654704702, "uuid": "3473f4e9-96bc-4b54-8ac6-6cde3adc18c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654704702, "uuid": "f11fad72-513b-495e-9d70-6765144be89f", "value": "450c65d0ef508270ad771347dbe1f03a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68b52fef-e750-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654709308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709308, "uuid": "26589a2e-7f81-4a95-9c4e-cbc4fd6ede3b", "comment": "Malware payload (Mirai)", "value": "f246414ce483b35cedc0d74658f6d09b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709308, "uuid": "dd6d6497-104c-4cb1-99ec-95a787c92dcf", "comment": "Malware payload (Mirai)", "value": "615cf824af4de426a167282c6115514024b49be774d68c65b4a931ce057ae225", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709308, "uuid": "4df33a43-1de5-4efb-b7ff-a74c0b3ee852", "comment": "Malware payload (Mirai)", "value": "ae5f204f255e4406763030febf76a6df25e8ca31", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709308, "uuid": "9b6dcf07-38a3-43b7-8d0b-63387d93e475", "comment": "Malware payload (Mirai)", "value": "8141e8cf79fce43e37f7bf4f0f639acac45dbd27f9f933f6f61ace1c0a6e46ec58a1a876aea449a384b2c100723c10ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709308, "uuid": "52df6a43-99da-4194-a4ca-4fc6958312b0", "value": "T126731946FC818E11C9D813BAFA2E118D331767A8E3DF72269D106F207BC692B0E77655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709308, "uuid": "af211941-d570-4e26-b2f8-cec46ee117a2", "value": "1536:htnyGrtLgWfYkja3HXrJTj8qZ9dSn6bBr1Ae0yern5+/LQ4MRipbkwrszXJ:2GrBf5jUlw8dS6x6ZyeIbrrsz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654709308, "uuid": "e5a80ebf-c689-4b1b-bb34-22c303b1b6b3", "value": 79196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654709308, "uuid": "709b3bf9-ce34-4d02-8199-ae1e651d2704", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709308, "uuid": "c1de1d38-2c97-4280-97ef-03533a89418f", "value": "f246414ce483b35cedc0d74658f6d09b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85af33b9-e776-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654725677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725677, "uuid": "94c5f14e-f240-44d1-8175-735606dc28a6", "comment": "Malware payload", "value": "90b11903efb8d73e6a65f6d82da53008", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725677, "uuid": "a5797d13-66a7-43b3-b334-a73fc5132339", "comment": "Malware payload", "value": "6223beda7313f2cbbfaee7138efa223fc5197d274e7511ce1ab6449b92a74008", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725677, "uuid": "179d462c-5f50-4d6d-91d8-3cf872c7b896", "comment": "Malware payload", "value": "ffc62d7b75dfc6ce0f2f4cd1ff03b166953bba81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725677, "uuid": "653e4e59-0f7a-4ed8-a642-ce1e2a096f27", "comment": "Malware payload", "value": "c663e56115f2749839e53af836a54729fbe352239f1431289603c6eea0036860c9704f3786b5f68f38f5b3866b2fcffa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654725677, "uuid": "9d907dcb-12e2-4e1d-9703-5bae9c6e519d", "value": "T1BA051947E77341FCC96BC97483A6A732B930785841397E2E4F84DB226F61F20952EB64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654725677, "uuid": "60550d50-ed2b-4d83-a5da-42fd791a5457", "value": "733e4ccf9ef47c6e471d93270b5eb898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654725677, "uuid": "1e6c4f33-6c14-4f3e-aa52-3a9d89f17502", "value": "6144:Jb5xjIShSnbDu6ee0WU3LdUsypcNfAsubd5x991A6VUPV2m7rlb4rZxcg47wsuIO:JdNIShSnbfaLdUsypcRPub04mHlY9uA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654725677, "uuid": "97549e02-82ea-4732-b696-ddee392f576f", "value": 845824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654725677, "uuid": "e255966e-e827-4977-a050-bc47a9471a59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654725677, "uuid": "19b77417-2ec0-407d-bb02-adf5377d3d31", "value": "90b11903efb8d73e6a65f6d82da53008", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4310a329-e705-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654677032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677032, "uuid": "bb4ef5a0-5a03-4d14-aad3-f98240935a9e", "comment": "Malware payload (Heodo)", "value": "075e7099c1bfd16a8d2fe197966ce754", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677032, "uuid": "284bfed0-1bae-4789-85c9-6f53b94f6255", "comment": "Malware payload (Heodo)", "value": "627469a9a9ed0fedf0a804b67cb556c6e10e3cc69b7c23ae1571d66c521448db", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677032, "uuid": "0d676244-c9af-42e6-b0d2-6e178de4b8ff", "comment": "Malware payload (Heodo)", "value": "7323e9d7607856ad4fe775a050adf7895f613a33", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677032, "uuid": "b890a109-9ea0-40c2-802d-bf1b6083615d", "comment": "Malware payload (Heodo)", "value": "1dacf7caf568ecb9457c11db8c837428f23b31c8914a9fc6282e8beb134364aeb26261238b6ce84be574e0da3e18361e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677032, "uuid": "ffbd4462-e48c-4f53-848b-0b4e746fe8f2", "value": "T17744C089ABE1ADDBD51407798DD6D324333EF2814B8387076B2598390F23BA4BFC5A45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677032, "uuid": "3db93f84-61fd-4b62-a8bb-b455c029f303", "value": "963f2e88a5b03877d0583808b2526c1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677032, "uuid": "0ad0c643-47ab-473f-b5b9-95a2e88b327f", "value": "3072:7R7ue82w+Oh+UjuFJrfr7CS/FmikytkqroMdjaWtHCqPZ4PEx2ES2vZg3f4L5ZJi:7lRJuk4uFxOmFwytLVxDtfPZ4PE2sPs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677032, "uuid": "925c1fe6-5e52-458c-b336-7befd679705b", "value": 270403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677032, "uuid": "45c8069a-9ab5-42fb-9ba9-0db069357541", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677032, "uuid": "379de9d1-5522-4fc8-b7cc-eb89d04d5a24", "value": "075e7099c1bfd16a8d2fe197966ce754", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b802554-e71f-11ec-93bb-42010a9c0043", "comment": "Malware payload (NetWire)", "timestamp": 1654688186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654688186, "uuid": "89e2e355-cef8-4153-bb35-6d96028ac79d", "comment": "Malware payload (NetWire)", "value": "6d3d5b6bcda43adad97f41660ee1ebf1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654688186, "uuid": "004be98b-89c2-4705-a4fe-43f37a26301f", "comment": "Malware payload (NetWire)", "value": "62e10c7d7f2136172cfef4c1679edbe3a9f013fb81c17b33d252180e0087ea05", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654688186, "uuid": "164e841b-fd68-40a1-9d48-49e0b8b03afa", "comment": "Malware payload (NetWire)", "value": "24d35d4d56af54e053e7bc514a42b69a2ee8433d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654688186, "uuid": "9ad680c0-116b-4313-a89d-7b57e13ce8ee", "comment": "Malware payload (NetWire)", "value": "8e3d6568b5dc92c0ea906295b2cd1ab6a1947e8afc3bd299b037c92d6f288fe6af16b4255bfccdfebd36bf20e8cb43c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654688186, "uuid": "9e9759fa-0630-4135-aa5b-b4a78e84a0f3", "value": "T1A5E4DF90B3BAEF71F27963F26420900817F4691E45E0D62A8ECDB0CE62A5B4359F5F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654688186, "uuid": "56a916f2-8caf-45a2-afe1-0cb4e8db5e01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654688186, "uuid": "4b3ed49f-b660-40ea-9db4-272546fc3bb7", "value": "12288:EJLRW09qRpu6f2iG0z793/daVB3b+HUOR7Os5v05EKrJu:iLRW0m5GQsVtbeUs5v0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654688186, "uuid": "1e7f0586-f703-4063-97af-d7f447b7d5b3", "value": 704000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654688186, "uuid": "041c7506-f9ba-48f0-82fa-0cff527d2e8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654688186, "uuid": "459ba21b-eafe-44e3-a02e-81961bdfeffb", "value": "6d3d5b6bcda43adad97f41660ee1ebf1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0d6a7ba-e6e2-11ec-93bb-42010a9c0043", "comment": "Malware payload (Joker)", "timestamp": 1654662265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654662265, "uuid": "39fb969d-6c5d-4cf6-88b1-0c9f68bd0e19", "comment": "Malware payload (Joker)", "value": "22c90e1be761de86e96e409073fee778", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654662265, "uuid": "b0a837ca-6439-4372-b922-9fcfc2ac67c8", "comment": "Malware payload (Joker)", "value": "62f93c74b4f4718560b3d68cf28d53cc0e4fc9661eeff3a70eaff8811c7c6dce", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654662265, "uuid": "c43bca86-01d4-4d07-8710-3b474b9ba05b", "comment": "Malware payload (Joker)", "value": "a043a6ed3e02631aa3e5fdfea76a2e4d87381908", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654662265, "uuid": "5c0f2991-b4c9-493d-b43c-b2f4456b7ab1", "comment": "Malware payload (Joker)", "value": "c477d1ef1696652ff0acf9b865a27018c12c6fae6758854cc237765dc452f13934e83884c9da7e8e00c8365353d459a2", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654662265, "uuid": "92f7eee4-c4b2-41be-9517-fcc5e7663b79", "value": "T1CD96125AF7A9A96FC8FB93320979123411574C268B43EA876818727C18B7ED44F47BCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654662265, "uuid": "c65a3b76-9c81-487a-9076-207555bb834e", "value": "196608:/r4lU2ceS9+PiGVlMIX+dhSoKKXfdOgGEXbBD6SOfK4HNjl4lQ:/i3BpPF8NKKdJXNDcfTjlD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654662265, "uuid": "f30a7ccc-a9f4-4e0e-8c51-aef94bdc14a5", "value": 8650077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654662265, "uuid": "25ff4551-1970-4034-b4ac-d4c29ab7863f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654662265, "uuid": "ffcb03d5-91c3-4e91-857b-8c42452e645e", "value": "Fully Camera Translator_1.0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "876289d6-e729-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654692609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692609, "uuid": "f461283c-cf28-4d51-b185-b84da65c22aa", "comment": "Malware payload (Mirai)", "value": "f4ea657b2d9723a97ae4cc2a704680fc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692609, "uuid": "9e6cee65-3c91-4ad3-b1c5-5a25e435fbb2", "comment": "Malware payload (Mirai)", "value": "635b062ac2a1835e1af30cd889a8a62ccf8f2f6a1a9d2f2be75c0ec3d4137b2f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692609, "uuid": "a42fa6da-7f23-4b3e-bb51-fa5f8da8427c", "comment": "Malware payload (Mirai)", "value": "841b0314c414b881261e0d38ab685a8106f9a65d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692609, "uuid": "afc5bdc6-5c3b-4458-9695-efb2f9ae5fd7", "comment": "Malware payload (Mirai)", "value": "9bdc952d4e155406d8f148d9eee94db13243c467f8bbcac6bcd955dbfb39cc0c4ea7adf3c8186ccbe723630d94ef1b1c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692609, "uuid": "147ae103-4e6d-4c47-b26f-1cc7bc7c61b4", "value": "T10AC34B46EB808F03C4D62776BA9F424533339B54A3DB730699186FB43F86BAE4E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692609, "uuid": "c12053ad-b924-4931-a55b-0d31ece5d3f7", "value": "3072:Wq8M7QF9TJqaoqfZxWzJpsqDO5M/9Phy91D:38MUPJqaoqf/WnsqDcM/9491D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654692609, "uuid": "13ca1b1a-50b4-4cc6-833d-ef6e53a45d53", "value": 118579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654692609, "uuid": "d825f33b-0ff1-4a81-97ad-f9be84168c67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692609, "uuid": "2bc945de-d169-439f-8e2f-01a15f38be0b", "value": "jew.arm7-20220608-1250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d0bda98-e717-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1654684753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654684753, "uuid": "8f2c91b2-e54c-49e1-b295-30d2931953c7", "comment": "Malware payload (AveMariaRAT)", "value": "80682b84608e1aae2aeb291763710a0c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654684753, "uuid": "40846fd7-bf56-4b35-831d-f2cd1f48f4de", "comment": "Malware payload (AveMariaRAT)", "value": "636f68fc02226c9ff4e8a387467a37133f7166cd366c6fd4d300081e975cdca3", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654684753, "uuid": "c2225e64-9b1c-45b7-96e7-a859da9502d0", "comment": "Malware payload (AveMariaRAT)", "value": "d83046dad9d76f1b6d7dce8267a65188d1947484", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654684753, "uuid": "0beaa777-9f07-4940-9a94-4a9358b81800", "comment": "Malware payload (AveMariaRAT)", "value": "888ea644f7e038b4623ce999a325719ed5ce3b4c138506a7a9b8c144bc460d7c94a8f62ba5f9f7182316f14be3d3202c", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654684753, "uuid": "175edb50-d23a-48a4-ab2e-720ec9adfeda", "value": "T12CE4E011B1A7DEB3E1D58B77C0C2441087BA8147E9AAF70F368813E5AD437DFCA51A86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654684753, "uuid": "4f22d7c0-eef4-4c41-8057-085c9bf0115d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654684753, "uuid": "597873b2-8045-4d87-a185-662a03839225", "value": "12288:ly3VLCwCkhx9qby8dehko+f7DrdmLskj6ajbg6nlC+K:wKkhxIeb+jDrdcZlR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654684753, "uuid": "91909deb-c5f2-4a06-8824-ac0ec9f01295", "value": 717312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654684753, "uuid": "ec9203c2-cc1f-4e87-be4b-0be0d8f7c2cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654684753, "uuid": "1227e58b-4247-4cff-a2fe-07053fd437f9", "value": "SecuriteInfo.com.W32.AIDetectNet.01.14181.17080", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81b31028-e77b-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654727818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654727818, "uuid": "71c60f23-69a3-42f3-8df5-4494e1632b24", "comment": "Malware payload", "value": "d8af71d2806e8bee29f7dfa56b1cff24", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654727818, "uuid": "bc7e5713-5ef8-4585-9637-b88b226556d5", "comment": "Malware payload", "value": "63d3f232f7db00f79b0c6d5f9d10b7ef34b83a9004f95fe2fe77c45651ffbec7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654727818, "uuid": "3ffeeb52-9577-4f0a-9bdf-8793c420e807", "comment": "Malware payload", "value": "fa7318d6996c1ec2d4c70a253963a54d43bfcf47", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654727818, "uuid": "2b8fd695-cd2e-45d4-95cb-d941b1c926d3", "comment": "Malware payload", "value": "911ba7ead5d4b9e7e573b0a8f91c5b0feee39db96ed7a15d4ccf8982eb871f01beaac506ce3d162ccba85b99ba46f1dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654727818, "uuid": "2fc88e2e-8093-46f8-9153-5acc34bda152", "value": "T14F563395D4D89AE3F918557936C17A189CB5EA6906B6867C08FBF0F80E0F30250F4EF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654727818, "uuid": "9136358b-cdcf-4d7c-b833-8c4af869f1c2", "value": "4b8ea275b01195301d047f45b8ba14d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654727818, "uuid": "4dc8d2a4-2906-4ab3-b9ff-c77e52db7d82", "value": "98304:DCTsKIRDl6vOSG3zlzsIuBGgkX1c3kwQIhuEiljQ+QodLAhA6kEwp668uNx/cJDg:D2sN6VEKIuBG3X1OZQwiljRUA6s66TLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654727818, "uuid": "7fe6a267-dbb3-4262-a506-2f860bfe7abf", "value": 6205648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654727818, "uuid": "95b571fe-cee1-48c5-ad0b-6d0786c12e50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654727818, "uuid": "4f7d1b3d-a2fa-4646-9b7f-287db0d737dd", "value": "d8af71d2806e8bee29f7dfa56b1cff24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a3a6764-e70b-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654679729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679729, "uuid": "4710210b-3bc6-4a19-88df-4dd0f6796533", "comment": "Malware payload (RedLineStealer)", "value": "1c1408cb6fa180eed0c864b9b23928c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679729, "uuid": "4c779524-d2c4-462a-9f97-6f6f65d7619c", "comment": "Malware payload (RedLineStealer)", "value": "63db624325183984a2a6187e50d0f8ba19e32260922025d619913473580161ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679729, "uuid": "671c33ba-f541-4574-aa51-24b63e1d6de5", "comment": "Malware payload (RedLineStealer)", "value": "c653179b60cbda40dc6a81fdf7db44fcd01c7c8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679729, "uuid": "6a9ef56f-e3c1-40df-b499-b0737ebd66d9", "comment": "Malware payload (RedLineStealer)", "value": "a019b2e90e602052d52985755fc43cac566df53cad1f5539491d7295f3ac5153a63c26c047957f4b6b69c3c1e93c5dbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679729, "uuid": "31484fce-8763-4d6c-a2fa-b4509703ecfb", "value": "T1D184C010BB90C034F5B712F449B5C368B63EBAA06B3495CB62D42AEE57766E4EC31707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679729, "uuid": "68b191c7-e29b-4fee-954c-4dd0f2edde70", "value": "28f9b27e782bb155192c1d4fb9991cf2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679729, "uuid": "e59974c5-caf9-4ccd-848b-2317f750f9ef", "value": "6144:0yA4l9S0w9suzdSKzxqkwqhWHag8vuiQJAtJ+ug5KjGyRjGq+JND0:0y9a0NuYYxqYhNgOBkB5Kj3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654679729, "uuid": "08dcd72d-3522-4137-9737-5a052b4bc971", "value": 382976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654679729, "uuid": "af53c8c1-6513-4fee-bd52-08c41cdb0932", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679729, "uuid": "2dcf6265-1591-4250-b310-26f1d901792d", "value": "1c1408cb6fa180eed0c864b9b23928c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a99e4b03-e73f-11ec-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1654702115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702115, "uuid": "e09632d6-548e-4fef-8dc4-c691e669bde1", "comment": "Malware payload (SilentBuilder)", "value": "85d1393196c536a20cbd3d405d5ef42c", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702115, "uuid": "662a63ff-db2f-408e-828c-9f5d5042d580", "comment": "Malware payload (SilentBuilder)", "value": "64492ee5d824de451cfe96b60031c1c0423d25b245a5574ceab98fe92bc0ae82", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702115, "uuid": "caac9667-94b0-440d-b87a-80b4d78e96cc", "comment": "Malware payload (SilentBuilder)", "value": "55473514b83ebd956e4988c51bd26f5047e1c03d", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702115, "uuid": "56ca3b60-2fec-46a1-ae7a-4e872be1c424", "comment": "Malware payload (SilentBuilder)", "value": "996483c50f2d349d55aaae689af15f91c401a0bcf5efe17a303aea0e25c70630c2cf953087bc68469b687f2c5377439b", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702115, "uuid": "6d17efc0-137a-42ff-836c-0f7f6c90a84d", "value": "T1EA23A446BB5AC85DF914873448E747EA7323EC314F6B0B433669B3256FF89A05A0325B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702115, "uuid": "9e9dfa70-03d9-4d35-a150-0bb1322ed8e7", "value": "768:hDMPKpb8rGYrMPe3q7Q0XV5xtezE8vpI8UM+VmQs7iqj/X20eu2Y:hYKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654702115, "uuid": "568fea5c-c9dd-4c99-bca5-02e3ca578560", "value": 47634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654702115, "uuid": "9aeb541d-d917-499d-9a8a-a08d2ff4b5e6", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702115, "uuid": "3e1f7bc3-c262-4080-ac18-0c3b0c243f28", "value": "Form 06.08.2022.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72745221-e776-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654725645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725645, "uuid": "7fdf7fab-88db-4a3b-87bf-04061245da93", "comment": "Malware payload (Mirai)", "value": "f9c5dbb9b297996404e9fba1e82baa22", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725645, "uuid": "34fec3a6-82bd-4084-97a0-27176108dcdb", "comment": "Malware payload (Mirai)", "value": "64d7f4588c50449d2f3f3af9d666612be71ee994f7ebf657837dcf881649d237", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725645, "uuid": "81d9ad5e-eea4-4f6a-b5c2-55ed001fa199", "comment": "Malware payload (Mirai)", "value": "041d1fe47c62495f063413c54cef7c8368a16f68", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725645, "uuid": "1bc40c29-bf3e-4fae-8a75-b47ac776917a", "comment": "Malware payload (Mirai)", "value": "963ee057e8f06815241c3340321dfbbf1d05f182cbbf8310fb8c6443022a06160a552c613a936a33f926b114ae6f6cd1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654725645, "uuid": "b53745c3-428a-4453-bc0a-46ff348933a6", "value": "T17083E60ABF625FFBD8AFED370AA90B0224CD551721A83B767534C418F61B64F19E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654725645, "uuid": "c100fc09-8a27-4016-be0d-7403eca5a5e1", "value": "1536:sYT3yRDSK8p9bbWYYcfOjx4PhmYa9akaLNQAZhpycj3ktLL3z:sYT3yRuXpJ7LPhqpaLaAPML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654725645, "uuid": "d11de8dd-5afd-49da-867e-9cefd9ca049a", "value": 88700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654725645, "uuid": "212849a5-dc57-4819-b52b-efdf766c0f40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654725645, "uuid": "52e9559d-dae3-471e-8d0f-1f85d9a24dd1", "value": "f9c5dbb9b297996404e9fba1e82baa22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1433502f-e73f-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654701864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654701864, "uuid": "9033869f-9f6a-4a3a-967f-fdb3a0eae035", "comment": "Malware payload (Formbook)", "value": "0de5e0752262c0cd5cd556fc72200820", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654701864, "uuid": "25cddbc2-5948-4c6b-a656-4393004b19e6", "comment": "Malware payload (Formbook)", "value": "652d40bb88df43cc5c2c71b746bca9594198c1e0bea923e717e093c04284cdcf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654701864, "uuid": "a981aea0-8b92-4e51-a160-b3f3f1d36421", "comment": "Malware payload (Formbook)", "value": "67e67a084f479b984df62e72f8165e8ddbcd877f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654701864, "uuid": "02b8e101-5c12-4e1e-9054-46230b7266aa", "comment": "Malware payload (Formbook)", "value": "02b9b7934d72ebdbe048e13726b5a6e2109afadceb22e67370e6dbc3d80d767f58218be65f68d50e65b187f48f4739bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654701864, "uuid": "6c8b4b41-a09d-410f-b5ce-476ae34d604c", "value": "T11124128551E09A7BF71299310D7BA22DF7FBA5D80521A90F0BD01F1A2D265C2EB0EFD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654701864, "uuid": "76edf448-2abd-4bcb-82bb-02e576f393d5", "value": "dd1742eadfc6df18ded3c26ae64ad610", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654701864, "uuid": "f28cda11-f5e7-4339-afc4-4787944d37a8", "value": "6144:Fb+sImLOYEJbhOsxOubNy2jOtTkMdOPNlo:HLOYmUBoNPjETkwl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654701864, "uuid": "bfa81c6c-cd34-4e34-b09f-b6fab968f4e1", "value": 221489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654701864, "uuid": "79a4b242-bfd0-42ba-bb69-db23991ca34d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654701864, "uuid": "ea53a74d-01bf-4b3b-b4ac-ac9c4950a02c", "value": "odeme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a444e24d-e740-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654702536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702536, "uuid": "89bb7fe2-ddd3-4cf0-bd38-bc8fc82bf4ee", "comment": "Malware payload (Mirai)", "value": "b54d25c2103cf2066b53ab02b2503b21", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702536, "uuid": "98842c14-fa78-48f6-b1f0-562147a45976", "comment": "Malware payload (Mirai)", "value": "65ae0a691d3c4917f7cd7362c65f43b9854482690dba354baf0f8495aa1832f4", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702536, "uuid": "0a1be4a7-e9dd-44c6-ad46-351bf81aa31a", "comment": "Malware payload (Mirai)", "value": "b6bcc3d5d5df16aaf13c283be40557b516dc5226", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702536, "uuid": "a3ef812d-8f37-42e7-8a22-a3b57128516a", "comment": "Malware payload (Mirai)", "value": "8712cdeb38aa46d49402ff6dd52a9713e64cc82c507ffbdf39c673ed1b78cdeaff8d6ba6bba9420635de89d6a81192f4", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702536, "uuid": "9c98dfec-81ff-41a5-9a27-f1ded1b1a0eb", "value": "T107B2D136E0479E38F87787346DB1D205C44BB30E8BBA55B13D882684670177F6B92A75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702536, "uuid": "f4a465f3-25a4-4de8-9000-d497ab8c1f17", "value": "384:MV/zy82f7822Hx2ykhdxYXWQB3CdQ7jjPKc06aYCsKhrkefeCVNeKON2XM5B7hA:oFi7/Ymdx6BB34kDtMhryceKONsMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654702536, "uuid": "577c1166-68ba-4da6-9482-88e03b4ec8f6", "value": 25252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654702536, "uuid": "a2c939ed-ee16-4a09-9f81-8b28c9600909", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702536, "uuid": "bd9f12e5-c209-4d36-9e94-efbead3f8292", "value": "b54d25c2103cf2066b53ab02b2503b21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e6d098-e76a-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654720490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654720490, "uuid": "73228d16-3f23-49ec-81d9-ddb574d18a5a", "comment": "Malware payload", "value": "72d93687cc8dd0408d62475779e08a07", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654720490, "uuid": "e06bbd58-0195-4fa4-90f9-55b52d523ef1", "comment": "Malware payload", "value": "65b9b04ec3b5a01396871ad5963bbe2b95dfcea0ef1523bc8566b7dda4929608", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654720490, "uuid": "94fb5bc5-0d80-4633-be7d-7f5e153166f4", "comment": "Malware payload", "value": "3408cd003c88df6b02f2c39a03897ada09d33a2f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654720490, "uuid": "8b69a4cc-3fa0-4144-8b01-e3369d506d53", "comment": "Malware payload", "value": "c448a83fd1feabad2cdc70c875367e5ee3286b9c24f939d4c5c475e1c7411c50e01a7c2f17aea631932223110dd509a7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654720490, "uuid": "7c5b2507-a698-4410-a6c5-9d761e306508", "value": "T18C95336EDDF60F53C6BA20F40DAFEA7541ACBC64B74189A7290635253A39B7043E391C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654720490, "uuid": "874006da-9b7c-406d-a458-0138c6b6e583", "value": "24576:kaPoA4A3It2HM8bEyZj18x35ifayVlFJlH9zRvScKbqB68XZsfrLwOpebcrIvL7Y:BzXHert5ijzLzxQGyfrebgAnH/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654720490, "uuid": "dc4315cb-9f97-40b5-aba2-3eae6f923150", "value": 1963520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654720490, "uuid": "aa676831-0901-45e6-81d3-820cede98a48", "value": "application/CDFV2", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654720490, "uuid": "2555ef24-9aab-4df7-b6fb-d34a981e614f", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.3959.5831", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb5a2b66-e6ff-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654674764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674764, "uuid": "58e057c0-6a1f-4f74-bc03-d7db136c14dd", "comment": "Malware payload (Formbook)", "value": "5f99db6eeab20b02c272c475f3dcf56b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674764, "uuid": "e5250519-51ff-458c-b7db-3ebf8ad12cbe", "comment": "Malware payload (Formbook)", "value": "685a21a449aa1414d3919570dc0aae7ad2d784685893037dfc4bd60e9cd4b922", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674764, "uuid": "8be2659c-866f-40c4-9bc8-9321fa556eff", "comment": "Malware payload (Formbook)", "value": "03553784edaebd2476d3c6fd2f44888f0b429ee4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674764, "uuid": "ec3fab0e-0523-44d2-a490-4b86ee3960f7", "comment": "Malware payload (Formbook)", "value": "a8a44e4c0c00e1cb7fa5b418cf847f7e806501c92ab2be3e85f20a24ab09ef621eb1813560102862ca9d2ed982e21220", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674764, "uuid": "3f6108a9-b78f-43fb-b2ce-47cfbef92297", "value": "T1980533463D31CDF2E871B7E360949EF69027A88E55EA8B659A54CCCF15AE3D3024C393", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674764, "uuid": "974a1fa3-174d-47dd-a171-7db55a4fe975", "value": "24576:e9g38RKwuEdgIHX+1CQXSugzph5v1O9pNr:ei8wwufI3+1CQXSp5oR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654674764, "uuid": "1a45c4ab-cd07-4d22-a23d-6f39540c2219", "value": 838667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654674764, "uuid": "ca26afc2-37d8-4b4a-9b7e-000200e5720d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674764, "uuid": "6450d804-3abc-40bd-8f2a-1f51007feaa2", "value": "Quotation_request_list.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0f3b73a-e6d1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654654856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654856, "uuid": "5c6f243f-c721-4cb5-8ad8-1693493c8bfc", "comment": "Malware payload (Heodo)", "value": "b0500e4fdc959e1dc7d99ab803b562f4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654856, "uuid": "cf9df476-2e0a-4801-ad2f-2bfab764e01f", "comment": "Malware payload (Heodo)", "value": "686144558f5f8a0c26fd0eb34313458ef47c8881bb8d767bd3e1c5c138d09c38", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654856, "uuid": "97e42554-5aa6-46e8-b2d5-f2ce89a85390", "comment": "Malware payload (Heodo)", "value": "e0f354da81b489ae2767abbfed22c346d03fb917", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654856, "uuid": "670e8ab6-e0e5-4bd2-aa13-9c8f4c6ec62b", "comment": "Malware payload (Heodo)", "value": "f7464709b1bd8653f13a9c89a8dc7cff7031dabc418116b82b35c583e1fd0301374551b37cd4f7256f1851cd91e79ce9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654856, "uuid": "a7e65c82-dcfd-4500-bef8-a181d18e499f", "value": "T19104026DD14C06DDD611137CACE90F3392FCF980A0262B5BBB70A6774BA4B96DB5B900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654856, "uuid": "76c2cb48-b384-4b02-9010-7f250b6ed526", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654856, "uuid": "d29bd82f-5ada-4cb2-85ca-0e4a0223c087", "value": "3072:rpjfvFcO4J8FYMh1PAzu8GmeR8dk5pL/rRn/02QBgjVcoe5Uy5i6zNL4ZNgzPKcQ:rRHWW6u8QKkXzN/09gjV/eey5/NsAziz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654654856, "uuid": "afe4ddd6-a871-4926-b21f-972915b25d5e", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654654856, "uuid": "4a84e629-6efc-4a19-b47a-3e3701ca43f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654856, "uuid": "3914fc7b-99b5-4d30-97ce-301355c69971", "value": "b0500e4fdc959e1dc7d99ab803b562f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea340b6e-e705-11ec-93bb-42010a9c0043", "comment": "Malware payload (MassLogger)", "timestamp": 1654677313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677313, "uuid": "979de405-a131-4f06-8db1-9fc203694451", "comment": "Malware payload (MassLogger)", "value": "9a5d82ec57d8b3f752cce344b45d7e37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677313, "uuid": "51141ea5-e2df-455b-881a-3ce5bb200a62", "comment": "Malware payload (MassLogger)", "value": "68653fffc060d2ea40d837afbdd54f00d9e9f05c9e86147e7008b5b397e0e615", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677313, "uuid": "e3e183cf-99d9-40f1-b13d-9d658402cb82", "comment": "Malware payload (MassLogger)", "value": "863155fd4695c45f81fe1739dd5c50f3194dd081", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677313, "uuid": "fc612b64-1a40-472a-b3f7-9313a221436a", "comment": "Malware payload (MassLogger)", "value": "d25e1743182e4044902a14e226f56634dde746b15f59ae7a539ac069ffa319729187026047ab6f5bc34d3b694b18b886", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677313, "uuid": "8b1aa3fa-77e8-4277-bdc0-5d88c66e93c6", "value": "T11F94CFD2F11042EEFD6A173264271DA659932CBDE2B5D51C60F932326BF72A3002F95B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677313, "uuid": "00188231-3dc4-4569-8f05-a34b5d3b081b", "value": "55f3dfd13c0557d3e32bcbc604441dd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677313, "uuid": "e297ff6c-b0ac-4e0c-a920-685f1b29f8f0", "value": "6144:cG8WVqB0eyYTMwBYwHiehSx03o+Q5Om0ICJS:RW0mIwBYwHiehSe45F2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677313, "uuid": "13b98e41-e59c-4b12-ad3a-e3c77368ce15", "value": 429876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677313, "uuid": "55906874-0f0c-4507-baed-964d443798da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677313, "uuid": "78095268-135e-41c6-876c-53985b9cfe5f", "value": "TS00099753456780098765.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4405bf44-e763-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654717407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717407, "uuid": "b8681d65-c441-44f1-b214-a7d92e304b1c", "comment": "Malware payload", "value": "cd53c82be5655f907211cbb254abe584", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717407, "uuid": "0478ca0c-5320-4cd3-819d-f2785b365b28", "comment": "Malware payload", "value": "6941756f07224ef744dcdee9280dd1493d9f06eba0c4b3ba5fb19eb149151635", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717407, "uuid": "6505b016-5b1b-4264-98e9-8e4561b333b0", "comment": "Malware payload", "value": "3d8916feb3b25b657e3155f6b691a54abaad765b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717407, "uuid": "64ba4978-2e1a-485d-9f59-a6b2e0553b01", "comment": "Malware payload", "value": "72a635431848c32f595a4b5a987a613be538093252e11d5333202d4ef3be8a57b4c9bae9ea021980d92cc178694caee9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717407, "uuid": "f913393a-6231-4f5c-9b98-21e8e32dcca5", "value": "T196F2E132F1C91DD1EAEB8AE06CB59BC03FF4DAA622D385E1D5C25F04E6225727504AC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717407, "uuid": "80162a5c-5724-44d2-8a1c-9f7a00de31be", "value": "768:L5nGGh+LqlSQxpnzptaFDv2cQGzDTkEnUFHUEJsuik4uVcqgw02NWXK:BGGeuSapzHGDv2+zDwGMUVk4u+qgw06h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654717407, "uuid": "02928f65-2fcb-403a-81e0-90e55b3f5d7c", "value": 36512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654717407, "uuid": "d38ef3b0-6aa9-4e2f-a2e2-781f9964c799", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717407, "uuid": "4ac2d2ba-f28d-4dd9-ba1e-0e110e840889", "value": "cd53c82be5655f907211cbb254abe584", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2fa3c73-e761-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654716841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654716841, "uuid": "6e29dd32-adef-4973-afc6-4fcf5d55ff18", "comment": "Malware payload", "value": "bed46da9028eb0a198c462dadae04139", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654716841, "uuid": "75f8dfce-0d2a-4ecf-bd27-f7de7ad6d335", "comment": "Malware payload", "value": "6a139f3b5faa1e0b9bb2a1b847687db78aae0f317443830a77cdaefb18a23bf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654716841, "uuid": "db8b4609-71f1-4de8-a76e-ed16c309b519", "comment": "Malware payload", "value": "8c770d6e8f751c481a95ed4dd9da821c8a8254e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654716841, "uuid": "ac8e2eb1-1c3f-4bbf-b8e9-ebb6ff4e960a", "comment": "Malware payload", "value": "535c55e3e07fbf352452d0b1e9fd115d79a970115da91d84f6fd987052b45d5d10cefc57af6bea406164cd50117914e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654716841, "uuid": "018f315e-ff1a-4ddf-86f8-a242f2fa45a7", "value": "T1A9532B4DABF208BBFBEE4BBB0833D1C18A339CC59EB6931755A1E6840E522C07155797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654716841, "uuid": "56e69b3e-2a51-4840-b2e9-a00d22c895b5", "value": "d04d606a5f2fa0a69cd5c8ffebc64ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654716841, "uuid": "084f0233-2181-43ee-a642-6b9a054f63ec", "value": "768:s2kFBxUf/geee/tNwqWDv850dxlpWmE7alt9L6lyQbdJXgB6aIL:s2kFkfNflNwvj/dxbWmEutLApL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654716841, "uuid": "30191a3b-d99c-4d48-957c-0dc7344c0407", "value": 62464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654716841, "uuid": "15146b1f-db61-4a8a-95c0-022346cee420", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654716841, "uuid": "3a5bb1e1-b596-4d3c-b42b-18d327fecd11", "value": "SecuriteInfo.com.Trojan.Malware.300983.susgen.4523.28801", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d88ed6f-e6ec-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654666366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654666366, "uuid": "cda0518f-870e-4ba0-9327-1665bdf8968a", "comment": "Malware payload (AgentTesla)", "value": "599066d4ce439d28ef7aa35cdac8878e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654666366, "uuid": "22be525e-fac0-4f9e-861d-d69cd172f30a", "comment": "Malware payload (AgentTesla)", "value": "6af938652e4c3aa6dbd69a06cb7b1c607f9c31dc549951d34db43aa72a23ef37", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654666366, "uuid": "5301a30f-573f-4ee7-9834-522dfbf8e7e9", "comment": "Malware payload (AgentTesla)", "value": "5143aa0e49437c91c6e11c05fc3fcb2b10563695", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654666366, "uuid": "8e12662e-eb51-4ef6-a064-881bf387e084", "comment": "Malware payload (AgentTesla)", "value": "60a9d3d35e1f8bbe223bb5e2c883761f7e49c8abe95804a3f9b74484e5a6580709d9deaf23c034af1f347a5541a465ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654666366, "uuid": "de5db91d-805c-4b8b-b3d3-f9b461dfc61e", "value": "T17B75BF05B320E757C226B33B6964FB3502A62FC6BD22EB559134A6D73C53B808F617D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654666366, "uuid": "17a43a96-977d-4276-9e2d-3bbd4c22c631", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654666366, "uuid": "89243c94-99db-4313-8ab8-9e4c0fc3009b", "value": "24576:ueTUIiYgv0EvK4zIdt8/5fq+z5fq+sOT75fq+W5fq+tJX5fq+z0sz5fq+Q5fq+:ueTcYo/wOhrOEIZJVXG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654666366, "uuid": "edb6e738-1ffa-4506-acea-d10ad5470626", "value": 1664512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654666366, "uuid": "fcab2446-70f2-46e4-84e8-62a9b95fa0fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654666366, "uuid": "09a4828a-6962-4669-9156-b4be1aa220d7", "value": "SecuriteInfo.com.Variant.Tedy.121381.11689.32275", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "743b536f-e721-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654689141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689141, "uuid": "465754a9-10f1-4dc3-a481-af511530f21d", "comment": "Malware payload (Formbook)", "value": "a9fb17bc8727aa89947c6bad96fd8d03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689141, "uuid": "bbd90f6e-b17d-402e-bc8c-d3901a4cee17", "comment": "Malware payload (Formbook)", "value": "6b4d40c6d411de3ea66bf79bfffe2bce010d25ba08278f991e4f242896fdbc72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689141, "uuid": "a434b07b-693f-4f14-bac4-b63297376512", "comment": "Malware payload (Formbook)", "value": "b4d6037898b739d3d51a5d782c1b3d2c8060e767", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689141, "uuid": "26598cfb-689d-4877-b308-a5e7837ba078", "comment": "Malware payload (Formbook)", "value": "ce6174779f713afc80a8792464a277801a7d356ec6880428165602e5d477f22e51abced277e2b1ae0049eb0a5851ab33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689141, "uuid": "d5719742-d6cf-4132-8bb9-0183393c2641", "value": "T13BE2D01AF7A4863AE9750B752E7303410F7878538C13D76FB890650BBD273A105A2BF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689141, "uuid": "95f01ab8-b78f-4c3e-bfd2-05e44849742c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689141, "uuid": "94eec6b3-8ddb-4010-9eaa-30368ffae150", "value": "768:lNDB4bvq9Nf7oSFYwQTXvLWRgcL0ST8iNxy2W:H14bvqf97gWRgcL9HNxvW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654689141, "uuid": "fec70f87-a97f-434a-8f4d-11b483fd9365", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654689141, "uuid": "4dfec638-5473-4e15-8b3d-b3213f08f1fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689141, "uuid": "cb4c6205-654a-4852-b1eb-a0ac049c44ab", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7598664-e6be-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654646706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654646706, "uuid": "f4b0e86b-cd51-4996-90a6-c2a2291098ee", "comment": "Malware payload", "value": "d2e5e051ef32e92608d2df727ffbbe63", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654646706, "uuid": "54d04427-cfa1-4a79-8496-2146d106c8b6", "comment": "Malware payload", "value": "6ba4452b0ed929b62ff80046a6aa43985aa3e63ea4158b6bd2f4d18f9e622f8f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654646706, "uuid": "ad4b0e33-5f34-47c7-8d87-69cc281bcc6c", "comment": "Malware payload", "value": "528bfa7721d6a475e3a5f04118c2425ae6904d2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654646706, "uuid": "a2f3a53c-b97c-40c3-b784-6ddd5bcaec00", "comment": "Malware payload", "value": "43a320ed38067b7aa046e3eecda5d1bd8f3521ede743fb6aaab53e0524c05f0cc811a41bf7537c59e9a89b7bcec09980", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654646706, "uuid": "24e4d63e-82c9-4b84-8c87-fd3950f0a35a", "value": "T1B33633293498C862C8B76B358DA1EB54064EFCA10D254DA717C93FEFCD350E0752B7AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654646706, "uuid": "8b4a5016-72fb-42de-8154-1c055f175a65", "value": "87269679c0a401c85bb37d7dd224ac4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654646706, "uuid": "be2de2a5-f184-4798-9b7d-f15018e388d9", "value": "98304:iWEifjf/YUwarkGvmnux7Qaux9vzpzlnbjk5yf1Fo85ZhvzaOzuyUlFgn/W:ff/YUwarkGvmux7qLVlvk5yfU6fzaOz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654646706, "uuid": "d8c1d4d1-4719-460a-97ac-04c77a815baf", "value": 5158400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654646706, "uuid": "a3d6f8c2-c2c4-4056-923d-e1690ef3275b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654646706, "uuid": "0018676e-6184-42b8-acfc-4d100a489dfe", "value": "d2e5e051ef32e92608d2df727ffbbe63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "318989a6-e734-11ec-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1654697189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654697189, "uuid": "fc9b6627-2053-4300-ac9e-5c59e9282b7e", "comment": "Malware payload (NanoCore)", "value": "a4fdc38d1e0a846d37eb4b2f25f284a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654697189, "uuid": "3c36c81c-fe9f-49f8-be63-d6a67fc6f2f2", "comment": "Malware payload (NanoCore)", "value": "6bdbf82319b9c14df59cbbe82c0b79db631510cef4f2e6a6735eeb0e329fd943", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654697189, "uuid": "2d719dd5-978a-4792-b789-911e8dd20fbc", "comment": "Malware payload (NanoCore)", "value": "d483cfea0ecf0755c9bf4ca1209a7fbf949b7e5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654697189, "uuid": "319c8381-c063-4ae7-8cc5-165b75ba17cc", "comment": "Malware payload (NanoCore)", "value": "5faae45b49aec0ccefadf528ce54e5b17eb389f2c3c20499402cbb6958cd9fd9fed94acf078a5dda24fea5cf21370913", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654697189, "uuid": "66565dc7-1d4e-4ab2-80f0-b1f819c88875", "value": "T1DF05E002B6ABCF72E2950F73C0E25514C776924695DFD30B324823EB6D477EEC542A8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654697189, "uuid": "9b2ff13d-3f20-43cd-b0dd-8e5f82d3a608", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654697189, "uuid": "e68c5512-4c68-4d85-b1d3-b74573fdec86", "value": "12288:y0G2U7hc9qK5Ao1jSA/eYYQW5GvIYNIybPyUpOdLeBOBLe17UBXJu:KhcgWSA/eNQW2NIyGUOdLgOBMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654697189, "uuid": "bc0bbff1-01cb-4ef5-9b88-9e8d52ac69be", "value": 816640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654697189, "uuid": "a70c18fa-e4ea-4038-9259-6392a9a9b2b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654697189, "uuid": "ad078946-66b9-43e0-a7b8-f7b5a9edef33", "value": "RFQ scan documentsPdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01954cb3-e707-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1654677781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677781, "uuid": "03e6dabf-2e8c-477e-a317-89908c11d458", "comment": "Malware payload (SnakeKeylogger)", "value": "128c4ea9e0d4d77cb3acec51bfdc73d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677781, "uuid": "85612972-5a7d-4580-9b7a-5c87181419e9", "comment": "Malware payload (SnakeKeylogger)", "value": "6bf22d69c7df92fad03dd37fb90fa9f61f3edcbf17f91d3d54e1c899dbbf0cd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677781, "uuid": "067cc656-1ddc-4898-8396-e988264d3d36", "comment": "Malware payload (SnakeKeylogger)", "value": "497bfe1f7ccf2b992f114a8bcbccdb6af7d2517c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677781, "uuid": "b85bd572-3123-41d8-a795-fc4b399d6ef3", "comment": "Malware payload (SnakeKeylogger)", "value": "419ff9183339137635d0a54e3890a0341997c93a79fc935055aa1be0d5d447663bf2dbe6fb07cf1d79d623b6f3507265", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677781, "uuid": "62281b67-45f1-416e-9648-cc9bb4ee7667", "value": "T15FF46C4DA78799DEED40D779DDB31B600654DAB60C6E9317E3663A1EC07F7A82C80B02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677781, "uuid": "64d9e48b-5a42-4a31-8aea-4e6efdee202b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677781, "uuid": "044bf781-b0b4-4b3c-be2c-04485b28e5c6", "value": "6144:TIcpfWvVHB4fuqlaqMfD7w/79khCD1gPjxJ3WOJg4K/obyz/LpgtnxMSklymd7sM:UuOH22qla5w/yXbxp9SzDVpv3p/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677781, "uuid": "08cc4d95-5577-4a9f-b2f7-7cc5bb1229a5", "value": 765952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677781, "uuid": "1ef95be4-65a9-4c73-84c7-4aaab57e8abf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677781, "uuid": "89cfb119-811e-462b-a858-e03d834476dd", "value": "new_invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70094b69-e6ec-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1654666370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654666370, "uuid": "fa1b1290-0f74-4d43-a549-660b5a87987f", "comment": "Malware payload (GuLoader)", "value": "47b472b461007edab2562d45159a5596", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654666370, "uuid": "bfaa0793-5ada-44a7-9afe-88d5093fb51d", "comment": "Malware payload (GuLoader)", "value": "6c1042d65a7a4711d9e1a02a768d1cebedb8d2f5a3dfe9e3c980c590e34e8b94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654666370, "uuid": "0952fc7e-26b9-446e-abcf-271f3c9738d9", "comment": "Malware payload (GuLoader)", "value": "dde094ec10dbd84f965e27ec23977ed7a9e2f07e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654666370, "uuid": "e4ce00e1-c5d9-47ac-9175-1825ae36384d", "comment": "Malware payload (GuLoader)", "value": "f283d4899fda5325c2e3cd2ea1a9f9c1877adafe346e4d0a5990ee9c110079d038d564d0906ff5a70aec448263565205", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654666370, "uuid": "b27c83b9-e608-4b19-8bc2-7fc4f87c55dc", "value": "T123946AC0E94455A0DD59AB316A37CD3596237DBCA874981D29DE3E3B3FFB2D3102A062", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654666370, "uuid": "c495487d-2891-4671-8923-8ee22859fbcf", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654666370, "uuid": "79f06e17-0864-4cda-be33-872ca488a8af", "value": "12288:sbTP7r9r/+ppppppppppppppppppppppppppppp0YzAwYyX/xzqMZtlZH04:sbT1MzbqMHD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654666370, "uuid": "66789e72-3f25-4055-ac87-64827dd5daad", "value": 448096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654666370, "uuid": "2f055f52-193b-4687-a0be-724b0fe7cc6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654666370, "uuid": "36e8f672-89a5-4ed1-b030-2e00be1feee8", "value": "SecuriteInfo.com.W32.Faker.AJ.genEldorado.1828.31685", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf72546-e6fd-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654673908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673908, "uuid": "98a0fd64-efdf-4ced-a8ea-6549e4e7f21c", "comment": "Malware payload (AgentTesla)", "value": "6cf1c4e43a899970af3f08d40885269c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673908, "uuid": "e052bc53-ef96-4a1a-be16-b495009471ac", "comment": "Malware payload (AgentTesla)", "value": "6c2817460b073cb81ca4946ef3a7e8b3496f8284dbb39402ee6c09d228bc0599", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673908, "uuid": "9846314e-d1f3-45da-a496-512f12549f35", "comment": "Malware payload (AgentTesla)", "value": "e7023daad87604884d732bda6c09a1419390d0f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673908, "uuid": "ec25b265-eae8-4b63-8b16-099e77a490fb", "comment": "Malware payload (AgentTesla)", "value": "667cafafdab1283edb879ea232278344a775b0fd686c083650cf531c0b39a221e92de3a8768c5dad70ea73c951122cde", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673908, "uuid": "5abfe709-49ad-4af9-a007-6ed98cd8f876", "value": "T14AB423808DC57717FADB01658B584AE8A341B26DD93F3ECD6DF0A117E94BB4A8C0BD09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673908, "uuid": "d9223fd1-c3fc-4eee-a3c8-0df8483f7c65", "value": "12288:tuYUNLWSnuY9P2vFEpN8zN6WSB0Gu/fkxsp4kK:0jWSnRP2iiGu/Mm4kK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654673908, "uuid": "94d974cc-8ab9-4683-979c-c804d3c5a61d", "value": 506271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654673908, "uuid": "195902cc-87cb-483f-af5f-32fe432bd460", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673908, "uuid": "6a25cf93-7890-4cad-9f14-23f610ae3355", "value": "payment copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34fcd7f3-e705-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654677009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677009, "uuid": "f8abfdf3-ef61-4d2c-bce7-25835847d356", "comment": "Malware payload (Heodo)", "value": "86dca178b66cec0484f41052f1576f4a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677009, "uuid": "46e39099-cd0b-4cd1-87d6-0e1efb700e14", "comment": "Malware payload (Heodo)", "value": "6c7c8c4306a52d42f7e5923607c4c0768f72e68bff6a6e84d1b5c3b28188fb9f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677009, "uuid": "0cdc1ad8-c13e-463d-9f3f-07b43916302f", "comment": "Malware payload (Heodo)", "value": "af6f0e39bbc27a7e3b4ca0da303b045bbc2f01c3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677009, "uuid": "85e90eaa-5a3e-4c02-9487-185a3a829b21", "comment": "Malware payload (Heodo)", "value": "f4bd24abac25f9ee3001029535af7bfe2fd319b4f090021c6b5a12fd322d1161eeca1b7ba60d7c1c712952c13dab8d67", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677009, "uuid": "ac1db46b-7717-473d-9854-b2a1f4196446", "value": "T11244C089ABE1ADDBD51407798DD6D324333EF2814B8387076B2598390F23BA4BFC5645", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677009, "uuid": "139001d3-40a4-4f28-8962-e9c73c5d5844", "value": "963f2e88a5b03877d0583808b2526c1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677009, "uuid": "5be9d150-c4c8-44de-83d8-bcfaf7a8b9e6", "value": "3072:7R7Ae82w+Oh+UjuFJrfr7CS/FmikytkqroMdjaWtHCqPZ4PEx2ES2vZg3f4L5ZJi:7l3Juk4uFxOmFwytLVxDtfPZ4PE2sPs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677009, "uuid": "7f680384-6fe3-41a5-9295-5548cdd8eda5", "value": 270403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677009, "uuid": "adf43ab2-49e5-4e00-8c57-3def701a633c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677009, "uuid": "a47f5c34-2364-4cd2-89bc-008fa7734247", "value": "86dca178b66cec0484f41052f1576f4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce88604d-e75b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654714203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714203, "uuid": "7951a26b-9965-4427-9e8c-7b073bf08f7e", "comment": "Malware payload (Mirai)", "value": "cd9f37ae6e270d76257ac21169bbc28a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714203, "uuid": "db9d3c0a-5aba-452f-a8c5-57e6c79a3b4e", "comment": "Malware payload (Mirai)", "value": "6cdad7471505cf01e7c24297859781f4e1a4441789db6cb8a902c594d0e3c8e6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714203, "uuid": "8794f197-f2f1-4395-8616-71d95dbfdc1c", "comment": "Malware payload (Mirai)", "value": "909383a367a15d1b2d96aceb2a40a2453f3bb220", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714203, "uuid": "7e1a9942-caa8-4a99-a503-eea861a1b39b", "comment": "Malware payload (Mirai)", "value": "87e2b06fc751e4ff4924ffdcbfc7929b37f7344dc066df78c2033d03913f959103dbae335294dfb5e0264b278d0e0fc1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654714203, "uuid": "7998c30f-7e2d-42dd-a6e4-8d814b2c1e40", "value": "T1A3044C46AA409B13C1D7177AFA9F024633239BA4D3DB730699186FB43F8769E0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654714203, "uuid": "fbca735f-8629-49f7-86bb-d2d2ae2bce7e", "value": "3072:KqvA6eYxOUlpN8gEFavGeCB+qsAKNDkqN5zKXml8KM/9k1wUxmOWWS0BV:KYA6gUXSfFavGeCB+qZKtFhKX2BM/9kb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654714203, "uuid": "d68d3faa-1aec-40c3-878b-629c833921cf", "value": 177305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654714203, "uuid": "d36efec2-688a-4ddd-8463-e2d645f9e8bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654714203, "uuid": "4134ba82-1254-4919-a704-2f4af254cf98", "value": "garm7-20220608-1850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ac7308-e718-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1654685204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654685204, "uuid": "121e0b7d-b993-4092-8830-4377b201f73c", "comment": "Malware payload (RemcosRAT)", "value": "09d587fc53cd9abde719c8db13660824", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654685204, "uuid": "2063ec15-e546-49ab-b45b-a68d7ee9ad81", "comment": "Malware payload (RemcosRAT)", "value": "6d19f6e852608ec704fc82653d8ba508be5b5d74c3109b21986976bc3407bfa7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654685204, "uuid": "3b32f778-ad33-4925-9c72-ddfa4c2dd3e3", "comment": "Malware payload (RemcosRAT)", "value": "aab300cfbc9969e865e375bd5493387a4189e53c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654685204, "uuid": "2386c4a6-e511-498b-ba91-b48952ed3e51", "comment": "Malware payload (RemcosRAT)", "value": "8ed4d2a1cbca52bd7b7891e12891639d97d4b0d8d6352f3c5a3bba81a230ac3430c9f9adec9be275bc5d4cf10726d201", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654685204, "uuid": "5a508e33-8c2e-4514-b4f0-8ec3ade70259", "value": "T1EE85CD514DB04598FDDE4EB01918A6E31AEAEC136661902FD3207F26E63139DFDCA2F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654685204, "uuid": "9064b6f2-6b2f-472f-af0f-a66046affde9", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654685204, "uuid": "f166ed25-af4e-4988-9c73-232d1324baaf", "value": "49152:dvBlQ5k04kb6MkOsugv+YL2EjJPQMtaj7h7b:dvLq4kvsu+3vPQ+afR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654685204, "uuid": "cbd25fd7-b451-49bc-aded-ef41300c5e0c", "value": 1750314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654685204, "uuid": "4c457ce0-e0fe-4154-88d3-335854d4dc8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654685204, "uuid": "b3c3455e-b65d-4c99-a253-f568cd7bee6a", "value": "Products Spec & Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbef0490-e73a-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1654700052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700052, "uuid": "49188bde-ea48-4117-bd34-c100eed9b3cb", "comment": "Malware payload (GuLoader)", "value": "c29b6a2504340ae2fcc2de52a7741171", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700052, "uuid": "1a3853bc-4324-4aaf-b230-0957769d0df4", "comment": "Malware payload (GuLoader)", "value": "6d3569838a125fbf8b860b5f7b871f593b8416744f7cd628bfbda814a5ef7714", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700052, "uuid": "b2a41341-1f21-4bda-b05d-83beea8e9155", "comment": "Malware payload (GuLoader)", "value": "74abd30984316cf1cf2f7fd8e5aa19d606e81cef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700052, "uuid": "a32ba522-2521-42db-a384-be79393fb132", "comment": "Malware payload (GuLoader)", "value": "545049fefecd13cd9a1d9d79738a3bbcde0a690fc82c06c949c661eba25f5d090417a1a84414e063919ffb929041620f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700052, "uuid": "114dea80-3f19-433a-900f-70ee39a5be60", "value": "T1F064F153B9449027C96E4B3194B7CFB147F36D41AA092F6F2B9437183EB31D2DB0A626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700052, "uuid": "1e82fe50-0afe-477b-a066-1788bbc8562b", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700052, "uuid": "87f0aa97-be7d-4408-bf39-af18edd19109", "value": "6144:rbE/HUyscQZVfFt4jPvLvv7VyZFKTU7ASZjKuIZRKpTrDN50b1:rbe1QJmjHrv7ILKct8Kpi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654700052, "uuid": "c922bf90-817c-4ef9-be87-cbf4a78a5688", "value": 326066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654700052, "uuid": "667d64b0-d159-4039-8909-9382579f14b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700052, "uuid": "3cc12031-06ed-4bee-9e7b-fd9c4570d672", "value": "pago perdido correspondiente.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db70801d-e6f9-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1654672134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672134, "uuid": "c1e5fa3d-3f9d-42fe-be7b-b06fa9caca8e", "comment": "Malware payload (GuLoader)", "value": "3625d77908a5d84c4f55e1cc06f59af3", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672134, "uuid": "4b88f346-1250-4a33-9a42-fd2b8808b29c", "comment": "Malware payload (GuLoader)", "value": "6d38065a5fb72cfc016800a3a2f1ad86108f3851ab8238dabd6830868b5bcc3a", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672134, "uuid": "5b332ed3-32fe-4deb-9ae6-a9ff1a6f3f5f", "comment": "Malware payload (GuLoader)", "value": "f6b21a1d165ebf3058e72d9c6fd8af4dfa7812e6", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672134, "uuid": "1ed09fd6-c6e2-403f-aec8-057cef5e029d", "comment": "Malware payload (GuLoader)", "value": "05e150174b895960149ebc737b0c0588eb884ed7f6516180bec9b85172eccd600079b2fec9c1cc5ccfa08a908980c9ca", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672134, "uuid": "150b7eec-a470-48a8-9555-43afc938e630", "value": "T1B444238CBD508AECE1950E0BECB73EED6B9B296C0D39004D564F47AC752D1E32DBA491", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672134, "uuid": "b0c6c518-4f58-48d9-98ca-807fbc69dbcd", "value": "6144:noryNgjatfPX2NtIPdk+FAFO+puGN26GaRy5ls:nRg2tXmNt0dkgA3HX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654672134, "uuid": "29e0711b-667f-49c4-ad6e-d463f0237452", "value": 255776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654672134, "uuid": "1bb48bac-d772-4f2e-bdc8-26af697b24a9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672134, "uuid": "30371bc1-0d8a-4dd7-8668-6bfb0f7dbbb1", "value": "Frustulose.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1160dae7-e6d3-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1654655474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654655474, "uuid": "cedcc5bc-1aa6-4110-9177-ec9b5f58523d", "comment": "Malware payload (Loki)", "value": "78103a3002004aebbd84479f6bc88bd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654655474, "uuid": "b8b4313a-2f9b-493b-a452-cdd6bf2fddb2", "comment": "Malware payload (Loki)", "value": "6d60bb3b3d55e79200892bd99f47a905f5f19ac3c38b23e915eaee6fb3da2413", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654655474, "uuid": "9f6016cc-9d3e-40ad-84f3-29f4c1dcfd04", "comment": "Malware payload (Loki)", "value": "1f4c002603e13a65c08e7d0c143da2791ed74aed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654655474, "uuid": "a4760af9-3235-4dd7-bc1b-4f739f0f4a67", "comment": "Malware payload (Loki)", "value": "29da5f679d33133e6f468a0c512f8b8c541cb465d68b5ae4102e18f92006fe6c9c04730c475406b5228b50278fa07a5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654655474, "uuid": "e64278f8-67b0-4041-8c70-d0fe413fb5b6", "value": "T16714D88B6C55C85AE4D07FB16CF1A1872936BCAA1164C18FE9DBFE2CAF7134417C1268", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654655474, "uuid": "08674602-c5f2-4b12-b125-26f28bae458d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654655474, "uuid": "2a237ec5-9cec-40b6-8d2b-15d0310b786f", "value": "1536:N4Xq6n/MhXVo2ZFcEEEEEEEEEEEEEEEEEEEEEEEEEREEEEEEEEEEEEEEEEEEEEEf:r6n/MhXV5/X12vexXo7zAmnfkl2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654655474, "uuid": "b0865e1f-2dba-408f-8408-f7aa25784e69", "value": 192000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654655474, "uuid": "074077c5-a41c-4953-9616-254ab37be728", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654655474, "uuid": "e9de7f64-79a2-429e-8d01-788b4c57e85e", "value": "Divjxh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a9f16c1-e728-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654692050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692050, "uuid": "0133af4c-3219-492b-9890-661b8c5c24c2", "comment": "Malware payload (AgentTesla)", "value": "75839302bfedf11a38f44de134eb074e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692050, "uuid": "33bd83f7-18de-4cf7-a0cc-01ca7d0e5197", "comment": "Malware payload (AgentTesla)", "value": "6df25138d92024a948e9ed655ca1da3dbf631113b67375e53fa6598d4fd62c05", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692050, "uuid": "dbdfd607-ec2b-4605-8459-5d28c2768a96", "comment": "Malware payload (AgentTesla)", "value": "45d68ba074f7ac8b912fb473d86a426e10b720ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692050, "uuid": "3d17d3f2-898e-4f41-97b0-a7e7583fa4d8", "comment": "Malware payload (AgentTesla)", "value": "a8894cb453c3a64cf88661f02579d3b8e25492fd4f617a1dcf2d9da2b7b8ac09fa8827e627fff7e0f2fe29b86f4d7911", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692050, "uuid": "9fac468a-91ef-4874-9663-cbfb1cf4a23d", "value": "T17305D012B6A79E72F2D50B7BC0C2C81487BF8166D0EBE35F275812E66C433DEC956642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692050, "uuid": "7dde8119-745d-4ea8-9244-61ff9ad0f2e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692050, "uuid": "17a6cd9d-c8c3-4289-b2e6-a811a9040ce4", "value": "24576:AvLqchcW34+viOwwGyy8Dl74Tqpo2NQKc:9IcW3HHwwBzl74m22NQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654692050, "uuid": "068ad15d-1a74-4eac-96ce-18ec51ac4eac", "value": 811008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654692050, "uuid": "d0371520-78f8-44e2-98b7-ae7883bdbc7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692050, "uuid": "dfefd145-8033-4349-8dab-90f73778cfa7", "value": "PO Re-order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "662ceb6f-e72d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654694271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654694271, "uuid": "38922299-d7c9-44f7-b172-20ae0109e7ed", "comment": "Malware payload (Heodo)", "value": "0f7fc267453438a612bce878120064f9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654694271, "uuid": "8bd887a3-99ae-4ced-98cc-a8eebda98fa7", "comment": "Malware payload (Heodo)", "value": "6eb58d5482db60cde32b26808d0bff2691f51e37af82f8638ca8e87131c2c08b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654694271, "uuid": "43c4f8f2-f340-406f-939d-9d4d39ebb0c0", "comment": "Malware payload (Heodo)", "value": "47f3ccc72e6a9ffb94dcfa128fbd8b782c75ea09", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654694271, "uuid": "af430c64-2f6b-48d8-bdaa-adc7e048d071", "comment": "Malware payload (Heodo)", "value": "3b3c6387589d80566ebf279ef357a66e48e3519d9f390589a8fd1ea981d9cd89782cbd7ac121a27f8a42cbca3304cf66", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654694271, "uuid": "9664fe57-626e-4f69-844f-066190658b1c", "value": "T19844C089ABE1ADDBD51407798DD6D324333EF2814B8387076B2598390F23BA4BFC5A45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654694271, "uuid": "fc9de52f-5181-40f7-8fc3-abb9027b2222", "value": "963f2e88a5b03877d0583808b2526c1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654694271, "uuid": "32412367-5d55-49d1-9062-96fad9f2ddbb", "value": "3072:7R7ie82w+Oh+UjuFJrfr7CS/FmikytkqroMdjaWtHCqPZ4PEx2ES2vZg3f4L5ZJi:7llJuk4uFxOmFwytLVxDtfPZ4PE2sPs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654694271, "uuid": "6a50d25c-d3b8-427f-b441-71394635ca1d", "value": 270403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654694271, "uuid": "ef73b897-2087-414f-90bb-0b2863ea8656", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654694271, "uuid": "b1d5e3a8-e822-4033-9058-6c7cdeb26614", "value": "0f7fc267453438a612bce878120064f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a12bc7af-e73c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654700812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700812, "uuid": "6ee713ab-f813-4cfe-a51e-770bec4836f8", "comment": "Malware payload (Mirai)", "value": "6dc19c91c37670088a1f451270609374", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700812, "uuid": "aea06b70-bdee-4114-9e0d-90146d431478", "comment": "Malware payload (Mirai)", "value": "6ef38edf326079bc4c3094b744fe50475706eb707adbe5ecab0353d88b8c44b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700812, "uuid": "d7824181-3693-4722-9ad5-33b6ff497ccb", "comment": "Malware payload (Mirai)", "value": "bbe68bc9f4238b3dcb88b0f541a2c411991803dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700812, "uuid": "ef28867b-2820-4000-afd1-b70defcbc345", "comment": "Malware payload (Mirai)", "value": "070d02a325799229ea9c3744bcf31f6f9a95a58e625474fe1e682e8a7be13a23fa3b6b929c77e139fc335f716da59a9a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700812, "uuid": "e6625f91-8b3c-434a-8642-8360e033ec26", "value": "T1D8834A35B9762A26C1C1A53A11FB4760B2F157CE36E8C61E7D720E5EFF60A406013DB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700812, "uuid": "b1f75770-3434-4dbd-a73b-e9e4b9f1b502", "value": "1536:a0ETw6HikxWS/uZEqyaJBoM6JxSmUR2gtuxwWUE:7c/uXvV6JC2cE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654700812, "uuid": "5f19beab-daa3-439b-9a84-0d163254991d", "value": 83264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654700812, "uuid": "5f64cf1f-7540-438b-ba4c-d4f4fd722d01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700812, "uuid": "7e43439d-616e-4531-afae-2dbaa476f03a", "value": "6dc19c91c37670088a1f451270609374", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e562ec92-e706-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1654677734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677734, "uuid": "eb85143a-ee66-4752-ab91-ee05e8f77dce", "comment": "Malware payload (SnakeKeylogger)", "value": "0befe129e75216711ababf33b3c2777c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677734, "uuid": "a97ef395-97ea-48ac-9d94-9b2717515160", "comment": "Malware payload (SnakeKeylogger)", "value": "6fbee1a78f579a39d536f374dc17b7e368e61e419fa51643af4221abb63868ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677734, "uuid": "2dbb81ba-97fc-4c44-91cf-0ead00578701", "comment": "Malware payload (SnakeKeylogger)", "value": "15ef4b48c7126902bdbb8a024d3d8fb296e1a9de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677734, "uuid": "f9bb9e17-9bd8-4a6c-8019-7aebf6f85811", "comment": "Malware payload (SnakeKeylogger)", "value": "0b72a7400a97631faca930f1ba8918d15dc8c1ebd1a6bbc367a963a71206fcf6af63cdbb98c12281aed3d74a0af6235e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677734, "uuid": "c8142c9e-6dff-471a-95c9-4cb9bb099453", "value": "T1FCC4F17DB9E7CE22CB582772C0E319002371561AF633E39B1A5A42D64D02BEB86D57C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677734, "uuid": "e9414f77-afb5-454d-8c7f-0c72d0c48339", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677734, "uuid": "f898f7cf-4742-4198-96f4-ed5232ee8289", "value": "12288:3I+BTZlWFYzp/VYkTkw9aE576TzDvCGe8Dcu11UIIRuCmYfL:/iSYawgG/bVYuLHou6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677734, "uuid": "9ddfd522-c9f6-49e8-a621-1da72b7b4dac", "value": 594944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677734, "uuid": "46b3ae90-f0d6-4bac-a2da-98da65b67238", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677734, "uuid": "0f4a7b45-25b1-445b-b08b-117afe678ec6", "value": "0befe129e75216711ababf33b3c2777c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e07984f-e6ff-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654674581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674581, "uuid": "0a13e813-63f6-464f-9b8f-dc58e4027637", "comment": "Malware payload (Formbook)", "value": "72a68160f9c995930b56edb3e299e8f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674581, "uuid": "77ed3717-fea0-484c-9e90-965851769e14", "comment": "Malware payload (Formbook)", "value": "6fd7a41af249df56ac2cc4f2b9175421c9ffa25b71c759657a24a97296bd3bd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674581, "uuid": "9f16590c-0290-4cfb-8652-6659e890143b", "comment": "Malware payload (Formbook)", "value": "af823ec6a418485cb859bb0b3bfa16f3ae418c1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674581, "uuid": "a17ccb53-86c7-475a-9929-7bea772cd942", "comment": "Malware payload (Formbook)", "value": "fb8b1f9671cae1b504b2cf0f9d205399e795d5fc0242d38dcc92cad8f907f15f3b801e0018f7b44bd6426aaf5f4441d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674581, "uuid": "84609829-b2d8-4132-b3dd-a783df28bce4", "value": "T17F35BF26B2910837C9631A305C2BBAA5A969FF102C24E4867FF53D4CDF793907D361A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674581, "uuid": "c032bc35-d488-48fd-be4f-d3c5b5e0c2a1", "value": "02a89028ae3fc76c6e22c422944c365e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674581, "uuid": "2d439d2a-6a62-43c6-9c91-02c0f90bd3c4", "value": "12288:MIfbQK/punQN2hK04lk5WiZt0/2CjDj3+3S8HL75M9JOGkMTgIGuURWCXCEUaWQR:M+UKInQ0KO5b4+CfuieZM9JJkMsTWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654674581, "uuid": "b21daef3-d5e9-4f08-9275-c756ff3c010a", "value": 1064448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654674581, "uuid": "0313d76b-b045-493a-bd7a-1707ac54b3bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674581, "uuid": "fd735431-d411-43ed-aef4-1369c71b9b1a", "value": "Swift.03425627829.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7507d3fe-e722-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654689571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689571, "uuid": "31050da8-8bdc-44ad-9970-d00cef44186b", "comment": "Malware payload (Formbook)", "value": "891937eb660a6e03ed9942a9bf78eaa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689571, "uuid": "ed922afb-43df-4090-a32c-d664135eb573", "comment": "Malware payload (Formbook)", "value": "702b8681dc88e450755e72ae12066d7e95c3cc4c87e5934bdb0646a52abf1d71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689571, "uuid": "0fedc141-a920-4f80-86b0-06ab9e047713", "comment": "Malware payload (Formbook)", "value": "41235e982fc0ee4340a99c160288a3f3090f6e62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689571, "uuid": "6ab19de4-7588-49e6-9d60-bf8dd8a48480", "comment": "Malware payload (Formbook)", "value": "7b7ac6e97467cad0ca44fb7fac224add5aab2a1d71b6b7a84acf85411e82794cbac18399735aac834a08ba4bc875f772", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689571, "uuid": "68750082-271d-428e-8762-03e8801b626b", "value": "T1A864E192E18144DBECBA1772987B8D2661A7BD7DBDF0A90E42AE7D311B731C3011784B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689571, "uuid": "443ebc5b-b786-4fe5-8874-d1616df6b4f8", "value": "dd1742eadfc6df18ded3c26ae64ad610", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689571, "uuid": "92da6f32-9d03-4aa2-aa81-61f12c90a0fc", "value": "6144:GbjLiqIf8le3EmS5lc6v0uY/x39vEnSaelXrAQqJk8+1:Ce0llo8nle5qJs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654689571, "uuid": "ebf9aac7-daef-41ee-bede-c40591738d96", "value": 336414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654689571, "uuid": "ac0f0069-3b8f-4aaf-b16c-302e03edb4c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689571, "uuid": "759de78f-7bec-40cc-a45e-7ce22379ba83", "value": "SecuriteInfo.com.Variant.Tedy.137414.29130.21401", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f35312-e76f-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654722529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722529, "uuid": "2d4e8ad5-992a-4259-8bb6-20be0203fdcb", "comment": "Malware payload", "value": "d98fc256ae870559dbe20132d178fde8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722529, "uuid": "89e0df8c-3043-4217-aa21-52dee2211022", "comment": "Malware payload", "value": "706daa6b72e92fa8645d1e31a7ddb3c9a45b4beaedd71e7b1c8f3518cfe641bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722529, "uuid": "4d5e590d-ee8f-43d7-a409-375c5ef61807", "comment": "Malware payload", "value": "6c54510add72b5f83ec411b430088d63922ab96e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722529, "uuid": "f71f5e85-19e7-4903-a173-0a6de925d010", "comment": "Malware payload", "value": "70d73b826a24ce1fd2a3e41803c31311ac8d2661593039ee40c48a6ac4771d19dc1f302d32986191872503a8dd55e086", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722529, "uuid": "0654c4c6-db15-43ef-8872-b46ed9875a0e", "value": "T129D4121837ED0B72D5BE0BFAE869110203B55736640BF34E8E8125EB1FA7FD18A1561B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722529, "uuid": "d0bffada-b01f-4632-869f-0fc3f3e000f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722529, "uuid": "3ee3c096-2fdf-48b2-b2e0-848827ce48d1", "value": "12288:HCxDt3my26CYNVCgTVyLT+96taurTxqBdnUdbxcBci/Ibo9q:OYFY6PLT66kIV4dYxBi/Ibo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654722529, "uuid": "895d5982-8c2e-4f50-bff8-b94ff3927be9", "value": 651776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654722529, "uuid": "4897403c-8ed1-4af5-8d09-d9c7d1ad0a57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722529, "uuid": "80de29a4-0abc-4060-81b0-5c01aa37c0dc", "value": "ordeReq.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af7a9a03-e70c-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654680221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680221, "uuid": "ad94a330-fd53-425a-9aaf-c02096cffd5a", "comment": "Malware payload", "value": "6fc88600e20ef83b62130d7a6df51024", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680221, "uuid": "ead9df77-660e-4da7-8568-a99fd247cb84", "comment": "Malware payload", "value": "70c36028253e71f849a77ea2e8e8f8a2f2386434103ef05aa481f020da950a97", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680221, "uuid": "95ea09dd-ffd0-416e-ad5f-17bac332141e", "comment": "Malware payload", "value": "7bcb18f8c9ad12ad16a8587130d939b46d9bd0f9", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680221, "uuid": "773e85c8-0b1c-4bae-b371-23c32f8c4f73", "comment": "Malware payload", "value": "adda81d328f8f459571b347306deba23191fd317ecad94e7734fa559b3cd281d1e30e130a6adc806c6a6993b2b9b799d", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680221, "uuid": "b6ec0983-040b-4464-ad33-23a4b1b86465", "value": "T1A2065B97B2CA693EC46B1A36453BD668893FA6B525168C1707F41D4CCF36480373AE2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680221, "uuid": "49064c95-7e96-4479-b8b0-ec3144c1838a", "value": "49152:TBIiDMoree5KSWsKOdXSi/PFlsQ0WTlwd+InOYLEA:eMlyCgi/dlD41nOYAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654680221, "uuid": "d1cab38f-5782-4953-9888-aa8a4c260235", "value": 3714560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654680221, "uuid": "f59c0394-0215-4e20-a01b-e465fff9cbe3", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680221, "uuid": "f83831f6-c218-41cf-a1a8-34eb5182829c", "value": "AdjuntoCarrefour-Archivo.Fact040677.MSI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e8b2631-e73a-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654699842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699842, "uuid": "8b94c531-0b50-4461-a588-893c4694378c", "comment": "Malware payload (AgentTesla)", "value": "076063536b38a474afd9fa5cdbd7efe7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699842, "uuid": "b1f600d2-23cb-4401-a661-54ba011ef805", "comment": "Malware payload (AgentTesla)", "value": "70cdb9db8282adb1bb6180798f3b35f3b69baf831fbe03e2ae38166b36a25c83", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699842, "uuid": "e4f66a2e-3e8d-4468-a3b1-3741098dbd77", "comment": "Malware payload (AgentTesla)", "value": "7df86f01f8bdfbe9e043997ef7225fda99cac489", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699842, "uuid": "5775a2f7-7087-4eae-a26d-73806437ac8d", "comment": "Malware payload (AgentTesla)", "value": "5000c1a330ed915e156448d678c1c90700f5a3ebd293fb01a468c09e3ec46b4861545c10fd2d7277b1b7610576a9824f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699842, "uuid": "b3c4d20f-1b45-4067-899e-b3bc6b6aa53f", "value": "T15C05E11179F7CEB2E2990737C0D24420D3B6894E9197E75B220823E5AD4BBDFC946B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699842, "uuid": "e42731fd-d1f3-4cb4-a632-124ebee805c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699842, "uuid": "9f4a7cfe-cdc8-4e39-86ad-3e3da714bec9", "value": "12288:wqXIJvhE0hc9q85+lKcfogaBSY1vuY9LTrmxhPs9ofs5zXRRysxJDds:eZfhc5Nt31LuxhPBghAGJ5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654699842, "uuid": "fa91303b-1bf4-46b2-b001-9b18c9480bb3", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654699842, "uuid": "7ca567d3-6e3b-47f0-9c64-6a9c1ac7e32a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699842, "uuid": "2f8e471b-94fe-4357-bc09-91ea48f588a9", "value": "SecuriteInfo.com.W32.AIDetectNet.01.5350.18472", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1135baf-e705-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1654677324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677324, "uuid": "b944c781-2690-4bde-af99-5bb496835481", "comment": "Malware payload (SnakeKeylogger)", "value": "9ed725887951914790662b1df6c41589", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677324, "uuid": "606a9b61-09d4-4038-982c-3f7d69189383", "comment": "Malware payload (SnakeKeylogger)", "value": "7172623ead75432cead652b0e4609f6a96922a4923c4f94c4c7274e81c5df716", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677324, "uuid": "1b6c8f52-c319-4367-9baa-723cd4ab5e2a", "comment": "Malware payload (SnakeKeylogger)", "value": "e30c3e8ca08bdb00a536764376e41b53dd26ec76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677324, "uuid": "64502dd2-e121-4d5d-95a0-7a0d0a61353b", "comment": "Malware payload (SnakeKeylogger)", "value": "1b880117a3cdf9fc0dfd7b9d5ba96d9d915c8de3f63e5f8b48852a193f6c1635d6612e8298433636c4eea51890c7292d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677324, "uuid": "880567e8-4ec5-4e13-9de1-42470c0a4c3e", "value": "T1F1F4CE85B3A9DF36F13853F66415D01917B82D2E8AE0E62A1CDEB0CE20B5B4305F5E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677324, "uuid": "8df1a423-a2b9-46ad-b3a5-19dbf4a87154", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677324, "uuid": "5873fa91-d57d-4eb7-be47-cfcc4a96e758", "value": "12288:JHws2iNqDdpbS0Yc8Ez3i1Sl/ycOOG1xBIa7DaxTzj848dE:dws1QHbvzz3i1m/QFHBr7D4Tk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677324, "uuid": "9aeb3498-c90e-413e-afcb-9cf22cf00e86", "value": 730112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677324, "uuid": "7925a993-5801-41a4-810d-f66299104ee6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677324, "uuid": "092bb747-fdc3-441a-924a-3dec716aab53", "value": "Payment.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "594b34f8-e767-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654719160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719160, "uuid": "31ec16ae-4ce2-4bde-8831-ee7010e5fba9", "comment": "Malware payload", "value": "115e0cbcd2758f3da0aaba524d79eefc", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719160, "uuid": "e55112a7-b532-4ed8-854d-ca2329fd5863", "comment": "Malware payload", "value": "71bc707f557a7f7470219611c8525f11d96d1b4abdbd64d715aeeb323bcf0288", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719160, "uuid": "6bd29421-f334-4562-8865-4370becf1f6a", "comment": "Malware payload", "value": "c269a078c43351862518728d32fcb6b594ef2674", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719160, "uuid": "bd6063e8-a55f-420b-8483-510a9a1b56f7", "comment": "Malware payload", "value": "1f074c9673ac401b0bf58bd82164a07090c78fe1864473a5103e87492bb369a1b4d99a0b00a19d81a390bed731c35b17", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SVCReady", "colour": "#EF2D2C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654719160, "uuid": "ff2c6bde-15cf-4eb7-980b-5b22602ff6c7", "value": "T1A39533A068A748BEC2C892367AA41ABE1C3D1395D25E4F3B51B541D8F5C6C13B4F2BC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654719160, "uuid": "a9168a11-2582-4feb-b8e3-a13320316c53", "value": "49152:SUVUBZurenW+LcD0OokTXxwlSZxD0XpHJ3Qw:5OH83tFTXxoSZxY1J3Qw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654719160, "uuid": "08493b0b-c01b-4e23-8ec5-c9176937a2ce", "value": 1986417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654719160, "uuid": "e69ae954-4430-4507-9fa5-137e8c016e5e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654719160, "uuid": "80c5b8d5-0d29-4f52-bfdf-5b4ac1477fb6", "value": "TM8dLjizHspYEqJd.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a3724ec-e767-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654719215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719215, "uuid": "07176926-9529-4000-9663-87fd48b2d307", "comment": "Malware payload", "value": "5ed2777a92079d80641e90ea474036a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719215, "uuid": "df704524-6f03-452b-93f3-d2734718203d", "comment": "Malware payload", "value": "722cb35d685ecce0737050a8ccd2e5d77232f14ab9a1749094cbd7f5a0a8855f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719215, "uuid": "e3766122-c765-4346-814c-b4f7418ba677", "comment": "Malware payload", "value": "db33eb8ed803af5b99e7bfc7eb15b39269fe13c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719215, "uuid": "6ad4bc2b-5c84-4fc0-81eb-6b25ebbe32a9", "comment": "Malware payload", "value": "f9da96afcdae9562369e57f989d09730edb23793c9963847e2411d5d8a2f70c4f37d0bdfff8b1d4737b4245e286bc3a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654719215, "uuid": "045bd96a-badf-4441-a428-eca44d6c5986", "value": "T127149BF36BD8C8DEDB586234F3424E1707516DEC68D6A63C1FDE7A29C530A6A60F8520", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654719215, "uuid": "6b703889-7e8f-4799-808e-d850e63ced4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654719215, "uuid": "36f9677b-563e-4af2-96d1-7a219dae54df", "value": "768:WXGfxhp6kELfs6CChd7ntnR+iEiii38n8nssGGTdjt+++Gvx/bb2exNEzAlgql38:WXGf7uS9wFO1hhwo8r2PYBU4cIN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654719215, "uuid": "5fbb48ed-4c7f-4180-8ba2-a9fbbbd6ca86", "value": 198656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654719215, "uuid": "37bbfffe-1daf-4d4e-9fe1-5de0edc92d31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654719215, "uuid": "6a4b824c-ca52-42cc-8466-02bd6387c7e4", "value": "MT100057.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d801eb-e76f-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654722780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722780, "uuid": "8b17af09-0be5-46f2-9d33-9444962ed7ae", "comment": "Malware payload (Mirai)", "value": "758274258a6ef83ee8878dfb0779cd2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722780, "uuid": "d2c8acc3-55a3-4171-87c4-8d06cca3cc79", "comment": "Malware payload (Mirai)", "value": "72f02f9a245c00ab6c5c481ada60ca2bd533316613df5dd473042327a2d2ed69", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722780, "uuid": "9504beb8-a66b-4e8c-a5ec-659d57e4f5aa", "comment": "Malware payload (Mirai)", "value": "791d230feca662c73da17ec7e474f679dab4019c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722780, "uuid": "f5d57907-19a4-498a-8ce0-a1be37c3a08a", "comment": "Malware payload (Mirai)", "value": "c9bc27e285b3c8762f0a594960a033eb9e268204ec280da3e8ac564a0d8de351e5704f70fb2dbc839e799c39adbb9cb5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722780, "uuid": "64f016ca-82fb-4808-83a5-fc55b37c2fe1", "value": "T10E731981BC809E15C6C517BBFA6F118E330297A8E2DEB353CD145B6477CA81B0E37A59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722780, "uuid": "b567c56c-6c5b-4025-9ed2-772ef75d23e3", "value": "1536:n1nblFlufknASOgUb+AAYg+y2HNclsuxIw9mrsplDKZUCQBKXAVan9X+F8Jyv+Bi:HFlvO5bzA1+JHNcsS79mrsplDKZUCQB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654722780, "uuid": "220f8e81-8292-43d7-8f00-1c39acf96d58", "value": 80108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654722780, "uuid": "0e3e0f7f-a4a4-4af6-a6bc-55e238fd838e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722780, "uuid": "e8ce6920-c83c-4c00-9fa4-4b572e28b2ff", "value": "758274258a6ef83ee8878dfb0779cd2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb8eaba2-e6d4-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654656270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656270, "uuid": "aa0d5084-70e7-4e78-bec8-98415ee21a4a", "comment": "Malware payload (Heodo)", "value": "97af3c0f615005456a8e790e71651d99", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656270, "uuid": "77b96707-a2c5-49ca-88af-72a221c558fc", "comment": "Malware payload (Heodo)", "value": "743dd4042c806ca952d291855984690474a2f54b0f8eb9827fb6a911ea02ed27", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656270, "uuid": "68c38e07-4de1-4042-925b-e8a5b2a3557c", "comment": "Malware payload (Heodo)", "value": "83666ef68f7311f86ec938112d21a0092ff3bcef", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656270, "uuid": "cb1c8d8d-e6a3-4ca7-aeff-86c22e64151b", "comment": "Malware payload (Heodo)", "value": "4f7ff3ef185ce31bcae9ba47aabfb43dfe087ba9e79ac1def0d6cf6d02c5fc35493e6e166382e0cf4874354ad05f977b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656270, "uuid": "e6d8b820-9fab-4048-b26a-2afcfbffd901", "value": "T1C204026DD14C06DDD611137CACE90F3392FCF980A0262B5BBB70A6774BA4B96DB5B900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656270, "uuid": "0e5506e9-8527-4a5d-a5ab-288a5f14c70d", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656270, "uuid": "b700b064-17cb-4534-b3e1-c29acef85a26", "value": "3072:rpjfZFcO4J8FYMh1PAzu8GmeR8dk5pL/rRn/02QBgjVcoe5Uy5i6zNL4ZNgzPKcQ:rRBWW6u8QKkXzN/09gjV/eey5/NsAziz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654656270, "uuid": "00101ae0-11a0-458f-939b-a56255a71613", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654656270, "uuid": "f30f1f25-7f06-4684-8f83-f97faba9b17e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656270, "uuid": "d04db39c-8102-4fee-9ddb-d266757b05ec", "value": "743DD4042C806CA952D291855984690474A2F54B0F8EB9827FB6A911EA02ED27.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9998889c-e750-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654709390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709390, "uuid": "86a25b7f-a391-4083-ae01-7e8c76cbc492", "comment": "Malware payload (Mirai)", "value": "c3d22073f0fb59b3ee804a08b785883d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709390, "uuid": "46e7e8db-0dfd-4107-b25f-0c62bd449a2f", "comment": "Malware payload (Mirai)", "value": "745c86533f4dfbd12c299c39779d77c51c5b67146c9e1d87e1a7431bfec8aa24", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709390, "uuid": "7ba2ef3f-bc9e-41be-a242-0094c6485733", "comment": "Malware payload (Mirai)", "value": "494395eb4a1ce37660a3173bcac6bcfaaf9d0613", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709390, "uuid": "23aaec43-c0ef-4429-8975-2d4a7bf6735d", "comment": "Malware payload (Mirai)", "value": "6812bf4321f7bff51bfb373f06733a4740c7bdf288419bf9d3e3305c9496ea8acddfdbb070f92e7228128d9dd0c73cea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709390, "uuid": "defc2e5c-94ac-4aab-88f4-b76c64f66141", "value": "T128F21946FCD2C66ACAC45376BB2F118E3321B3DCC2DE3607DE144B20768A95E5D27682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709390, "uuid": "71247829-6fb3-4ff4-baf0-ac2f58ca76ed", "value": "768:We4zHmGXb9tySdlr6T3ddFUjY5nVa+SeZEDAok+n6WBNaNb:AzmGX5ISdlr4Hh5nV3SemD36fp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654709390, "uuid": "896c7d9a-6986-4126-acf0-61e6eb32da7c", "value": 36096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654709390, "uuid": "ca9a0dac-3a57-48cc-aa4e-2ce9b4873a18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709390, "uuid": "90e37348-45dd-4553-89a1-e5babe4c51c5", "value": "c3d22073f0fb59b3ee804a08b785883d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "649d6a89-e73c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654700711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700711, "uuid": "7c3d051c-1a42-4bf8-9efa-cdc5f98886b3", "comment": "Malware payload (Formbook)", "value": "d76ca513ec114fa3b5a8fda929f8dd8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700711, "uuid": "3c4c20c8-333a-4658-af68-0fe12178897e", "comment": "Malware payload (Formbook)", "value": "74ba567fadf80160af985b3da457bd75db7cd2f94fd2a224aff945fd48a70660", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700711, "uuid": "ad41b3ec-6f2d-419c-80fc-82f19aeeff6c", "comment": "Malware payload (Formbook)", "value": "df76050c6e23dd22db856cddd5f25de5915a94d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700711, "uuid": "7c620680-982e-4aa4-b645-4f681925ff51", "comment": "Malware payload (Formbook)", "value": "b8c7e03ae914fa4dd64569b988f9ae8dbe36df96a76c7adf961534859d4bff593064ddb99833faa821037ce739a1dc02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700711, "uuid": "74b71c05-5490-46f2-80b6-66d9bae23acb", "value": "T1DF05D0407707EC7EF0290E3768A084046760561E86ABE72B76CD36DD685F3CB1AF2A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700711, "uuid": "f43e0ab0-2b50-49ba-92f8-6277265b584b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700711, "uuid": "6fa3705f-46a8-45ff-bee7-0e9cb55ee8db", "value": "12288:e0KMaKzPdNa/rk7ZacJDTU372iNd9qsuJcGKes/ola8tn9sVjg8nYw11B2SWY55l:e0/pVNerIMb371npNJolaiWdJ1B2gZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654700711, "uuid": "0c3a54d5-e804-4b65-9782-36ddc8a544eb", "value": 872960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654700711, "uuid": "9bbcbef3-c222-4965-85c1-a7fe58081f58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700711, "uuid": "83a2a858-b1df-4fd0-8ae2-0758396a8d23", "value": "j7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff49ebd1-e70b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1654679925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679925, "uuid": "3b4195a2-6993-4ebe-be6d-36b7f0f93be5", "comment": "Malware payload (Loki)", "value": "f68f16e835fac59e6d92f99b80bff8e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679925, "uuid": "825fac0d-53dd-42de-a002-529a8a8dd004", "comment": "Malware payload (Loki)", "value": "752c92310cd1d5e610fe6fd659385f4d311fe96db287758e5e9df42ec3061ca0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679925, "uuid": "aa921ba8-98aa-46d2-8714-d8bea5588c0c", "comment": "Malware payload (Loki)", "value": "1472b4b353423f46271a1afcd0c4c78d61413b06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679925, "uuid": "ae84cde8-6143-42af-9b02-fb70168f7279", "comment": "Malware payload (Loki)", "value": "d9d29036da7d55fad0a00e9b405c622d9fbc988b15cff2ec1f66f0bf6795fdda7742a103131af643f99292cf5a497042", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679925, "uuid": "65e5ca4f-bf22-48fe-af0a-67b04582ba4d", "value": "T198C4023937ED07E1EA7C5BFA9425010087F1A326A52BF30D4FC165DE5E67B84CA62623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679925, "uuid": "0f720b37-a1fa-4b48-bade-b00c3c08f532", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679925, "uuid": "d260dbae-369f-44ee-b582-b1f645450a65", "value": "12288:flG308m1zQ/QiMb50rekOZzdkKZFrJBTUTm9bo9q:Zi/QisKrkZW20Tm9bo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654679925, "uuid": "7853b913-9707-4378-bd16-0980a4c2e9e3", "value": 562688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654679925, "uuid": "2d6f309f-b91c-4310-946d-72fddcf5997a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679925, "uuid": "7cfaad90-f544-490e-9879-abde7a402438", "value": "Payment Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5545088d-e6dc-11ec-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1654659453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659453, "uuid": "b4ea8541-6890-4849-81f2-1232f0afae50", "comment": "Malware payload (SilentBuilder)", "value": "84e1924e689c5d40f5255dbaa8b281db", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659453, "uuid": "07c50e61-74c6-40f2-9842-192143631b83", "comment": "Malware payload (SilentBuilder)", "value": "753717e5a824ebd3ce08aeafc07dededaec0266eeb72a186782c8596c41f2db2", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659453, "uuid": "2976b2c7-fdf7-4917-8fea-8d0661f3de00", "comment": "Malware payload (SilentBuilder)", "value": "df34258b1a64938f6e8247832b7080673ddc9184", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659453, "uuid": "46ea5b0c-b95f-47fb-b3c5-4d2b2f77e40a", "comment": "Malware payload (SilentBuilder)", "value": "8ae365356c97652b9a0b01bef2a21cc4f310e20ac9ead2a369c9faf6cf3082aa87f7af1b9a9655801477a8ed3b70b90d", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654659453, "uuid": "13bf45c7-8e18-4a87-95ec-93d74edcc5f0", "value": "T1C8634B59B769884EE9198B3448F747D62323FD308F6F0A433259F3926FB95A05703A0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654659453, "uuid": "21f12563-8774-4ada-96f0-7d1021df5cd9", "value": "1536:DhKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+J+hDcnTLiQrRTZws8EH:FKpb8rGYrMPe3q7Q0XV5xtezE8vG8UMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654659453, "uuid": "60b6c0c7-aee0-4cc4-bf32-e9bf47b997a4", "value": 72704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654659453, "uuid": "2db9342f-a266-439a-b228-d3a30b8597ad", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654659453, "uuid": "68fa06e6-6683-4f68-b8d6-c5819d8e662a", "value": "Fk-hotel_Form.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4e5d5b9-e745-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654704765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654704765, "uuid": "5ca6faa8-b185-4d7e-b893-4f30973af757", "comment": "Malware payload", "value": "5b58c5fb463aecb3b09f25cdbd0a77d2", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama187", "colour": "#0BCF63", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654704765, "uuid": "607d3605-58e8-4466-aa27-bf1f034dd6df", "comment": "Malware payload", "value": "7541c1a0a91949d63b6c4e7422de0ea1b0df1e4fe59387c4b91896b06fa5dafe", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama187", "colour": "#0BCF63", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654704765, "uuid": "cbbb414c-52c8-452c-a128-fcf7aeb70870", "comment": "Malware payload", "value": "37f0cd078d8be7db6c45bdeeb81bd34ca07801a1", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama187", "colour": "#0BCF63", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654704765, "uuid": "bdd1346b-8a1d-49b0-a31c-bb94578d98f1", "comment": "Malware payload", "value": "671b6eee996880422d212acd52c999ae1e353ae9d79f865e713dd0e4b18160d301b0a30641e2426e70ded5db590dcc69", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "obama187", "colour": "#0BCF63", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654704765, "uuid": "84bb7a78-e72f-4b22-9dd8-3e716b190568", "value": "T184D423B01E656DFE4B38F52128BFCB16FEA10A078E1A5058D3216B5B7A1CF36016B136", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654704765, "uuid": "99154f73-0e9c-4d91-a852-a47d5f4b4e6d", "value": "12288:2knl5ccVVxB6vMdrMzAA9Jtjeftiz/CrNy6/f4g8kEJjifoWuqUN4+W7yzK:2klqcX/60drMzpHFItioV4VkZ7F04L1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654704765, "uuid": "614b5ee4-1ce0-4c45-863e-db72115a6589", "value": 647632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654704765, "uuid": "0172ebc1-ce6d-4267-8e81-bde830fd1be1", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654704765, "uuid": "6556ea5a-40dd-41de-8d9d-d632a55ccee4", "value": "ScannedDocuments_0672094.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b49938e-e6fb-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654672832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672832, "uuid": "94ced828-290d-499a-b21c-3d9cdaac719b", "comment": "Malware payload", "value": "cae27d74ae5f646da19edb268cf58259", "object_relation": "md5", "Tag": [ { "name": "2022-29464", "colour": "#352DE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672832, "uuid": "8999ce16-35eb-4720-b7f6-256b7907d698", "comment": "Malware payload", "value": "7546c872d27316d518823b693b440b69e8e3ca430776f52af8ac27f54193d8d7", "object_relation": "sha256", "Tag": [ { "name": "2022-29464", "colour": "#352DE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672832, "uuid": "12f42130-a760-4608-8ce9-033dacd4dfab", "comment": "Malware payload", "value": "c6fd86a8b2182254f50d9ec5f6a9a0fb8e578ad1", "object_relation": "sha1", "Tag": [ { "name": "2022-29464", "colour": "#352DE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672832, "uuid": "30ac0ee6-5664-4e32-b68b-5d3624c628f1", "comment": "Malware payload", "value": "5e64776339139f98e3fb57a08bbab514f609f25b8225990092aa8e0bbc4c2040c03f7f5c8bd921da78edfb4a23807e6e", "object_relation": "sha3-384", "Tag": [ { "name": "2022-29464", "colour": "#352DE3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672832, "uuid": "2f88739f-8994-4506-bdbd-7fccee2cab33", "value": "T1B8E1517F66162282773273BC965186B7FFFB94338250D110B78D42246FF382516D0ABA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672832, "uuid": "2de5f14d-ed96-41ec-bfb0-040de891fb97", "value": "192:W2baCxusCURQR6RD36RJB3R+Vo2bjeNEi:W2baCxusCGygD3gJBh0o2+Nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654672832, "uuid": "ebc77110-6567-4264-822c-93229e90a667", "value": 7083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654672832, "uuid": "12a0e804-f525-4497-b4c5-1141cc35e92f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672832, "uuid": "8492bcc9-da4f-42b1-8e09-028bf7328325", "value": "7546c872d27316d518823b693b440b69e8e3ca430776f52af8ac27f54193d8d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b59c1387-e70c-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654680231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680231, "uuid": "d78cfe8f-1653-4114-9cca-cdc2bfe5f191", "comment": "Malware payload", "value": "a60e3e5ee44a6857fe55339feb35d2b6", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680231, "uuid": "de829bc2-1b86-4eeb-87fe-12845dcd491e", "comment": "Malware payload", "value": "7559bd910c0aceecf3f601eaf5cc1dfacd31243ac4ab0d32846df4c47f4a21e3", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680231, "uuid": "b1481609-240f-43bc-99bf-d55d6fc7acfd", "comment": "Malware payload", "value": "7b870a69b9d74068d780a7e92ab9871e32d574f6", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680231, "uuid": "df813d43-c65d-49ff-9dcb-7f8a29de0b3d", "comment": "Malware payload", "value": "495b1a1a4424725dc7bc7ea9780d46f83a90043a9bbb211598600bd3199282fcf7773ce102eb3e66fcf60a329b2b8cb1", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680231, "uuid": "4cef7151-67c8-49ae-8c8e-047ee82d54e5", "value": "T122166D13B2C4653EC0AB2A3A4A379758993B7B713A22CC9B57F4494C8F356403B3E657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680231, "uuid": "fbdc1b13-514b-45e4-a6ba-0f3a4384f687", "value": "98304:kadPwlW9rYBF+ghILRwyDHB9zpSauYOY3A:kapYBF+g8w+HBNpSa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654680231, "uuid": "464d1e78-e656-4a8c-a045-0bdc69bc6f30", "value": 4388864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654680231, "uuid": "56de9c63-3349-43c8-8d24-7fef253f8993", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680231, "uuid": "a9dbd0ba-2c45-46c9-b96f-a7443696fa58", "value": "NTFS.Iplace.AppleFaturadacomsucesso05062022219177.MSI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac35c453-e70c-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654680215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680215, "uuid": "5980d2bb-7597-4031-b219-1f7be6fa1ce5", "comment": "Malware payload", "value": "6b73d5e954b77a13198792c3d539206d", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680215, "uuid": "7b0ba4a2-04b8-4655-94f5-bfd1595d47bb", "comment": "Malware payload", "value": "75a9098f7ac4ee359bc6ca90211e95a30c54d6073a3119984c439ca0ffa0fa27", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680215, "uuid": "6eeef14a-a251-4a24-9100-6460b80baa71", "comment": "Malware payload", "value": "aa0043f9a8f19477b382311ea059e7b124e55aaf", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680215, "uuid": "419648c5-2e29-4fdf-a885-976e337f178c", "comment": "Malware payload", "value": "cd3a25e77d5e7660bbd1f75af2f79971c67b3e9a3700cc326c32d4e540b01fa3c156beebc4edae5fb37ddd59f0901491", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680215, "uuid": "5eaefb70-05ac-4cdb-8b16-56d618a3785a", "value": "T19C166D12B284A13EC0AB1B3B8937975D993B7A717922CC9B1BF4494C8F365407B3E647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680215, "uuid": "04bfd089-c185-432e-9eaa-7e245c2eee8e", "value": "49152:++0ZtuDM/Kl/UdwSO1zXHQs0amtPsNKuU8bE1JxYGhA0ENp0EWCA8TmzjxpkAOY+:Inu3pJmlsAbmGhA0ENp0EWCA7kAOYxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654680215, "uuid": "06d9ddd5-45ee-48a0-94f7-120cc1390ffa", "value": 4337664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654680215, "uuid": "2a4c1449-ac27-4850-9224-d1b90b1a60eb", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680215, "uuid": "e9d41876-88fb-4f06-91d6-a7fe2141ae6c", "value": "Carrefour-Archivo.Fact05067740.MSI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8912a9ae-e6fa-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654672425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672425, "uuid": "56709f4c-f270-41e8-adc3-065af17f0072", "comment": "Malware payload", "value": "44615b5da6d7035c8107ac434188301d", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672425, "uuid": "a4679a58-b5d0-4365-809d-05e1bed11ac0", "comment": "Malware payload", "value": "75eadd502c4b1667e126dc41c58eb0eb0435662e159013ff37ddf1dd86fe8b1e", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672425, "uuid": "00fc5e88-26e1-4497-b92b-7cc925b49a33", "comment": "Malware payload", "value": "797a8c7116ba8b82de52d33bd0d924c182fd6afa", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672425, "uuid": "c27e9362-5ef4-4b6e-8c85-f5bda30e3764", "comment": "Malware payload", "value": "168314a8b8a4c261f50d2087bd9e6e69b8cd49740a864f8944988678c4da74583ef8d05bcd336d7e44020dd27411cd58", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672425, "uuid": "e6c085f4-5f6a-465e-9161-757cb4202884", "value": "T189D4121535E84FA2DA7E1BFA5815014057B5A22B182BF30E9DC234DF1E37BC0C9A6B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672425, "uuid": "cda3e6ab-f162-41f4-a07e-0c6f4753d7d5", "value": "12288:qHS7kkQfUnRr5IvRz3hw7Utj1Bx5ARGcbLt3iItN7XNbo9qw:nNmUnReRzREwjt5r2dn79bon", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654672425, "uuid": "61f831ef-c3d3-409b-bd3a-f18a5d5d83b0", "value": 653070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654672425, "uuid": "d46e16ec-bcf4-4efa-995f-6f7208a1b479", "value": "application/x-ms-wim", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672425, "uuid": "b4a700cd-554f-4634-9d5d-b2573e1ea84a", "value": "Shipping documents.wim.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cc2543d-e706-11ec-93bb-42010a9c0043", "comment": "Malware payload (Hydra)", "timestamp": 1654677424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677424, "uuid": "2d061685-da97-4b94-bf9e-b3ae4483d881", "comment": "Malware payload (Hydra)", "value": "abcef2353f293e694fe3073b53528441", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677424, "uuid": "758700af-267b-43ce-8ccc-df08d338c1f1", "comment": "Malware payload (Hydra)", "value": "75f9f66bcbfb732b3720f9b56a5b56a3a671ff4386b0b7dc8195124b0db206c0", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677424, "uuid": "b398f9b1-6225-4067-9913-7ebc7d4a5859", "comment": "Malware payload (Hydra)", "value": "0ecf181ad163bf5dc4e316ac61b3d2453ade356c", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677424, "uuid": "2a297be1-4420-407f-98ba-51f6290727dc", "comment": "Malware payload (Hydra)", "value": "5a90ebb0a4d7ea0092fbed02069f5fea31c6bae254c398788b6f873b7f6e6c9d211359bf6bd251b95cbb564c82bec493", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677424, "uuid": "6752fdf0-a8e9-4af9-884c-a227ca13b363", "value": "T19AF52366F7E5E526CD49AA38B046C00249EC4FA405D1E757366DB47C2F3A9F00B87EE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677424, "uuid": "25e636be-d39c-4b1b-9e71-8e312204d8dd", "value": "98304:Vz2v/oOd4+e/h8WBJbiBUUPBnzvU0C/MHpCNnvB:koJ+e/h8WfmBxVRqMJC/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677424, "uuid": "86a8a6a8-44fe-4adc-a0fb-e2ac11def833", "value": 3360957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677424, "uuid": "277064af-f600-407c-ad1d-9b8d24e6e525", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677424, "uuid": "6de4e4be-4295-4a6c-b2b5-b9c736c96cb8", "value": "FlashPlayerV1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b2f2fff-e72e-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1654694602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654694602, "uuid": "40f0a736-1a17-4d7d-9ab3-abac22b8d45b", "comment": "Malware payload (Loki)", "value": "d590eb2630d9db7c7b8bd25226190e1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654694602, "uuid": "0ced1d3d-d355-4ef9-b7b5-a9cf401923d0", "comment": "Malware payload (Loki)", "value": "763b9ddb8670835d34e5ecbd031c8077ad8c1e1572e43f558fa664a8d6b0c4d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654694602, "uuid": "efb57739-2767-4407-8bf2-4573601eb876", "comment": "Malware payload (Loki)", "value": "7ffcf9722c5c0c38d0d8aad97fe7471715767d63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654694602, "uuid": "99e6e961-b424-48e3-a907-ce68e6f0e594", "comment": "Malware payload (Loki)", "value": "c80d171e91feeecd6322f8a6d357841a0ce974721c07acf90d2c328fb4ec9f178bd9af3b65efd4265bd7ac6b2ef7cd6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654694602, "uuid": "894ffd24-68cd-4c35-a586-917b1eba6a8a", "value": "T185E4E01176EBCE72E2960377C4C25410A3BA8646A197E70B335C6BE55E437EFCA12783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654694602, "uuid": "bbd260dc-8421-4980-9a4b-0f645ccf6fe4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654694602, "uuid": "45fe0438-3e5b-4c5a-96dd-71e132704e39", "value": "12288:1ZSi1mD7UZFzo8aj5L2KBKptNvFsoUQSs+S1cshQ9qPvYKnZm/rGpOEjnCBCV7IF:1gWmD7UZFzo8aj5L2KBKptNvFsoUQSsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654694602, "uuid": "daf8cfa4-a3fc-4599-94e9-d477e7d8aff7", "value": 681984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654694602, "uuid": "a1a69c41-bbc5-4d68-9415-21a69061f106", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654694602, "uuid": "659e6492-7a5e-4ee5-b44a-9478f0b47a84", "value": "Purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a3f339-e769-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654720067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654720067, "uuid": "37298d65-0fbb-4223-9333-d6ba47415f03", "comment": "Malware payload (Mirai)", "value": "7ced91fb8d36312265f0d9383b5edc8b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654720067, "uuid": "a6e5c43f-efe3-407c-81f2-0edbf0c0820e", "comment": "Malware payload (Mirai)", "value": "768be599a308d991032766eb02e71e2f6ab590b3e7e69cf0954c75cec83864e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654720067, "uuid": "5b91d022-f92b-4d03-b966-c688ad73d20d", "comment": "Malware payload (Mirai)", "value": "b9ef460c66b8bf6db80b17cc7a8398966fbde5f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654720067, "uuid": "a1646fe3-f59f-49ff-8144-68f23dd3ff58", "comment": "Malware payload (Mirai)", "value": "45519d92c110a09e7a17c3c6a3807812f6e0c30ed6211c3094fd17ed7e0bf1823b9737d82b07952b589230b685a25c8e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654720067, "uuid": "19f785e2-763a-4821-8fc0-1642599f7838", "value": "T150D2F17107209AE2CABC5E709DED46071A0D977480D7B4F211104688B9E69D7BAFC3E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654720067, "uuid": "bd31a409-f394-4f68-ae41-714dcdfa6075", "value": "768:+W2K93ZmoaRZp0Wkwnjfc/qNkiteBJWWyuU/N9q3UELdx:+vKpZwLwiqqVqL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654720067, "uuid": "60252c7c-5569-42c0-a3f0-cf115c60e383", "value": 28992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654720067, "uuid": "d177c76f-ef99-4835-ad18-2d8f834867ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654720067, "uuid": "51524ded-372f-4204-bb87-f9d5e826e932", "value": "7ced91fb8d36312265f0d9383b5edc8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da334f5b-e6d4-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654656240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656240, "uuid": "f30e9f1a-c116-4467-ad27-e2955f3ae8bc", "comment": "Malware payload (Heodo)", "value": "dc5db183e6fdb4f6a36ec5cc6fd7101d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656240, "uuid": "ce5c1384-66b4-40ef-a446-150a342ebcc8", "comment": "Malware payload (Heodo)", "value": "76c684784467c4b40f2ae55e452d9911fcbf1b69a683e7fd11755993927b2898", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656240, "uuid": "87ec2c46-d2b9-4732-9438-446c004e3244", "comment": "Malware payload (Heodo)", "value": "ca3bbbf25c70630d132095c5aeef6242be76f017", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656240, "uuid": "ccb97b60-e516-44de-b9a0-12556970e9b1", "comment": "Malware payload (Heodo)", "value": "7d6624fc3bfd07e38478723a85ec9303bca1972a112bf8683977bff20af0e2d394ca4632404276fc611c1f3fc6f5d413", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656240, "uuid": "5a623bbb-5b34-450a-9874-24fe3d76ee98", "value": "T1AC04023EE5031A98C22ED8FC58EE6DF9D5F634006258062A1FA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656240, "uuid": "34a74c27-80d2-4405-8eab-b42ce097c0bc", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656240, "uuid": "4a5c74aa-b1ee-4399-9f8c-01b4bb3dd938", "value": "3072:VpjftoFs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VRKi1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654656240, "uuid": "4a9a3ac7-a0c6-41e7-93ee-dcf76f23b65c", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654656240, "uuid": "cce4f10a-95b9-4ed1-9d74-a3ee39355cdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656240, "uuid": "570c2950-8584-40cd-ab56-f1555e1a7632", "value": "76C684784467C4B40F2AE55E452D9911FCBF1B69A683E7FD11755993927B2898.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1193ec1a-e70b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654679526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679526, "uuid": "6c22a73b-1254-4101-b51b-7f2b1079baee", "comment": "Malware payload (Heodo)", "value": "ad9ef6485a8d45fc6ada46734c1b2924", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679526, "uuid": "2872dbae-8c0d-4ec3-ba9d-d60d86549c0e", "comment": "Malware payload (Heodo)", "value": "774872fca0725fb228585dcf7733d84e80c284aa638d0dfd620004219d51632d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679526, "uuid": "09fc45aa-6756-48ba-9b49-ad321f5781eb", "comment": "Malware payload (Heodo)", "value": "e251e7ee4ffeccd83b3b459c7ce05d3edb1e58fc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679526, "uuid": "81c1e637-3aac-4171-9439-564e6a0045f2", "comment": "Malware payload (Heodo)", "value": "322ac4a75db62f8d49a91a1b57c2b98df67309b7707eaca490d583823b6821f9313ef3c2205d0db3fe9f0f52db14b75f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679526, "uuid": "949e40e3-b25f-4a4a-bb5d-0a0de961a405", "value": "T17F44C089A7E1ADDBD51407798DD6D324333EF2814B8387076B2598390F23BA4BFC5645", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679526, "uuid": "13b9fcdd-ccdb-460a-84fd-d71785fb4b67", "value": "963f2e88a5b03877d0583808b2526c1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679526, "uuid": "c2ff16c7-1d68-4407-acf1-bed80a690a2a", "value": "3072:7R7Ce82w+Oh+UjuFJrfr7CS/FmikytkqroMdjaWtHCqPZ4PEx2ES2vZg3f4L5ZJi:7lFJuk4uFxOmFwytLVxDtfPZ4PE2sPs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654679526, "uuid": "0eee4596-4b88-4a6d-b0ca-1583c9c8e42d", "value": 270403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654679526, "uuid": "79085f20-c9ce-4557-8014-6a278aa7427a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679526, "uuid": "7974a530-e211-4652-9b67-16397fd033fe", "value": "ad9ef6485a8d45fc6ada46734c1b2924", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9647259-e742-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654703430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703430, "uuid": "d02c6ea8-a843-45e7-ab0b-a1d8e0d8a28d", "comment": "Malware payload (Mirai)", "value": "92aefe170d43c8c6faeeb8d293bd24df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703430, "uuid": "3e3080cd-e18f-4961-9d78-71c112a201b8", "comment": "Malware payload (Mirai)", "value": "777dbe9c57f88506330aba05d103643ce53ab764caaeb507e5409087b6dd361f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703430, "uuid": "31eda86d-4ed8-42c2-b83e-9e9bab85594e", "comment": "Malware payload (Mirai)", "value": "b8d656bec108f23906bc050d80a6a94da5b26bc7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703430, "uuid": "d269964c-ce5e-4f5b-9d6c-9b4c0b8a7316", "comment": "Malware payload (Mirai)", "value": "199abb396e8603acb5cf8c94092063db2b4e3ea91626e4a9b21f342573895012d553c89e7cc2860b31d91aa15a0c3877", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703430, "uuid": "ce55272a-18ba-4f58-81c0-6c5063daeb8c", "value": "T19EB2D1AC1A0064F9D66845B570A30F910F264FBAD353CC993859FA43AF4D4793C67ED2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703430, "uuid": "c1190a38-20c4-4233-a935-ffb386a0d38a", "value": "384:1v9wHOD4mWmT9RqM54l2YOfU5ukSAIyyIb+0cnTRBaJgGlzDpH7uNj1Jz/j:1v8mJxL5mh5AIb+RFsJgGlzDpbuR1Jrj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654703430, "uuid": "2c9d8797-8348-4aad-a0ca-970d1e1fa971", "value": 25404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654703430, "uuid": "cb1af947-73cd-4b2a-80d2-c1fcaff00ba0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703430, "uuid": "b43561ef-0181-49dc-9c60-7e3832f8b2b8", "value": "92aefe170d43c8c6faeeb8d293bd24df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96035a90-e765-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654718403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654718403, "uuid": "765f8c2a-5c35-4113-a716-76aea407d849", "comment": "Malware payload (Mirai)", "value": "183478061146dc3aa702ebacb6904e46", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654718403, "uuid": "2a005217-b0ce-47b1-b65a-024b137b9c61", "comment": "Malware payload (Mirai)", "value": "777e19b773432025c2442ed7e7652d13d526e388a31937096a20bf0ea4c966af", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654718403, "uuid": "ad57fe6a-496d-4d28-848b-7412926e1862", "comment": "Malware payload (Mirai)", "value": "92756a6501f2a8b6ac26c16d7e66ad5a94faccef", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654718403, "uuid": "cac54822-ade0-4ccb-b8f1-0875df5381bf", "comment": "Malware payload (Mirai)", "value": "3bfa92a33ed078b69d5f7ef073e58bc837844d37a42c7c539c5f31ebd05b3bfd363d2b1ce02396a59ad12e330259f1cd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654718403, "uuid": "3d46eba6-2b4e-4fbc-8585-446386202d07", "value": "T1E1B2D075D88EBA7083B09431D2664C4B13851BF7E8F33656170306B07BCAAA1BB78687", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654718403, "uuid": "3d1b9487-cf3b-43cc-8c17-a1f4e6fbcb57", "value": "384:XtbZciv+WjgXQf2GWu75YZV6K5dFllRRi50ZUbsn/F0ifRehymdGUop5hp:dbZcjWjgXQf2108Vnlle6Z7/F0ifos3h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654718403, "uuid": "d5197a8e-935a-4608-b69a-d3ab50760814", "value": 24072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654718403, "uuid": "7d369fb6-6a00-4f85-9cff-e8a61369fdc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654718403, "uuid": "5b7f3260-4cbf-44fb-a756-7bef09c999dd", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78ea93b3-e74a-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1654706758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654706758, "uuid": "ca8eb8ec-faf9-4955-93d1-43bee2f7fd92", "comment": "Malware payload (GuLoader)", "value": "cdf83d3100d0fb3c5e01b09b9fa85e91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654706758, "uuid": "cc98ccf7-6cd1-44b2-8164-d0ab92ace714", "comment": "Malware payload (GuLoader)", "value": "78074c89407110eea440f3a6f67eb518ada68a4fb15a5d29467c2af380515cc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654706758, "uuid": "48c8f1a2-601b-4ccf-8c77-b55e99836ddd", "comment": "Malware payload (GuLoader)", "value": "b264d9ec939b1817997f09827e290103e69967ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654706758, "uuid": "62c675fb-fe61-4dd2-b622-54de3272625d", "comment": "Malware payload (GuLoader)", "value": "ca923bed3b9de609131cf53df0ee9ac3435d563a45d8e43f2af22fa362c9fa8c87c33a37e02c37398b74bdb191b32bc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654706758, "uuid": "bbdefbdf-4ef1-46b2-832c-d494ce654095", "value": "T1C51412196BB1C077ECB387335A3A67799AE9E6222064554703206F4DBC32FC1965E3B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654706758, "uuid": "db2a5a2f-e566-402b-947c-8ec76698e08e", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654706758, "uuid": "33f5e1f4-da4e-4840-849c-dfa2366751ce", "value": "3072:F1NjcVVnLpPuFRb+2F9l+gyqrse3w7SDsPKujINDLKu/Ahu8fBSHlGfcTDdPHs5g:nNeZ27/lTyCseqSTB8Xf8gmDd0Ok6rAg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654706758, "uuid": "e08c7464-7930-4d6f-9bbd-b3e343ca92d6", "value": 199568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654706758, "uuid": "5349e25b-2ffd-4281-81e8-09393291079d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654706758, "uuid": "a8f1a6ad-04fe-41ad-b460-d8a14900b2f0", "value": "SOA 6-06-2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc205c37-e732-11ec-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1654696670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696670, "uuid": "195a2f65-dd3b-4505-b552-41018c21c057", "comment": "Malware payload (Gafgyt)", "value": "ed77186d304d2e5d957a34f69b3e0b15", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696670, "uuid": "b90e80a6-eb72-4fd9-a885-c987b8e8e004", "comment": "Malware payload (Gafgyt)", "value": "788db01a3b8ddbdfc3f82858e61102003ba23ebab2dc9a442fa681d4067812e4", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696670, "uuid": "e7c4f658-62fd-4aaa-afb2-ce9288b362ce", "comment": "Malware payload (Gafgyt)", "value": "69b1ad64278047d4ed9e870e876d617454515870", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696670, "uuid": "ebfde71a-e12e-47b1-86a2-9b167c9d3bbf", "comment": "Malware payload (Gafgyt)", "value": "1ddfa8a7f6bdc22ba1ea41b502f811f6959ed7c8c4e93ac47cc42a175793569c0ec515316d9ddad11605659c494f3ec8", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654696670, "uuid": "2ff58cb8-19f5-44be-84eb-0d11711f46ac", "value": "T17913E176B0A31558C4CFC23B5CCB399A162AD20E0A96623A7ACD72B6DC16F2C5F46311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654696670, "uuid": "b706ff29-1b0c-415d-b01b-bdade11b2cbc", "value": "768:CnTpuTpboOMgRVhvjHVRYxJ4S3CdT9q4j4Wfuw41JnbcuyD7UWyqgYWrgCqYUSP:cMmOMwvzVEN3C9M4h/41Jnouy8NqMXqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654696670, "uuid": "1dbb36eb-6cc6-4596-9bff-814d36994005", "value": 41616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654696670, "uuid": "57bd8f23-d4d6-4e7f-8f47-64dc41b31a18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654696670, "uuid": "6e53423b-cb2d-4b22-9da3-cf70ff00ac82", "value": "gummy.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17d1b8ce-e70c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654679966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679966, "uuid": "757cf997-3c43-4e63-a960-2b0ebcbcc5c1", "comment": "Malware payload (Heodo)", "value": "84fabcf00f53e3c33a25f6cadebb9b49", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679966, "uuid": "72d093fd-aec0-48af-90ee-49eb4274c53c", "comment": "Malware payload (Heodo)", "value": "79490dbc1c608239f4a04402b08e7f383e0fb061e22369e758305d8763fccb9b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679966, "uuid": "555c0fb5-0e2c-48b6-a795-de29acba5908", "comment": "Malware payload (Heodo)", "value": "0b7eea7fc4e6cf37dc47dd3324add1460d50904d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679966, "uuid": "c043e4b9-fc8c-413a-84b4-56181b915ee2", "comment": "Malware payload (Heodo)", "value": "dc488eee8a7937e27416877fd97e00d161b645095f10f3b9195d1a4e66fdab4ef94be11f48bb2bd5132cdad3c3b64baa", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679966, "uuid": "944deeed-8439-4d45-b797-f3640bbdb3b9", "value": "T12844C0C5A791ECDBD92503790DE68364233DF2806BC74B033AB59A360E73B646FD5688", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679966, "uuid": "f9f3b88c-c2ab-40e4-b580-b5bdb6fc726b", "value": "963f2e88a5b03877d0583808b2526c1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679966, "uuid": "94ee767b-384c-4a99-b8b3-cda305658b92", "value": "6144:M1XyqUcchr3fdAdmG9rjcOLDNffPwz3GzMc5:MIccxfzGBcOxfHQ3GzP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654679966, "uuid": "e7d3e9ee-4097-4e54-91a1-c73243cb54be", "value": 274499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654679966, "uuid": "66759a1a-7b4c-43b6-905d-adca9a5f120b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679966, "uuid": "1897432c-21d5-4827-901b-3a1be32dfad4", "value": "84fabcf00f53e3c33a25f6cadebb9b49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d68be545-e742-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654703479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703479, "uuid": "f297d431-be9d-4711-98aa-c4d393a3173a", "comment": "Malware payload (Mirai)", "value": "659c64b8329f12439fe27ebf21aa21fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703479, "uuid": "1131fa57-d0b9-4ee2-9281-1938f85cf063", "comment": "Malware payload (Mirai)", "value": "7966b33fca3261107d8686d86b960d2d7ba380ed5ca9895a0e191e03b1a513c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703479, "uuid": "00b2cfbb-afb8-4e1b-bc28-b2baf67b843f", "comment": "Malware payload (Mirai)", "value": "aaa47d827f76675fab218c2c9ca66e87c00c045c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703479, "uuid": "0c791399-6c8a-4f9d-83c4-2c7ebd7d86df", "comment": "Malware payload (Mirai)", "value": "193c2198f7abae0e17fec8dc36890b7bc2acd9ea42a46eacb796ec1a4cbd89d3eaf0ded35744767414b2fc76fd43e4c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703479, "uuid": "e14fccba-040e-4e0a-aedb-5e4b86bb289a", "value": "T1E0B2D07813A66ACFF5689773AB1C9C53E0655460E23C93DA17C6C4431C6B3A1BD24EF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703479, "uuid": "0562a4e7-5ff4-43c9-957b-87ca2210d7d8", "value": "768:jDmTYT/nB6e6LWKdW710v34aCmwqXzADT6:fL/nNudx34tm3XZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654703479, "uuid": "2d056e32-b3de-48d8-b072-9139d511272d", "value": 24772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654703479, "uuid": "be1378a0-a3fd-4ee4-be5e-8ac7e9179718", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703479, "uuid": "04628b43-0eb0-45af-892f-ba7c39da1e7c", "value": "659c64b8329f12439fe27ebf21aa21fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "311339e0-e77d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654728542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728542, "uuid": "c6725d0b-3236-4c81-957d-24599dc27b5d", "comment": "Malware payload (Formbook)", "value": "04d5581cb7b5098ad418d83b2c805a16", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728542, "uuid": "cb43d4c8-88b6-4282-acd5-0094112eaf7c", "comment": "Malware payload (Formbook)", "value": "79a31aea4e37d41e6bdb99e35c35a1d92e5d9f04a47dc89b30b4c0a097d571c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728542, "uuid": "a4c3db9b-d9e0-4a56-87ba-16b9f5444f56", "comment": "Malware payload (Formbook)", "value": "b9dba7b9e60c57b43c705d60d92776c3e885e20e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728542, "uuid": "5be6808a-fe4e-4d2d-8652-04c59f2b825d", "comment": "Malware payload (Formbook)", "value": "9f1a34d162617e5a30c8a35c0c46140d419f266e8c2669d63fe337a4c02f47faeda9b6d712253c68779a8eb95ed7df43", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654728542, "uuid": "40864043-83da-4d1e-b1f7-bb8120e5702d", "value": "T111D29222FFAC8450D9052A32F877C7B11122AD125EF0691A36DE7B3FA732395584672F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654728542, "uuid": "0212a712-25ce-46d0-87ff-fc79a23f8c79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654728542, "uuid": "802cd9dc-9080-4696-96c1-d78c2f4aadb8", "value": "768:Kle742Rols8hZk/WPwFwIaG7BieJYls8hZk/WPwFwO8:Yj2CGNT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654728542, "uuid": "fa2de6e7-458a-4d40-a836-7d2cc2ea6ca6", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654728542, "uuid": "2bec5f64-103f-44bc-9f4d-9568bcccc8a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654728542, "uuid": "d248d549-764a-4979-b08f-bbf7be882650", "value": "04d5581cb7b5098ad418d83b2c805a16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ae90cc-e6ea-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1654665704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654665704, "uuid": "780a1b82-63b5-478d-82df-2d378ec38560", "comment": "Malware payload (GuLoader)", "value": "a3a2432e514d008a077474d1fc23b71d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654665704, "uuid": "3e1fd5fa-b09d-4c0a-9c67-200452a32ac2", "comment": "Malware payload (GuLoader)", "value": "79e000a7c245f0c53841b706383e2ca45104b66484134b42457e4c3f68b0a01d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654665704, "uuid": "56734b16-fbc2-4902-8370-2f413f2d118c", "comment": "Malware payload (GuLoader)", "value": "d99f969f10ed7a1ab0ab744a7c91b4c01745acaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654665704, "uuid": "121b2066-d026-440e-a002-709d2794d42a", "comment": "Malware payload (GuLoader)", "value": "dbacb75c0c2bcb1179e858bdf7d52f68e1b9146a9b4a0514e5bdb472b3e885f2cdf648602d9054148f99fe2d8c5ec4ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654665704, "uuid": "ddfdc510-c6ab-49ac-aba9-e69db006f85c", "value": "T1BF83E00533A4C86BE87307724E7A5BAAAFF2A5121074970F17608B1D3E36691DF0E763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654665704, "uuid": "fbaf8ad8-59fe-4f6b-af0a-f27daec19384", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654665704, "uuid": "ce86339f-ecf9-4079-b9c0-0967080bde11", "value": "1536:NmsAYBdTU9fEAIS2PEtuJ+b3Zbk9GKOb7jScGeHBaRnsBvu27fYo3KB:MfY/TU9fE9PEtuJ+b3ptKKCcGDnuvu2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654665704, "uuid": "ce9d9afc-28ff-4488-8947-26e13bff97f0", "value": 88486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654665704, "uuid": "5286604e-61bc-42e8-8d1c-9dbf8ecb6b8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654665704, "uuid": "de4df3a3-7dc1-4b7f-ba47-5142fafccbb1", "value": "Formcomp profile survey sheet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc5ef56b-e6d4-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654656217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656217, "uuid": "a1ad6786-86b2-48f6-9344-c3b63b815181", "comment": "Malware payload (Heodo)", "value": "14d11b729475324c7020e7965e759c09", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656217, "uuid": "19c36258-b08c-466b-88e7-5318f00ffe6b", "comment": "Malware payload (Heodo)", "value": "7a4fffdc75e0838830ee31aff29022d6683c233a7639679a9204e53cee6599de", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656217, "uuid": "158f95e9-1196-43a5-ae92-94acc4fbd8a1", "comment": "Malware payload (Heodo)", "value": "71d9033f36e1ee2f2c191092d64305b9ec40a726", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656217, "uuid": "72c1b2ae-f34f-438f-86a4-537ec0894bc3", "comment": "Malware payload (Heodo)", "value": "378c91eea0eac97af6d944f2610184a9fe6029eff9a88e23d6e6a16a34fec0383d85cec6a931f12dd94feab5d59f6af4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656217, "uuid": "7e72a133-2f61-425d-be77-0fe8637218ed", "value": "T1CF04026DD14C06DDD611137CACE90F3392FCF980A0262B5BBB70A6774BA4B96DB5B900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656217, "uuid": "3f6dbc95-5b6f-4583-86d6-7b20164364fa", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656217, "uuid": "4b5456fe-48bd-4bfe-a8e9-e5b7b2234c35", "value": "3072:rpjffFcO4J8FYMh1PAzu8GmeR8dk5pL/rRn/02QBgjVcoe5Uy5i6zNL4ZNgzPKcQ:rRHWW6u8QKkXzN/09gjV/eey5/NsAziz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654656217, "uuid": "9b6a711b-01d9-4ca4-a9d6-d1df186ceebe", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654656217, "uuid": "0ef19c32-1fde-4a5b-ab25-d3cde0f9bfff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656217, "uuid": "32346b1c-a619-48f3-8b96-763536cef590", "value": "7A4FFFDC75E0838830EE31AFF29022D6683C233A7639679A9204E53CEE6599DE.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bcb9611-e745-11ec-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1654704669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654704669, "uuid": "4e923e01-3d04-4b0e-aae0-23f36dc7c586", "comment": "Malware payload (Gafgyt)", "value": "fda6f92ecd7847b967e70e8312e4fb1d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654704669, "uuid": "7d4c3b94-f301-4e39-a538-c1d4a12d50c1", "comment": "Malware payload (Gafgyt)", "value": "7a51062b457d3eceea397580b15cb9f8c45743c5d48c32a1f85b670e6470c1c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654704669, "uuid": "a28458e7-db0f-4556-b4be-e4de565e8f94", "comment": "Malware payload (Gafgyt)", "value": "ebe6376e6b420610a5f34809b31c9384cfa13cf8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654704669, "uuid": "c4dbdef2-b9af-4814-b731-eda776e5c59d", "comment": "Malware payload (Gafgyt)", "value": "8a42ff3a1bf1b85ce0d864de5b6179858b74982189fdb97bc36f2a9c98004c7cb99aeb965ae4323de374e5f26d7d7299", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654704669, "uuid": "9690ca56-9696-41a1-a9a0-da6f528b5724", "value": "T15813F123219511B0C1D068B9FFFED40623A6AE7CD6C7365DFB04203AB572A4628B7B57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654704669, "uuid": "eb8049ce-9177-48e7-9f34-f5cb06640615", "value": "768:UGn+JOZWDTd1TaPMXnoWIC2KDq0f1X3UnSYUOO/aN+J4Eib:MJVDTGM3oVCrfGzUJJlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654704669, "uuid": "19088bfb-0fe2-452d-af2f-7c1c352d5ba4", "value": 44576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654704669, "uuid": "6811ee91-a142-4bca-855b-1ad36142f85d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654704669, "uuid": "e8096c9a-6fbb-49b4-acfc-f5ec2b9e26d2", "value": "fda6f92ecd7847b967e70e8312e4fb1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7e9c7a6-e742-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654703454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703454, "uuid": "79701f07-f741-4346-96e6-df0310fd76a3", "comment": "Malware payload (Mirai)", "value": "30d9ff17c8d5c63940faa5cccba96a40", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703454, "uuid": "56f9e61b-540c-4e8c-85da-076ac852c4f5", "comment": "Malware payload (Mirai)", "value": "7a6ffee81fd22d1fe26b494f8d89a88b9226d7bdcd08d830506403e7c1d6081e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703454, "uuid": "699a7178-5187-4c29-ab77-5e00f9b8cea5", "comment": "Malware payload (Mirai)", "value": "0d5aba5f449a30509c7972dcc0c8225b622995e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703454, "uuid": "3b9dad62-210b-45e5-b6f4-0345d7682331", "comment": "Malware payload (Mirai)", "value": "bc1addcc7f3b5716b9d29104c22481de88b097a674f0ce19ab701a2681e8fc5aa82a5f962e8c47a89831cac03d1ece69", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703454, "uuid": "dd21e8a4-21cb-492e-985e-601b256839a8", "value": "T1B7338C7685A89E98C62085B4B516CE385722F004866B3EFBD784C795E00BEFCF1987F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703454, "uuid": "3b66846a-f9c4-4727-b600-c321c0994035", "value": "768:7aTaAejehjeywvmO1KN1dHFuqMUbzofs3I+qn8vG19CMQodWzIkCvM:7a/akjFwvSNFuqMoofs3vqnW83djkCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654703454, "uuid": "023c6303-96c0-4e0f-ba93-b6cf9e992381", "value": 52712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654703454, "uuid": "16390e2a-d558-4534-8002-199a1591b9f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703454, "uuid": "548e0960-e207-4db4-8433-731a609b3644", "value": "30d9ff17c8d5c63940faa5cccba96a40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d9cb07a-e748-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1654705960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654705960, "uuid": "404f9cf9-6aa1-42dd-8463-46571ae5f867", "comment": "Malware payload (RemcosRAT)", "value": "1127f6b5f16bc12401757f1b8b3e672e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654705960, "uuid": "574f22aa-a854-4c6a-b241-e0abb26327fe", "comment": "Malware payload (RemcosRAT)", "value": "7a95dfe43a03318c0301489c77ecdb7f5da54842c4731a1f0c4214569155813e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654705960, "uuid": "e86c8dda-74ea-41ae-b688-6283294eaa07", "comment": "Malware payload (RemcosRAT)", "value": "9d029921c62f14c4d29579d75d78d3549bbbf0db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654705960, "uuid": "f87f229b-141d-4d89-b054-dbbb049668a8", "comment": "Malware payload (RemcosRAT)", "value": "fa759b052efa5c7040909b66f35a4ff23fef169ff83762e02fba2f53c6cb6ae70556708468bb09fb474649f9eb6c28f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654705960, "uuid": "b1f19f36-ba05-41ff-a5c1-f3f024e904cf", "value": "T16B45DF6D27F5C637F02E27369064001695F8240BE38AF71A2DC66DF818A73936D4A6FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654705960, "uuid": "9470b841-db6a-4828-a889-4d4e98b60632", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654705960, "uuid": "ef893f6d-3421-43f2-af5c-d540c466a020", "value": "24576:JqgvrxAZ0hGZnaMhqzfLNdiwwcAzSG6Mk6UpX0DIHJMm:pK0wZnHhSLNdbwcAzfk3pEDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654705960, "uuid": "f84ef724-eaae-4fdf-9e85-7fbd352812aa", "value": 1169408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654705960, "uuid": "1dc66871-c29e-4e9b-b430-78545b640052", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654705960, "uuid": "ae7dee11-1406-4eca-8919-2628c46f6066", "value": "1127f6b5f16bc12401757f1b8b3e672e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb755894-e71d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654687650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654687650, "uuid": "192756a2-4e45-47f8-92a0-e298ce2db0cb", "comment": "Malware payload (Formbook)", "value": "21d442eed7bdb224a3863920654c9049", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654687650, "uuid": "eacc7307-9c4c-4e3d-b7dd-bd99ad2a415e", "comment": "Malware payload (Formbook)", "value": "7ac6589bfa1b5c0e754852d37edc156e5756cff6ae5c41665d0fe5c722060fa6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654687650, "uuid": "c002806f-4b97-4c76-a39f-21479945f6ce", "comment": "Malware payload (Formbook)", "value": "bcd24ad4c67184e42aa2c5a0a045956671cfb47d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654687650, "uuid": "3889fbd6-de53-4cb1-80d9-46a73e3198ed", "comment": "Malware payload (Formbook)", "value": "625a335055db62629d77b0e5898431143cabb8bdb1b316f2816ff4828f5420b7530e5e3864fb066a3edf726e968c8315", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654687650, "uuid": "fbf17300-3e8f-46f0-95b2-104b6dc9f614", "value": "T12AD423D91A808322401EF6BED3167DB601EEDB1F8634B4F669C7C611A6457B1324E2FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654687650, "uuid": "36ffe447-ac8c-499f-b425-c44180768dcb", "value": "12288:1fn+2/k9K84y0NakX63+bGmCZZxUDe7JRQeYYyFEDRmCcsQaaiF:1mUkE84yBkXeZselRvlFmRLLiF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654687650, "uuid": "ac063c5d-998e-4d52-b449-2a364266a465", "value": 621437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654687650, "uuid": "a756a91a-6e9c-4634-8b50-6c5b066bd231", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654687650, "uuid": "3d8b1ef5-717b-4b6b-b2ca-ca87492df4f7", "value": "Shipping documents.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b25b5c83-e6d1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654654885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654885, "uuid": "1984e110-9705-4589-92c7-dbcbb84d5438", "comment": "Malware payload (Heodo)", "value": "e53560fa7b80b06bbd37669371d0d245", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654885, "uuid": "d12607ea-ae70-425e-8875-15438d1f4398", "comment": "Malware payload (Heodo)", "value": "7b25b860e09c49509fd6a0ba823141ec6bcbd36ab79c47113084226548615e72", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654885, "uuid": "1c7e45b8-4383-43fb-b4aa-47c2ab977201", "comment": "Malware payload (Heodo)", "value": "0f29a0cd60ae392390d4220cdf18d631d705ca10", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654885, "uuid": "05b2558a-cab4-4d2c-9845-84079dd55061", "comment": "Malware payload (Heodo)", "value": "308224c0e879c311b4e57eb144fac7859a87acd062fe5bca71d0991c90eccda4b187e78051144c4b44890c95699b40eb", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654885, "uuid": "1504734b-c902-4b19-b885-0601314affd7", "value": "T1A604023EE5031A98C22ED8FC58EE6DF9D5F634006268063A1BA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654885, "uuid": "ea67ed46-3f34-4d01-9268-7dd852fa04c2", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654885, "uuid": "3c51ed4f-a388-4784-b48a-cac243bd204d", "value": "3072:VpjftvFs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VRxi1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654654885, "uuid": "689d89d5-8d15-4125-9aee-ea0e224595b0", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654654885, "uuid": "09ca9c77-c2a8-4f11-90c4-9cd612141813", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654885, "uuid": "fb0e69f7-f4e5-4972-bb90-2884b3871be7", "value": "e53560fa7b80b06bbd37669371d0d245", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "977fbbfd-e700-11ec-93bb-42010a9c0043", "comment": "Malware payload (PandaStealer)", "timestamp": 1654675026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654675026, "uuid": "5f780941-cf97-47b3-a10f-af7618ba9b64", "comment": "Malware payload (PandaStealer)", "value": "79a7debc04b66da7592ef55b768e46b4", "object_relation": "md5", "Tag": [ { "name": "CollectorStealer", "colour": "#76C79A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654675026, "uuid": "9c4c5fb3-0f6e-49b9-a3a6-bb3537cdbcf0", "comment": "Malware payload (PandaStealer)", "value": "7b8253ce462a3a1f6efcb7a7d27b8320751e90db7afd4846545d8e823bb8953e", "object_relation": "sha256", "Tag": [ { "name": "CollectorStealer", "colour": "#76C79A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654675026, "uuid": "db8789a2-42c8-42d8-93f1-197f568f0696", "comment": "Malware payload (PandaStealer)", "value": "c71876635a7dbda629302a388fd36a0ee7c4ebd5", "object_relation": "sha1", "Tag": [ { "name": "CollectorStealer", "colour": "#76C79A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654675026, "uuid": "c9d1beac-fd9e-4c50-b8a5-9997a2449839", "comment": "Malware payload (PandaStealer)", "value": "9161250df32ed5948f758075e0e8280f303f74170a13ecf57e93690020e276cd19bdbde516e06ba43b0c123322e8a1c7", "object_relation": "sha3-384", "Tag": [ { "name": "CollectorStealer", "colour": "#76C79A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654675026, "uuid": "6c92de77-8f8b-4b80-ae11-7e91d910c875", "value": "T1ADE4C033F0C2C07ED0321032596CEB6259BFF9320A25499BA3C4156E9FB57D29E3665B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654675026, "uuid": "f28cafc7-0dab-4304-b2d9-891d2d23b374", "value": "2a908babc5cc3af850e078751d7de0e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654675026, "uuid": "156fb79d-347c-479c-95dc-48a9444f95eb", "value": "12288:VoJqNIPtNmO6IOOEp0TMlja7NRl2PSVikIyoyueh+AkHcnLwuukoCOD6zlDjOz+2:VoJEKZ6IEGTMxapRl2PSwHTehy6BQ+p4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654675026, "uuid": "3ab71dec-4db7-4203-ad1a-b7a36f3f3c68", "value": 698280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654675026, "uuid": "db962b70-f6b3-4106-9d5d-c96157c75340", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654675026, "uuid": "ab244863-7470-4c09-beb8-7f552624dce2", "value": "btwGaban.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d353d25-e74e-11ec-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1654708456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654708456, "uuid": "be7d3d4f-51da-4fca-8511-52eea6307847", "comment": "Malware payload (SilentBuilder)", "value": "091d53cdd1250f53d6322ae79f09891b", "object_relation": "md5", "Tag": [ { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654708456, "uuid": "7e4a9fc6-50e7-4990-9a58-04fcb2397d10", "comment": "Malware payload (SilentBuilder)", "value": "7cd973b129a836cfc82dc37ad473b1126daac2dfab010a7dd5d816b09caca34e", "object_relation": "sha256", "Tag": [ { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654708456, "uuid": "48119c09-aea4-4926-86b1-1e33ac3d8e3f", "comment": "Malware payload (SilentBuilder)", "value": "15e0916052275662b4358f3353aeab705f607c4b", "object_relation": "sha1", "Tag": [ { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654708456, "uuid": "d8e01149-de6f-4def-b419-c8c6d62377f0", "comment": "Malware payload (SilentBuilder)", "value": "be023935e23d87d11e00e72410da07c3b1fd2ceb38d1a909148839a42d3832d4c600e955a2a5b2894cc1ca38d9d4077f", "object_relation": "sha3-384", "Tag": [ { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654708456, "uuid": "1407793b-5a92-4bd8-b4de-9c8f16458cb2", "value": "T11923B546BB5AC85DF915873448E747EA7323EC314F6B07833669B3256FF88A05A0325B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654708456, "uuid": "d54e025c-957b-460a-a1d2-3e7adc494578", "value": "768:hDMPKpb8rGYrMPe3q7Q0XV5xtezE8vpI8UM+Vyis73q/44fq/uV9:hYKpb8rGYrMPe3q7Q0XV5xtezE8vG8UN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654708456, "uuid": "ca5fffa1-b753-4346-ac75-40a61dfbc1e8", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654708456, "uuid": "0c033ad9-476d-4f0d-8516-95ac47c3888a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654708456, "uuid": "8bf9d3e8-3e77-468e-a43b-6fbc0769e33c", "value": "report-2781679.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f2be67-e6fb-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654672853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672853, "uuid": "bd963365-430a-4f18-86bd-0019eff0728f", "comment": "Malware payload", "value": "ff1706b37fea16d75b739a5396d9ffba", "object_relation": "md5", "Tag": [ { "name": "2022-29464", "colour": "#352DE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672853, "uuid": "5f0c5e87-faf1-4ec6-b5d3-7b83812c95f9", "comment": "Malware payload", "value": "7d31843ce5231c95ce07a609cb4473fe53b95a8d0685df9d666de348d17c69ff", "object_relation": "sha256", "Tag": [ { "name": "2022-29464", "colour": "#352DE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672853, "uuid": "eaa997c5-ffce-428c-b7fb-e076cba95dfb", "comment": "Malware payload", "value": "a077fecb7d8f0d78fa6497f1da99a673f1c91455", "object_relation": "sha1", "Tag": [ { "name": "2022-29464", "colour": "#352DE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672853, "uuid": "4c188d52-6234-44ca-a35f-9f576c680961", "comment": "Malware payload", "value": "f89a326dcc847c8e1a55bae3d852fc4485bda9b2353baeb844842ab32c3fc2d92a6832102b81eb513decdd694c3bfa27", "object_relation": "sha3-384", "Tag": [ { "name": "2022-29464", "colour": "#352DE3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672853, "uuid": "50b2a868-1991-45ca-99c7-7c64887abdd5", "value": "T1BA71AB20C9690DBA02D4806C88FCB2D3061C89176F8D3D39756D9A5C2F4D73E66B6BDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672853, "uuid": "6eb28433-baba-436d-a07a-13c965a685f3", "value": "48:vIuTHvmiHLjsbNbGAS5JHTvnnMSZ88d0Swrn0StEhmV4ghmV4phmV4khmV4ihmVx:wuTOgbMSGShStEhm/hmYhmnhmXhmv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654672853, "uuid": "02f00930-9257-43c4-b8cd-371045e7dd79", "value": 3713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654672853, "uuid": "7fa30b98-18e3-43b2-8496-46a9a23f583c", "value": "application/json", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672853, "uuid": "33823cad-6e9b-4bdc-91b2-399b0a035046", "value": "7d31843ce5231c95ce07a609cb4473fe53b95a8d0685df9d666de348d17c69ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9995da67-e73a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654699941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699941, "uuid": "0eba4b9a-5eeb-4ccc-a9f4-44f20ae88f1c", "comment": "Malware payload (Mirai)", "value": "456012f1be70db4c5737ea2d0f9d8826", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699941, "uuid": "0b7dbce1-4a84-4348-882b-f411eb99768d", "comment": "Malware payload (Mirai)", "value": "7d8c71cb62ba9bad2b66a4ecaf307bfd1c1752a4d428874228d5993ce391679b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699941, "uuid": "3e3ee943-4312-4813-a7e4-68f246da0b7f", "comment": "Malware payload (Mirai)", "value": "940856254452d6f6cb995d4226265b39a5dd960b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699941, "uuid": "630d4615-43db-45c9-b408-fcd794b89c39", "comment": "Malware payload (Mirai)", "value": "1bc1c31bc89289b4e33f8e357ed865a59c3b2e9ad928ef0983ed7f0aeed86a040ffe71bb2ad8002c67429bac24e5011b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699941, "uuid": "ccc6ba09-7c61-43ba-b9ac-549fbe4e53bd", "value": "T188A3C71E7E169FBCF79D823447BB8E21A65833C62BE1D185E15CDA001EA024E745FF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699941, "uuid": "32f7862a-e383-418e-9c97-541726934e8d", "value": "1536:v9WGNL7Z6uavncqBvpQJ9c8x/VLa/fUKcamvwJQWWtwq:cGNL7wMapQJ9c8FVEfUKcamvwJtA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654699941, "uuid": "768c46a5-10d2-48f2-ace7-f4a5db97f085", "value": 101480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654699941, "uuid": "65b2ab1d-a7d1-42d0-a46f-5986bf5695d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699941, "uuid": "73c907e9-e1c6-4711-a436-90967e96538b", "value": "456012f1be70db4c5737ea2d0f9d8826", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc09721-e71b-11ec-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1654686690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654686690, "uuid": "473b105c-31b7-4dd8-9628-596fd0cb42a1", "comment": "Malware payload (SilentBuilder)", "value": "069a06eedf694aebb0a82037f8e10ccc", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654686690, "uuid": "1e20194c-04a4-4b34-b119-7161740ebffb", "comment": "Malware payload (SilentBuilder)", "value": "7eeb8f66914f9aced1cb1ae8618fbbe311e67345f1edd5e847a07f7647d9409f", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654686690, "uuid": "192c0a97-f782-40b9-aa9c-7717db47a45f", "comment": "Malware payload (SilentBuilder)", "value": "efb795528aebd572adbe710250c89fc47227cdfe", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654686690, "uuid": "bce44cb4-7598-4a42-8072-523c74b8b674", "comment": "Malware payload (SilentBuilder)", "value": "a05f04308c8eefa88cab463464d91b2948cfc9d3cc74cf8a443804f9764e5882c1f4eca0a647ecc9b04b10df4ba939c5", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654686690, "uuid": "ab6f216b-2278-410b-b480-8d5eaed5994c", "value": "T12F23A446BB5AC85DF914873448E747AA7323EC314F6B0B433669B3256FF89A05B0315B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654686690, "uuid": "2d37e7f7-94ae-44fb-ac86-6dfd7444ef79", "value": "768:pDMPKpb8rGYrMPe3q7Q0XV5xtezE8vpI8UM+VQTUs77quK7KtGu6m:pYKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654686690, "uuid": "c0df81df-411b-43e5-ac05-003ab81d93f6", "value": 47634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654686690, "uuid": "0b697714-3ff2-41f2-bf05-197ad9c98007", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654686690, "uuid": "0b84eed4-a924-458e-9095-c5999840e1cf", "value": "Telux.com_BIZ_2022_06.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5de6664-e6fe-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1654674245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674245, "uuid": "1518203b-6edf-4abe-b954-115e5ee7f709", "comment": "Malware payload (RemcosRAT)", "value": "8d94ba71d0fbe2f77b3a905d198b502a", "object_relation": "md5", "Tag": [ { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674245, "uuid": "da5e2bfd-5a8a-49f5-a419-cd9d5721203c", "comment": "Malware payload (RemcosRAT)", "value": "7f6c55baad9236defe5fada468e13f8f5257791caaf132fb7937bb9d2b74ad04", "object_relation": "sha256", "Tag": [ { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674245, "uuid": "d08bf072-3107-486d-8dd2-9d0ec3154c82", "comment": "Malware payload (RemcosRAT)", "value": "9c747e1758539323d3ded9cf454bbd8b4d974eba", "object_relation": "sha1", "Tag": [ { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674245, "uuid": "05a34e1d-749f-4b10-9d5e-d582079e3f99", "comment": "Malware payload (RemcosRAT)", "value": "3bc02cf283de15160f3e316bf1a34579330c55cc6abcdb140448f086a59ed373e9cc80278f8c43741d685b2ff39b2382", "object_relation": "sha3-384", "Tag": [ { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674245, "uuid": "21e5306b-272a-4045-be99-d344fc4de040", "value": "T1B95533705DCE548268DF532AF817F763368CF19AD8E480032D943BA3B3D8D5196E6E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674245, "uuid": "750e650e-3547-4f6e-a3bd-8ca363c7b095", "value": "24576:AF8Lfk+15QepizCuVsEPFUCtBZ96KfzGsgeERYBWbW6h7VqjxkLS:zL8+1P4G+sEPfZ6KfzGnXRYgbWY7Vq++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654674245, "uuid": "66a60710-b8ff-4261-a2f7-5dc1c68217c3", "value": 1334856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654674245, "uuid": "d0e86220-7d9b-40f1-bb1d-37cec5caaa0e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674245, "uuid": "5a123bbe-4594-4e2c-a7d3-5a8ba2c158e0", "value": "BL-SHIPPING DOCUMENTS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e26582-e729-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654692611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692611, "uuid": "66b703d0-5890-4fdd-91ae-de1a9e1595ab", "comment": "Malware payload (Mirai)", "value": "2ab35ff2f165820c59ef65d08123e64f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692611, "uuid": "cb9eb47c-544f-4ecd-b8cc-ad5ea6dc0eb8", "comment": "Malware payload (Mirai)", "value": "7f86c3e03bff54a2c7051add9d382d74767442cfef7a5f434bae7a9ff1898c4d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692611, "uuid": "544f51a9-a9fa-476c-a743-71b6fc1f146a", "comment": "Malware payload (Mirai)", "value": "39d6178730b7857ba50cfc67b854a533b470b0c2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692611, "uuid": "a30df614-00ce-4b77-bc26-5b87c20b4b57", "comment": "Malware payload (Mirai)", "value": "8cdc8480ed99c8a2bc4a2519cd6c044e284833e952247bb4cb90c21e94bc8b054d417dea5de30b68a9267935fa6d2612", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692611, "uuid": "3f02a78d-10b3-4992-b6c6-6956b818dd2d", "value": "T1A4031A52BCD29E1AC5E0A27AFA7F959C3320A3E8D1DF3317CD141B407ACA51A1D93B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692611, "uuid": "7f1b5621-bf83-4638-9ed9-2030ed2ce6ff", "value": "768:131QaH0YY+d6DPecGiRvvmUL5R8kaNxZXYaGhzGobKK658K2fegEEehvmYEOSOB:13XUJ+d6RRjR8kai3hSou8xO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654692611, "uuid": "cea6ed2b-627a-4f10-8a36-ac1e49789e84", "value": 38088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654692611, "uuid": "16e67626-4e46-4d80-bd3b-8c7e24733e34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692611, "uuid": "a2407e0b-17fb-4494-810e-1281ba6a7110", "value": "jew.arm5-20220608-1250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a5c76f9-e6eb-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654665851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654665851, "uuid": "49421e65-1379-4ea5-8cc7-9c6c7a75113c", "comment": "Malware payload (AgentTesla)", "value": "42bcd01caa0a615188e89407ef9ed014", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654665851, "uuid": "9b4cc63f-24a1-4272-a6cb-8029d84fbdf1", "comment": "Malware payload (AgentTesla)", "value": "80b0a6e0b56fe84f7b1fb1543704b1d4b61684ca0b8ec85a3957e03a5a27cb91", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654665851, "uuid": "d0f7296c-f2b2-4a31-a74b-a090a29a19ec", "comment": "Malware payload (AgentTesla)", "value": "31844ead1330317fd8e28314196af30cc9fd1d38", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654665851, "uuid": "0d6635a4-af18-4af4-8f9e-117a12df649c", "comment": "Malware payload (AgentTesla)", "value": "c3d4abc1dc09eae51cdd81c0cf6fdf7bcbf81d45b21744927234776c766364febb2f80c79f352e485b2595932cca38c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654665851, "uuid": "61bb2893-f79b-45b1-87d4-0f686b3e754e", "value": "T159B2E701E7E5D275C9B919FAAD22628042355D19CA12EA0B788A332F7DF330CDC5D3E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654665851, "uuid": "ffda2568-76e4-4226-8ed2-8c09409a05d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654665851, "uuid": "d535e8fc-430d-46e3-907d-5444b51a0458", "value": "384:8b4UCWFtg81SDr84bgk9+2j+mu5GAH1zFRX8:NUCWsSSE4bbenH1z8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654665851, "uuid": "913a5f5c-6340-4dc7-b3e4-c3da20f8178b", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654665851, "uuid": "80ee7371-fc57-4d87-bc4f-5b47ff75cb76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654665851, "uuid": "7707a07e-9643-4838-aff0-91030b258e88", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c4ee7f6-e74d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654707918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654707918, "uuid": "182ea7c9-c86a-4f74-90d5-3ef75a127434", "comment": "Malware payload (Formbook)", "value": "278710631b20b326fef9aed1c93451db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654707918, "uuid": "9791c637-ad34-46f0-94bc-f0ee063fd49f", "comment": "Malware payload (Formbook)", "value": "80f508b4c73ab8ad364242a2a4e2e9f1cdf5615587e09b00b9e006731db6a993", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654707918, "uuid": "58cb37a0-af28-43de-bfa7-36e2462c4ea6", "comment": "Malware payload (Formbook)", "value": "0aa12fc9509a46e6809e4a9af2dfd9cd853290a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654707918, "uuid": "b057596d-e16a-4392-bac8-601cccdfd0a0", "comment": "Malware payload (Formbook)", "value": "997675147dd5728e6fe5569206b02b6a7cbe1bcc0ca5ae9c77af9de923dc26c2a5f085b2ab947e51e60e0456e402fe81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654707918, "uuid": "8d974cd9-3190-4439-8caf-c9223c27b2ca", "value": "T118E4F1F59FF878A4E12921777460613C37E34E1CD8A9D53AC68BF14A34A6AC620F1E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654707918, "uuid": "eff143ca-aec7-4a60-ba09-75b9965382cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654707918, "uuid": "f1139c7c-40df-4161-89c7-58177b34ac2e", "value": "12288:sNk82iN/I9qXzMnTjr1Ah7rS4p/EzYYlAP0ekdiL6gQw1m0ayGt8k:i1pI3nXr1mPAYY6P0ekkQwQ0avt8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654707918, "uuid": "85f94aed-801c-42b0-9a8b-bd5027c7de3f", "value": 662528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654707918, "uuid": "602756c1-9958-409d-a464-4d3618af2367", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654707918, "uuid": "2cdabb24-8eaf-4944-8d2a-f72ec6b155bb", "value": "jwi93cBMUM9ucaD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "000e8240-e712-11ec-93bb-42010a9c0043", "comment": "Malware payload (NetWire)", "timestamp": 1654682503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654682503, "uuid": "b9fe2234-3e30-456d-ac0f-fe4a321119f4", "comment": "Malware payload (NetWire)", "value": "580a3eb425ff685473ce8efb4102f57d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654682503, "uuid": "c540d834-56c4-4ae8-a62a-a18ee8958ab4", "comment": "Malware payload (NetWire)", "value": "811690717824917911f152507cf4232df4aec5f198a57a638a3a9e0a738e84b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654682503, "uuid": "31b05470-92b0-476e-bbb4-abc5c83766ed", "comment": "Malware payload (NetWire)", "value": "f74867d322ab1f6ff47a03e0e762ffd222d5809e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654682503, "uuid": "f4f48fe0-eafd-46ba-9349-9713cdafd089", "comment": "Malware payload (NetWire)", "value": "81406f367893ed3e1ceb77ea768c3eff79397722419ba2c970f13f5c610b20e85b6ccf9c826ef0818da387cfbccbed9b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654682503, "uuid": "8b2598e7-75cc-4916-8a80-358ab6902f10", "value": "T114E4D090B3AA9F71F17963F27520A00817F4391E45D1E23A8ECDB0CE66A1B8259F5F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654682503, "uuid": "f7e78f62-998c-47f8-a25c-b6e4af3b423f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654682503, "uuid": "fbcb3dd4-0f58-402b-9141-8643d5b04296", "value": "12288:UJpiV09qto47CgnHHRIvT2oWgZzJ/Wcjc1H80ibEHw:ypiV0K7HHxIvT2oZB7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654682503, "uuid": "221472ac-8951-4d09-a9d8-b9b170288937", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654682503, "uuid": "8e98e376-1a5b-4979-81c0-9e402fd22e38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654682503, "uuid": "ff103e44-286e-4a00-9ac2-29c13c5f4b6d", "value": "580a3eb425ff685473ce8efb4102f57d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96ba6471-e749-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654706378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654706378, "uuid": "a8071636-3417-4c7b-ab28-8dd8c9faa314", "comment": "Malware payload", "value": "b66938ccbe57075dcadbb0eca53e4c32", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654706378, "uuid": "d9db9fd6-a47b-4794-aea3-db18c659ba24", "comment": "Malware payload", "value": "8140e974305689e26b6549bcf43853ee84f1e1c8889249bc3fe1cb491f4c3810", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654706378, "uuid": "8ca3d6a6-f8df-421b-aee2-9b59930bfd8d", "comment": "Malware payload", "value": "0621e8ba05f6e893d8376fa42265bc8961eb900d", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654706378, "uuid": "5b6ea7c1-a355-419b-8d48-18f90450b8ca", "comment": "Malware payload", "value": "3cafd91324c2f65d160acc651299532fcb48d44498c0144129c1d495060deba02aca4a7f487074af59be20a964b64b05", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654706378, "uuid": "bd5aab24-aa1e-4739-948d-24cff2739f66", "value": "T135252342DEF2F13EFAA5F978B1D249423621C5E2792703871902F03CAF6C946BB56359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654706378, "uuid": "689d6911-93dd-4a07-bc72-3b4aae827158", "value": "12288:XR3bLX4bQ294mSi9qjttGEl9LybrRUE12ZU8g5CJZPWdjB09xUhc8uMHi3JGuqob:dN2Mi9A9Irx12Zy52Z+dqTHMC3JGuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654706378, "uuid": "e429623b-9d23-4a1d-b83b-5ac3c6896107", "value": 1018437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654706378, "uuid": "f60cf5be-1709-4b26-973a-6f5285cd9c7a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654706378, "uuid": "99b92c4d-cee5-465c-b9a5-553fd6279b3a", "value": "SecuriteInfo.com.Trojan.GenericKD.49037278.21052.3875", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d640da1-e705-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654677157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677157, "uuid": "7b479ba5-aee3-4b90-ace1-0c8afe02a131", "comment": "Malware payload (Heodo)", "value": "b484964329f6890d8c4714478041b332", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677157, "uuid": "b01ca6e7-c646-4f56-a10d-8261807d52dc", "comment": "Malware payload (Heodo)", "value": "814df2340c59d6e83779f2c503f8b03e545c5e1b66da11194c2d8e55a6f1b61d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677157, "uuid": "8f709273-2683-43b4-a0ea-17da1e0f162e", "comment": "Malware payload (Heodo)", "value": "9db95de0354eb008592a716221c21eb12bb830b3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677157, "uuid": "341e509f-c39b-456a-b866-660bf9b3542f", "comment": "Malware payload (Heodo)", "value": "21d47fdc3f5854c7d477cb379ff7e8d1e5299543f69c138211aa40a9b788580208ba71ba31023373db54c25a530f5f00", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677157, "uuid": "02ec4500-88dd-4684-aeb5-7d64ba513f89", "value": "T17644C089ABE1ADDBD51407798DD6D324333EF2814B8387076B2598390F23BA4BFC5A45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677157, "uuid": "b5f13888-ce42-4fd4-82cc-cf502231218c", "value": "963f2e88a5b03877d0583808b2526c1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677157, "uuid": "32308817-a7df-4d75-9d0f-eaf2a3d57643", "value": "3072:7R7Ve82w+Oh+UjuFJrfr7CS/FmikytkqroMdjaWtHCqPZ4PEx2ES2vZg3f4L5ZJi:7lgJuk4uFxOmFwytLVxDtfPZ4PE2sPs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677157, "uuid": "8bbbd775-4c38-492a-8204-bc521a70ff50", "value": 270403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677157, "uuid": "2eebf03c-ee8a-4e4a-bd39-c39a3d3af912", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677157, "uuid": "186cd269-4dde-4913-a35f-c530b5447b58", "value": "b484964329f6890d8c4714478041b332", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef2dd5b3-e6d6-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654657135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657135, "uuid": "0ecec984-b806-4ea6-a123-76bf171df277", "comment": "Malware payload (Heodo)", "value": "1795b1a031ef9acab3508dd87995b11d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657135, "uuid": "90656e22-cb4e-4b15-9406-ef033bda58fc", "comment": "Malware payload (Heodo)", "value": "8258ba2a7e051d91f7d860362df4b3e25f377c1fe3e9b7c5a183e27297191882", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657135, "uuid": "d3191619-fabe-472c-9285-304fe61fcca7", "comment": "Malware payload (Heodo)", "value": "b561928307942334e265a6c18e4c9305dc59511d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657135, "uuid": "6a32cfa3-30ae-422d-baf1-3fe1cc80475d", "comment": "Malware payload (Heodo)", "value": "c869506577abbcad461fcd42f06956bdd0e930c06414af1f29c8199fd88e5f1aaffe2d09f513ce49b66e362676d8e228", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657135, "uuid": "fd560e54-1c73-4215-93ca-d6a047ac67e2", "value": "T16604023EE5031A98C22ED8FC58EE6DF9D5F634006258063A1BA77E7C1D71661C11BCAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657135, "uuid": "f5f63cfc-cb1e-4ac9-b392-62f67766e788", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657135, "uuid": "553db7ff-b2d4-4116-928c-16fda49dceac", "value": "3072:VpjftoFs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VRSi1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654657135, "uuid": "c1b16d7b-b63c-48c8-abb7-36d4ac856419", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654657135, "uuid": "3821eda5-0831-4d7b-8f28-13875caf6daf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657135, "uuid": "c4045316-d478-4f12-85a9-71f0e4b9867f", "value": "1795b1a031ef9acab3508dd87995b11d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62d5f9b0-e705-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654677086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677086, "uuid": "d26ec19b-7377-4a37-8b01-66eebebc6314", "comment": "Malware payload (Heodo)", "value": "92f55112ffa6067be59e4bbca0b0b865", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677086, "uuid": "7af5aaef-b131-476d-9b61-b4498a9afe35", "comment": "Malware payload (Heodo)", "value": "8283ccfb3d0c0b0a981713b928d7d08ddf7b3164c2998af1dbf803efa7dd887d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677086, "uuid": "e6788efd-f85f-4142-85ec-adf20d20f65a", "comment": "Malware payload (Heodo)", "value": "874aa5cbf4284fb00dd3298f0f39f7f08690c477", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677086, "uuid": "70b42132-adcd-4cd7-9aef-f463f171b57a", "comment": "Malware payload (Heodo)", "value": "83c276dab92523eeaabc13094fa5e32e4b89c0cb8b1bae55c9c06724888e67109d3c7cdfdc9ab4d77d009b6c9535518e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677086, "uuid": "a2e678d2-cfef-4cdc-a8a1-8b66eeaec745", "value": "T15144C0C5A791ECDBD92503790DE68364233DF2806BC74B033AB59A360E73B646FD5688", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677086, "uuid": "80c8cf06-9742-4cc8-a3e0-b9c16c8491d3", "value": "963f2e88a5b03877d0583808b2526c1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677086, "uuid": "390eb282-c16b-45f2-98dd-15f9825d2c7e", "value": "6144:M1jyqUcchr3fdAdmG9rjcOLDNffPwz3GzMc5:MgccxfzGBcOxfHQ3GzP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677086, "uuid": "fc38b497-b7dc-4557-9488-73da4711cbe4", "value": 274499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677086, "uuid": "dd45a0db-6c73-4041-97e4-ca3f6a710fa2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677086, "uuid": "26269544-b765-4c74-a151-7d982eed3414", "value": "92f55112ffa6067be59e4bbca0b0b865", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb59b94-e701-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654675597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654675597, "uuid": "573632ce-a724-458c-a752-3dd8c3500334", "comment": "Malware payload (RedLineStealer)", "value": "7c0fa3111d54b3ef107a82e39ac246a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654675597, "uuid": "aa14aa5e-97ee-42fa-809d-6319286d2cf2", "comment": "Malware payload (RedLineStealer)", "value": "82a108c44defd4e43bf5bdee2bbadbf7f62870683557276b698d15845267c722", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654675597, "uuid": "6c18fa34-3b42-49ab-8a48-eb023120ba97", "comment": "Malware payload (RedLineStealer)", "value": "f5fe7bd13c85a0b3b68c04130924b84cfbc1cd8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654675597, "uuid": "8214c6da-b7cf-41b5-a3d5-7ccd9dd5f318", "comment": "Malware payload (RedLineStealer)", "value": "ab093fd1eb8060a9cd3780f12e8088d9e98afef30e1939c1d34869457cd9f19bec2df7c935ee51b502bce307eb3f8630", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654675597, "uuid": "5f7f73d8-f32a-4760-8db4-3a70d3904308", "value": "T1B6448E00F790C035F5B712F449BA93A9B93E7EB19B2450CB92E52AED5635AD4EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654675597, "uuid": "1530d453-d46a-4047-bc98-465e11bb01dc", "value": "3215fae786e72310b15953e12ddd6b57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654675597, "uuid": "a02e3ce7-0489-474a-994b-3665ca9379fc", "value": "6144:0rXIV852b799IMZLbasNCKH+SEdSf9EmEfH4oNVnkBCW2v57+:0r4EpMZLuJKFEdFj/46VnSCWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654675597, "uuid": "2f2b5885-d8cc-4db0-bd69-678b76779dde", "value": 272896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654675597, "uuid": "2439ef04-3ce5-49aa-885d-0e559f79832c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654675597, "uuid": "43348f10-278b-4a04-8e66-cec3aa795ec3", "value": "7c0fa3111d54b3ef107a82e39ac246a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7989040d-e741-11ec-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1654702893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702893, "uuid": "4097a489-2de2-4fa4-992a-d47e58337925", "comment": "Malware payload (AsyncRAT)", "value": "0ff03a181b19c7688023855bb0b9bb77", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702893, "uuid": "b44a4cfe-078d-429f-96b1-9c984e4aff41", "comment": "Malware payload (AsyncRAT)", "value": "82f90e3eca5e34f4364858d3bb515cea65ff2c183f5a56c565ddad1644c3da15", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702893, "uuid": "09401054-0e96-4412-961f-b384bd591542", "comment": "Malware payload (AsyncRAT)", "value": "891dcf3aa7d379f076c349b755902015f88ddab1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702893, "uuid": "200a3ae9-a2e7-4ee5-909c-053234eed294", "comment": "Malware payload (AsyncRAT)", "value": "f7938c6df97f55096c55cdce085fc44887c01bf267ec1fe2fb069d9f37185b01d44a489d2e4668d414072c0efd6e1646", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702893, "uuid": "ad7faee4-ca61-48ee-8eb1-20bda79ff621", "value": "T1D43307D2D54042A4FCB90F31647A6E2446BB7EBABC74F60DA84870636B732D32932D57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702893, "uuid": "0eaa85f4-9924-4a25-b1e7-17e60a886861", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702893, "uuid": "50b57256-7caa-48da-837e-7d94d4a22cfa", "value": "768:5Kfji4dGJfPb+ZocDAtwYwq4EQv3hFsubtW5Mmq2jTAeSPqR1:5Kfji4YfTIFAt1B4nv3Hs2s5lNT7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654702893, "uuid": "9b1b7e9f-f331-437f-b963-54d13b002f91", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654702893, "uuid": "15382194-b280-4d8d-aeed-5c9ed3ec6432", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702893, "uuid": "0d732be8-f899-41db-8eb5-faa1616c2800", "value": "20220706001003001993991.xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db7d40e-e77e-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654728992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728992, "uuid": "74abae60-2b5b-41c1-a808-f906523fba1c", "comment": "Malware payload", "value": "bfeb4999fa75e2a929a3b838265c2e01", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728992, "uuid": "4dc88a40-c96b-497d-aebc-5e92fe0b0eab", "comment": "Malware payload", "value": "834df4de2297661c2f84e9af56a9f10766cd69927d9eb62163e08786243d84aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728992, "uuid": "163d6803-563b-4524-aa15-cf48902ea13e", "comment": "Malware payload", "value": "5d215eacbea80e8aeb8695b48abcfe4840831058", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728992, "uuid": "71460e8c-529c-422c-ad50-7225d87a15f6", "comment": "Malware payload", "value": "4dc9fb4946aefd130818cadc12a32f877d36bda67260726344baac1ba6dc646a61fe066caf6b15d80153bc12080b9d4c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654728992, "uuid": "3a5569cb-4e5d-4902-bade-6a11262ea114", "value": "T107649D11BB90D034F1B712F849B983B8BA3A7AB15B7491CF52D51AED5634AE1EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654728992, "uuid": "f15cbe1f-0cba-4d99-bf94-ed88311f3ef4", "value": "d530938e11b87f5dcaab85f14604822a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654728992, "uuid": "7108be2f-3cb7-41cf-ae05-e941e27dba1a", "value": "6144:L5Dx3zux770ZC+L7SkQq8vMvwmsjYPmzzzki1x7bWMIGWPuvmDWlGAZD:L55M0ZjfSkQjvl/Wmzzzke1bxI5PuvAa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654728992, "uuid": "0528dd37-35f1-4996-85bb-e8fcbbbaef6c", "value": 327168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654728992, "uuid": "a384d47c-e7bd-49b4-860a-8eed64c43620", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654728992, "uuid": "d0893016-6449-4ade-be64-21420546c7ca", "value": "bfeb4999fa75e2a929a3b838265c2e01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d90739ec-e705-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654677284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677284, "uuid": "bb01da07-0bfa-49f1-bf8d-0b6a32e9371d", "comment": "Malware payload", "value": "2f0a9db840f43c4c151e5d53980b624a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677284, "uuid": "de18ac51-43c3-41b4-9cc7-2d3592e7373c", "comment": "Malware payload", "value": "83965271c1abe9c5cc6cbd53237b6ef91e19d0494a2350531d34ff2eec6dba9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677284, "uuid": "3932fafa-17c1-4c88-bb39-b3b292ac702b", "comment": "Malware payload", "value": "2f4e00ee432f3d845df5601a3eeedaeb3eea4a61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677284, "uuid": "0ac7dc19-944a-4c18-ab14-4b478e9e6f5f", "comment": "Malware payload", "value": "8d745286ccb6e2bc8c953e7be32d89e38bcbc053db824fbd2660c68377d79a3a4f7d64aab6517c14641e0fd076b3737d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677284, "uuid": "4720708b-e9e2-4dd5-a03a-105e646f4d17", "value": "T13F52D93917A4C874D9F58936889B4AF00634FA174892FBEE32C06D1F6E23BC5CB52275", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677284, "uuid": "ef860f80-a99b-421e-af22-19639c6813fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677284, "uuid": "5c9fdad6-f20e-4880-a48b-26b1a341c4c6", "value": "192:wh/4CTkhvDfwa5dSY2sj4lyQGQKDkdCB28KDW0LO09yM:C4CYhvDddSY2NWQKDCC08KDW0LOUy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677284, "uuid": "c36cd842-9edb-4a28-b8b7-912f2fa45c75", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677284, "uuid": "c194d2ac-fe9e-4b85-8c85-4846ad205f0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677284, "uuid": "b8b4551a-d89c-4239-a8b3-63c3300d90c7", "value": "12220173387_20220606_13363111_HesapOzeti.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51cb1348-e6fd-11ec-93bb-42010a9c0043", "comment": "Malware payload (NetWire)", "timestamp": 1654673621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673621, "uuid": "664f26e1-1af1-4f74-a946-a3346c65f10c", "comment": "Malware payload (NetWire)", "value": "25e4d205e066d55b04365064fe27848b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673621, "uuid": "8c3f54f3-a1b7-4c1e-b7e9-b11e244e2f99", "comment": "Malware payload (NetWire)", "value": "8397c04c6cebbfcb4ffbc18722a72e8485626304db1fb5c83875e1d64b873a23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673621, "uuid": "a5d001cd-97b5-4261-87c3-5109af4c20a7", "comment": "Malware payload (NetWire)", "value": "0a95c7154721684d1cb23432fc93387d0e9001c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673621, "uuid": "2522a4cf-9056-4279-9ee3-0807b7a89951", "comment": "Malware payload (NetWire)", "value": "28e82f4b660b122cc321371c59e9d81efd8af7276c87c531209f4b168ab000e1b6e470271a883e2daadf09fe160e1d9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673621, "uuid": "96d33db4-1068-422a-9baf-95bbd9b61ab4", "value": "T1AED412293AEC4B72C6BD47FA946404008771B726091BE30D5F4422DF6EA7F91CA63B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673621, "uuid": "ecf84abd-eb1b-4b10-8a8a-66066ac0f690", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673621, "uuid": "83e91216-9373-4906-aa4b-72bbcf54854f", "value": "12288:tbllintmC6Xsj2LB6lNdQU8H+ZEqaWaxkATSJBN1eCJfbo9q:rgnhugLuoYWaxINdfbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654673621, "uuid": "d3d318cf-7a2c-4e20-a86a-3e44ba6297ee", "value": 623104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654673621, "uuid": "9f5e1163-4239-46d3-b4bb-c93a9ff7c3d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673621, "uuid": "acc093cc-ceb3-47eb-8e07-6864207ff1a4", "value": "SecuriteInfo.com.W32.AIDetectNet.01.8641.19617", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7439f74f-e72d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654694295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654694295, "uuid": "571688c8-18c1-46c0-b7c6-bdf7ee30c977", "comment": "Malware payload (Heodo)", "value": "f90baf254dcc36f3a5c9b34f6ae9aab8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654694295, "uuid": "57b2e1ab-cc6d-402e-81cc-32d22e19397e", "comment": "Malware payload (Heodo)", "value": "83b3e9dc67a11a8fee58393914b40f19c516297e765226e96c51bd374f9a1454", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654694295, "uuid": "0bf73893-5631-45e2-bebc-764228376dc3", "comment": "Malware payload (Heodo)", "value": "7044be65ae651d643de5417e6fd3051da09b45a5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654694295, "uuid": "f041ab35-cd2f-482b-9912-bd988a1434dc", "comment": "Malware payload (Heodo)", "value": "b3d695ac960ed074930b05108c0cf5c521f9ad5804a50a873c96ac6940868f9e16f2a7be1402e4db504b479c1bd2e914", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654694295, "uuid": "e4372048-78eb-4476-b92d-a4c00e67cb54", "value": "T18F44C089ABE1ADDBD51407798DD6D324333EF2814B8387076B2598390F23BA4BFC5A45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654694295, "uuid": "1185d2f7-dd4a-441b-b674-321307b22057", "value": "963f2e88a5b03877d0583808b2526c1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654694295, "uuid": "f8baf1c6-5521-4b8a-a512-2945ea2ee612", "value": "3072:7R7he82w+Oh+UjuFJrfr7CS/FmikytkqroMdjaWtHCqPZ4PEx2ES2vZg3f4L5ZJi:7lMJuk4uFxOmFwytLVxDtfPZ4PE2sPs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654694295, "uuid": "68388426-eff8-43df-afd7-199168c327be", "value": 270403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654694295, "uuid": "b8c73a2e-b09e-4dec-812b-1ed72e783058", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654694295, "uuid": "c37edf64-14b9-4fd8-b102-85208a52f995", "value": "f90baf254dcc36f3a5c9b34f6ae9aab8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482ea8ac-e714-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654683483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654683483, "uuid": "986b9212-3f34-44c0-8e0e-7c4f4e1ba465", "comment": "Malware payload (Heodo)", "value": "2d96b18cd57772e294ad4a5802a4ca6d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654683483, "uuid": "a63e3216-42d0-4ccf-ba8c-526b19e94396", "comment": "Malware payload (Heodo)", "value": "846cac85484e7235081f613ded5e7943b18e7e17fafc20e4a6927c0f70b0d1d4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654683483, "uuid": "6427bb6e-7529-4608-9d1b-13aa67bdd943", "comment": "Malware payload (Heodo)", "value": "845a17f09612dd15d162979148899ddf0bd30211", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654683483, "uuid": "f7c2f8e2-bd4f-4572-8003-5d550bd8f765", "comment": "Malware payload (Heodo)", "value": "3809cb06ef3642404f9075a2bc92c861c79e1c463e90fdaf4afd6bb2bf2d0dfc92868cc47c20aea3ffcc97bc14e0efcf", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654683483, "uuid": "a34fc158-a126-452f-980e-54607d0a5ce7", "value": "T16F44C0C5A791ECDBD92503790DE68364233DF2806BC74B033AB59A360E73B646FD5688", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654683483, "uuid": "50f774b9-8c9d-46f7-8560-0e9eaa86c580", "value": "963f2e88a5b03877d0583808b2526c1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654683483, "uuid": "c676d759-22f5-4fbf-af32-eb16086f5811", "value": "6144:M1GyqUcchr3fdAdmG9rjcOLDNffPwz3GzMc5:MvccxfzGBcOxfHQ3GzP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654683483, "uuid": "d9c87700-2fbb-4c20-a244-580192fb3edb", "value": 274499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654683483, "uuid": "0a4c3bd1-737e-4257-a4f5-0eb1bc55e519", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654683483, "uuid": "d79e8748-216f-4bcf-bed2-d36767d76cce", "value": "2d96b18cd57772e294ad4a5802a4ca6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f7918b5-e74b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654707091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654707091, "uuid": "612558db-7f18-4ec5-8e30-e5e090fd3379", "comment": "Malware payload (Formbook)", "value": "c2fc26c96f6ae046865a5bbbbda31d2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654707091, "uuid": "b5d3e889-b733-4727-b6a2-1c492a89681d", "comment": "Malware payload (Formbook)", "value": "862f0f7c4ff77ae7d33ec905cba93167681c7919b182217b849fb1fe08205e17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654707091, "uuid": "6a342716-83bf-4a57-b0b5-ba2d3f3dc7b7", "comment": "Malware payload (Formbook)", "value": "df734e9c08acffd305bcf342600c8d716965939f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654707091, "uuid": "4ef7620d-7a09-4c32-bec2-6a23d4136fc8", "comment": "Malware payload (Formbook)", "value": "e14d2bc97f0770b92d02ae3ca564f9b0a9dae0f3c6b1712b3a5dfd47782e18d0b0bcaff4b7e90c06adf0261843edd35a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654707091, "uuid": "388ada6a-8e39-4e03-8a74-c03951ac9d76", "value": "T1F9C4D7382EEA1129F177AF7C89E03596DB6EB663770B9A0D14A102CA0713B41DDD163F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654707091, "uuid": "303c410c-1bcf-45a4-baba-5fa5d71697cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654707091, "uuid": "259dae60-951a-4d95-a0a6-65789828ba3f", "value": "12288:3yFpBDX1sJbdTpmzh3qSS6D1C1bcuJVQB:3CpNXMlm1HB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654707091, "uuid": "099bbfd4-a8a5-4060-b363-8da8ec7ee286", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654707091, "uuid": "acf3ddd1-fd78-4e64-836c-a8f6a5240572", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654707091, "uuid": "408cba95-add5-4901-919e-d67680f3f20a", "value": "c2fc26c96f6ae046865a5bbbbda31d2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d05033a-e768-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654719650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719650, "uuid": "8c35a5b7-5a85-48c2-ba77-fa9204d354bd", "comment": "Malware payload (Mirai)", "value": "afbb2c9ee62d2bd99ffa7c0b3e1d2453", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719650, "uuid": "5ab1732b-c600-426c-b9ec-53bac154587c", "comment": "Malware payload (Mirai)", "value": "8723fd7db8b4d824901a1788194e89ad97a553f3a6d4e44ca6f99828fc2bdd1a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719650, "uuid": "7a27289c-f0d3-42aa-a3ed-2eddc3a1d30a", "comment": "Malware payload (Mirai)", "value": "97fe3fcb4edfb0a17362ee5258bad67457b248c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719650, "uuid": "531ff8c4-bc03-4b7a-b1cf-ccdc343f61c7", "comment": "Malware payload (Mirai)", "value": "55325f4c2381d7a99e5c99ae574c6165ae5415ce9da758083772558ffa3ef220704e5836bca411e63d491882ff817b26", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654719650, "uuid": "b8e193fb-3ee0-4dce-a2a4-c3c898d4ee72", "value": "T183338C7685A89E98C62085B4B516CE385722F004866B3EFBD784C791E00BEFCF1987F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654719650, "uuid": "5fb4bcac-e0ff-4086-ada9-1ca54442909c", "value": "768:7aTaAejehjeywvmO1KN1ddFuqMUbzofs3I+qn8vG19CMQodWzIkCvb:7a/akjFwvS3FuqMoofs3vqnW83djkCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654719650, "uuid": "97e1fb65-d3dc-4777-9c18-e1acfa513297", "value": 52712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654719650, "uuid": "ca86624f-aad3-42d6-af9d-314dba3e9722", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654719650, "uuid": "d2d9b42a-a114-4a5b-af32-0fb1e09d677d", "value": "afbb2c9ee62d2bd99ffa7c0b3e1d2453", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70fa14d2-e768-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654719629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719629, "uuid": "a11cdf36-7ac3-476e-b1c6-2f9b5b1b205c", "comment": "Malware payload (Mirai)", "value": "8b531aebc63ee7d3db947a017c5d0cad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719629, "uuid": "c694b708-7014-4dda-b516-604b2fba4e94", "comment": "Malware payload (Mirai)", "value": "881d992f3dbdc60b65936d145bcf1434335756a96ecefa3696d78d2fdbc218ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719629, "uuid": "8fbb2b5a-048f-4d14-af83-fd1997937ec1", "comment": "Malware payload (Mirai)", "value": "fdc81d24853f05256e6a5fca8188a096ab52da5a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719629, "uuid": "96e33933-ddf8-4fbc-b9c3-91cd16ded9be", "comment": "Malware payload (Mirai)", "value": "21c2ebf6ad6afbcdd497f358cd2e0e39720851a6a01430207eeb29a67309f346187914e94118450d221b9a5e24763a46", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654719629, "uuid": "dc41b160-579e-434b-8faf-fbf191e03114", "value": "T111B2D0B1E5145EABDF7AA8B369DAB7D5B3970E060702CE32B192FF502101636BB409D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654719629, "uuid": "ce3fdab0-e965-4108-a605-a26b7e5f3bdd", "value": "384:moPgX5g1IsZuoBl8XUlqvdKRiHVdB0CBYRJ8hDE1rWEXSnfu3fc10jjjqM4uVcqS:msgPsh4XLveiR0CeaDE1rWjm3f+ujN4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654719629, "uuid": "0836b3c4-68e4-43fb-ab04-a5e1a938fde8", "value": 23488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654719629, "uuid": "ee18f239-56ac-422a-b871-37d0984fb18c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654719629, "uuid": "14deb02d-eac2-448a-93e0-e62aba83f8b0", "value": "8b531aebc63ee7d3db947a017c5d0cad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "477e3c36-e73a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654699803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699803, "uuid": "da50d4db-bd85-4ddd-ad0f-623f1dd5ca94", "comment": "Malware payload (Mirai)", "value": "789c66039106f3e277a0906dcd3f0602", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699803, "uuid": "3ef74dd6-3616-49af-8d03-c4fc40a93f06", "comment": "Malware payload (Mirai)", "value": "8846e29f473d62976bd1241c7ae4f77cdf664adc3866dc26ddd705a9e46459b8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699803, "uuid": "27bb6bc7-168f-4796-817a-e797259d6d72", "comment": "Malware payload (Mirai)", "value": "6da7b699120d5a2e114b6fd87cad17bd3b26cfab", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699803, "uuid": "cf3e8ee7-dfcb-47f9-b69b-88fe312fdf72", "comment": "Malware payload (Mirai)", "value": "2686953a90fc82eb7d7b55da9fff0a6e2c98867dc81f261d194b2ea0feda2012892d293de7c275cb1c157a502a60b2e2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699803, "uuid": "f68576ec-111e-4d36-a455-895bc2a0e464", "value": "T144230236051A9E31F5735871CB7492D364CA8BE88C2D22607AE9017CDDE69550BFCDCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699803, "uuid": "57f80fd3-5833-4b9a-8a06-7414ee28df23", "value": "768:QhlEeac2nAR3tcQp5x8Q6thxSwhY59q3UELnQpDLkJcQMfU3zFKSey1B:QbEeonAt+Qjx8Q6xSVsLnYLci83Zpeyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654699803, "uuid": "9a163b25-62e4-4efd-9208-1fca126f9798", "value": 48376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654699803, "uuid": "ffc505c6-1144-4aa8-99f4-a9b8a8e97127", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699803, "uuid": "db989a5f-ce38-4a7f-976c-9c8b1b306df2", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c7cec5b-e739-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654699328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699328, "uuid": "0bfb69ce-177c-4032-8429-a214fb0276a1", "comment": "Malware payload (RedLineStealer)", "value": "b87afa51e71bf7d11b5a1e1a76f1c048", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699328, "uuid": "45669a91-3a84-46bb-8e52-d2c72c65ee66", "comment": "Malware payload (RedLineStealer)", "value": "889e9ff72f2a5648700e7c62ff9d9feb1330e13bba18c52b88c129e6a06ffc9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699328, "uuid": "62686455-cd97-44a5-b03f-4230f25038bc", "comment": "Malware payload (RedLineStealer)", "value": "b37153d44407fd77675420b547fdcda547886373", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699328, "uuid": "53ff139e-01f9-4850-b61d-d54cda1840b0", "comment": "Malware payload (RedLineStealer)", "value": "2e55196905bfd4787812b6275706027f60ba2a07877f8dcfa39a89a663e4f0e291469cbcbc26e08ca0743a1c778eab20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699328, "uuid": "cb38be6b-cfc5-4588-9a20-929b9a7e8fac", "value": "T1B874CF017592C031E53214304DF5DAFBAE3FE8100E315DEF6B941B6B4E32392EAB5A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699328, "uuid": "9d025962-b89b-4dd8-863a-2890c5f35ed1", "value": "55be0c93c66ed8138f777cda7ce3ebbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699328, "uuid": "b3dab81e-78bc-4b0f-8ed0-f1d4b5ab7aa0", "value": "6144:liIZ9kphT7BI9Hvh6Zejk7ixsZr2AOg/veAoGzlFULaOkuVPDhua+5pU5Shf:lLMphT7BI9UxScpDuVb4e5SZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654699328, "uuid": "85e163f6-2261-48eb-b937-8897e6afa2f3", "value": 346056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654699328, "uuid": "4263ec7e-182a-4839-a0e4-8be7e1f277d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699328, "uuid": "ed288a56-2e44-4b32-91a9-f15523e108bb", "value": "b87afa51e71bf7d11b5a1e1a76f1c048.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d47f5322-e74c-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1654707771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654707771, "uuid": "a69efffe-1bc6-484a-b67c-5a429fc3400a", "comment": "Malware payload (GuLoader)", "value": "5d1d02ff55bba04bb268e7df643758cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654707771, "uuid": "dc931e6a-a977-427e-8bfe-eeee0078345f", "comment": "Malware payload (GuLoader)", "value": "89b571cbda125914c68b4415a52ac57b703ee69adb07cae9cceea71799ff4dc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654707771, "uuid": "aa7ec77d-5adf-4781-9d27-07a249c3ea38", "comment": "Malware payload (GuLoader)", "value": "cc04ff97b52d040cdbe9b4799151f20f81f6ae2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654707771, "uuid": "f7c31860-eefe-47a9-ba6e-f1f062327076", "comment": "Malware payload (GuLoader)", "value": "2202fba445195fe37619fbfe7e223d642720d6f58ca166e4d2d231f32dcc32ad4cb6123b2c0cf294249fc917f630ca8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654707771, "uuid": "5b05ea91-f7b5-4065-bb28-3b26531292da", "value": "T11164F012B944A067C93E8B30C4B7DAB107F2AD516A9D1F1F37807B183DB31D39A1E666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654707771, "uuid": "94b3bda4-06e0-4d0f-959a-d23938bf9b4d", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654707771, "uuid": "864252a8-8983-447d-b2e6-17337cbd6bc4", "value": "6144:rbE/HUyscQZVfFt4jPvLvvHn73egGjon4u4zDjdpKC:rbe1QJmjHrvbwjo4u4zDjfKC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654707771, "uuid": "ef19a761-1cbb-4d26-bc97-327f1da95e17", "value": 317401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654707771, "uuid": "a55604f7-0d52-4f12-a44a-4fc353b6adbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654707771, "uuid": "5150d62e-1505-4016-a9fc-fec2dbd79065", "value": "Factura Pago Detalle de Transferencia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "944b8ca8-e732-11ec-93bb-42010a9c0043", "comment": "Malware payload (OskiStealer)", "timestamp": 1654696496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696496, "uuid": "a76b35ca-505a-4ea6-b48f-1e97b948fcf8", "comment": "Malware payload (OskiStealer)", "value": "197043d984533ac65f82611414d32792", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696496, "uuid": "4afcb655-1ef5-4d7f-b912-64912dc6d887", "comment": "Malware payload (OskiStealer)", "value": "89ec309c384717284199d66d01669738ce37d9fb445a8f7f2259dfd6ca888f5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696496, "uuid": "9b961cd3-fb61-46b8-bc58-96dccbd8cc6c", "comment": "Malware payload (OskiStealer)", "value": "799b97ec3adc652ff5cf89df6852e6c535e833d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696496, "uuid": "af7561e8-b070-44cf-8b93-0d7c9665a416", "comment": "Malware payload (OskiStealer)", "value": "c7cd553228976d4718349fea85e0effcd416017d7137c2cb914d73c44a18c9e77925a977adf1b898678d79f6456208f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654696496, "uuid": "301dda32-d32c-43d1-8f9d-f30d83fed36d", "value": "T1ED53D652BB448A85EA3B1B78442ADF900536AFBA7835D54944B47C633B33EC70C99CDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654696496, "uuid": "a093813d-c85b-42c1-803f-a0f9c8ae4803", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654696496, "uuid": "656ba122-2a20-4be8-8847-999a1bf60ad4", "value": "768:pV3Vji/1uFIZMYIIIIIIXllllllWvfIIQIWR1gRkg8Zg0kNK2Rpg3tNp1tnZDg/5:TNCzHgeGUvDgF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654696496, "uuid": "68a3e857-e0d3-4462-ac62-c66a53c47231", "value": 66560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654696496, "uuid": "500e0c61-0933-4dd7-a775-bb150e8d4d18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654696496, "uuid": "5af85d98-81a7-4a91-ac36-75b218e9adaf", "value": "invoice for payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf5e138-e6db-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654659091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659091, "uuid": "a8bd70e6-f4d8-442e-8b7f-6704ed924f09", "comment": "Malware payload (Heodo)", "value": "aba078857af02b9456470dcbb0840b2a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659091, "uuid": "4b5d33ac-5e33-47d0-a566-2d0ab7d2b37a", "comment": "Malware payload (Heodo)", "value": "8a111e72584d924bd9d39949419b416c0999a4b8e87bbed2bb4341140d043e69", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659091, "uuid": "796e48bc-7c15-4054-bf5d-1c582d1addc6", "comment": "Malware payload (Heodo)", "value": "1858f14a4fa36eb0ed7fd12d201861d60c1eba84", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659091, "uuid": "96f5e711-059b-43f1-ba61-1dac2fe262c0", "comment": "Malware payload (Heodo)", "value": "b570948b7bd7726c7b8cd9f75c58a3c9df7b5ce9f15e9f13e0b616408928fe8cf23419cac76be023a0423adcbfb02d11", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654659091, "uuid": "a5dcff07-9dcc-4607-ab22-4e3604f3f6ea", "value": "T1CB04023EE5031A98C22ED8FC58EE6DF9D5F634006268063A1BA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654659091, "uuid": "def1db6a-cb1e-479e-a7c0-d07655807e2c", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654659091, "uuid": "cc24d870-60a1-4bbf-bf15-a603a529084c", "value": "3072:VpjftiFs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VRQi1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654659091, "uuid": "8a0e4ab7-d91e-4645-9b61-1e1ee96984da", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654659091, "uuid": "65cd78ad-2b72-438a-9d47-78c2ec48fe2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654659091, "uuid": "cfcd1f04-5a97-4248-afbe-aa9cb9cb24a0", "value": "aba078857af02b9456470dcbb0840b2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c370cc9-e76c-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654721339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654721339, "uuid": "00c080e6-4c3f-4b2a-a24a-abcd02034719", "comment": "Malware payload (AgentTesla)", "value": "3955b2ce8c555c68542f0ef0ff676198", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654721339, "uuid": "1ee9be3c-9b6f-48b0-8e32-170fbeadfd4a", "comment": "Malware payload (AgentTesla)", "value": "8a75d8646fbae473f8805facad22210852aa3e755db6c0fefb353d800bee2816", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654721339, "uuid": "e3855959-4dc4-444e-9fdb-deee2df855c3", "comment": "Malware payload (AgentTesla)", "value": "bff63c70aafb799bcaf7e157d44d92624041232b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654721339, "uuid": "4206d35d-2ba6-4927-b579-10a64c6fae50", "comment": "Malware payload (AgentTesla)", "value": "58995a5a7bc52db7f22b499e44ea318a6af3ceb2fe7824b0d656b4683c447a4c0197fef5f7266a0ce613a4fa06f0debb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654721339, "uuid": "d618b7f3-e2b9-4d71-aa54-364e72817ce1", "value": "T12B541241D9C1DDB3EA93D13A2C70237AB76BBB717625964B4F846F963C25A4B4E0C2C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654721339, "uuid": "a9ccc6ea-0acb-4c03-95ac-d22f4ca4622c", "value": "dd1742eadfc6df18ded3c26ae64ad610", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654721339, "uuid": "1c100bfb-a1a3-4bbf-9fea-1458bc3e1c15", "value": "6144:FbDDHm7rvrZ18k/SZ7BptvxfujxkLSRmu0r8a/CXWtMOWJm9Rz:Ravv8kqZ9pt5WjxcS50r1LtMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654721339, "uuid": "33c6077a-6ba0-4107-a1b9-50041121ae09", "value": 299254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654721339, "uuid": "4506597d-4821-48a9-8256-65ea460a542a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654721339, "uuid": "15e861a4-d116-493d-916e-b37827391ce1", "value": "707.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eabf32fd-e728-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654692346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692346, "uuid": "d3211d69-8c7e-40b0-a9e4-03ddfd3f0f63", "comment": "Malware payload (Heodo)", "value": "f5a82d119e8e1a17e3d98f67e2fb10d5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692346, "uuid": "ea65d493-eaf3-4c17-a8a6-f48db352501c", "comment": "Malware payload (Heodo)", "value": "8abe8114e9b601519fd15d2c9ecadd96ffdc3f3ac2fb70260cc85a3ca2883944", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692346, "uuid": "417072e4-75ce-41f6-86f1-d8ab9b3dd408", "comment": "Malware payload (Heodo)", "value": "5f9bba80cfc1fee1f166d5d04f52b7fcab176826", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692346, "uuid": "3947687d-4c09-480b-a9c3-fc16542a76b0", "comment": "Malware payload (Heodo)", "value": "6efe8456fd4e675b5d2b8f09bd1cfafaef7bf1b17466b8bb79339bda8dace97cf38f300b0803a32c666718d7cde2b8a2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692346, "uuid": "355815f5-8104-473e-8e16-1cfeae21d89f", "value": "T17B44C089ABE1ADDBD51407798DD6D324333EF2814B8387076B2598390F23BA4BFC5645", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692346, "uuid": "2c60a31e-432c-4c05-a783-a327931a0d40", "value": "963f2e88a5b03877d0583808b2526c1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692346, "uuid": "ac169e0e-20d9-4155-a33e-e5e2ae0eea0d", "value": "3072:7R72e82w+Oh+UjuFJrfr7CS/FmikytkqroMdjaWtHCqPZ4PEx2ES2vZg3f4L5ZJi:7lpJuk4uFxOmFwytLVxDtfPZ4PE2sPs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654692346, "uuid": "922a666b-138a-4bce-b5d7-9958c0fef6a7", "value": 270403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654692346, "uuid": "9b97030a-c633-4f26-b736-03be55af2337", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692346, "uuid": "e38cc7ad-9126-466e-8f40-7bb732c3f87b", "value": "SkEGB2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c07247b-e750-11ec-93bb-42010a9c0043", "comment": "Malware payload (SocGholish)", "timestamp": 1654709206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709206, "uuid": "4af00b25-9814-49cc-99a1-5c1c7481002e", "comment": "Malware payload (SocGholish)", "value": "dac644c91d4c256a9a4576296653d719", "object_relation": "md5", "Tag": [ { "name": "FakeBrowserUpdate", "colour": "#82EC84", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709206, "uuid": "084dc8d7-6c7a-4bea-b81c-65a0841c1074", "comment": "Malware payload (SocGholish)", "value": "8b4a65a117139e8c9a6624e68517edc941b7e0f67980fe5f2a05c8ca79d146fa", "object_relation": "sha256", "Tag": [ { "name": "FakeBrowserUpdate", "colour": "#82EC84", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709206, "uuid": "f7bd1ec2-5ba5-4852-b4c1-16bb38a17434", "comment": "Malware payload (SocGholish)", "value": "274952a33ea20aaa4bd37f21426a331eef4eb444", "object_relation": "sha1", "Tag": [ { "name": "FakeBrowserUpdate", "colour": "#82EC84", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709206, "uuid": "5ca429c8-86e8-4e23-add7-fb3d0470e770", "comment": "Malware payload (SocGholish)", "value": "474ffe6a509eafbde2f06e9d5a86ca13629441f3fbf1a4140f8a9ec24963514fadf8332c7c47a2886ac66f5fbe80bf85", "object_relation": "sha3-384", "Tag": [ { "name": "FakeBrowserUpdate", "colour": "#82EC84", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "socgholish", "colour": "#4A4C7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709206, "uuid": "748e29b9-f6a3-49c3-b788-1c2bd5298138", "value": "T18231DBD935CB610DA7C63394943A5858ECBDDCB2A284C47DB440C1A4FDB051B16EEAFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709206, "uuid": "71ea1a91-842f-472b-8363-a63d2824cc6a", "value": "24:1rtOCmzXhW5b+dG7sqzKOxlUSf+vUZq7tQtZ+hOYCyaSi9LeJrxNmTKXrPg:1oCmzXhc2Qx+L7tK+YQaSiRytNmTKXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654709206, "uuid": "cda569cd-e9fb-4675-a20d-a19d1bc13470", "value": 1873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654709206, "uuid": "dfadef20-8d37-4357-acf5-1f6656149803", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709206, "uuid": "9e31070c-36e3-4a4a-955f-a368f158a797", "value": "Chrome.Quick.Update.ver.103.94.65594.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf2ed042-e75b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654714204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714204, "uuid": "d55c602e-1d82-4133-ab4a-0e995ea14c59", "comment": "Malware payload (Mirai)", "value": "370bf7df1c730bb282ab93b2c98bf0e0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714204, "uuid": "3805d418-58af-48f9-8469-4048019308a9", "comment": "Malware payload (Mirai)", "value": "8bd3e58437aa3f55f4e232a8451b40561b1c6a65fd2dbb643c82ae255ccd99d3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714204, "uuid": "67916c95-520b-42a3-b3c1-c7196bb50373", "comment": "Malware payload (Mirai)", "value": "1cf20b44abcbc19cbe0de0d364663b0ce6fc0e9d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714204, "uuid": "d6c0878c-5a50-4dc1-ab20-2f52067f45cd", "comment": "Malware payload (Mirai)", "value": "086047bd066e0da657807c2b305ea8c22cafc0030fbbe6503c184b04277faa9f7c5767533806bbce5ae86cf7c6f920b5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654714204, "uuid": "f175be98-8676-458f-8f09-59638018791f", "value": "T135735CC4F987E4F5EC12467A206BBB378E37F5769039EA6BD78869239811641C20739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654714204, "uuid": "c7828a76-2814-459f-83bf-1d244d837e03", "value": "1536:EE6Djx9ZYalJBvUWVuiit2VBzVDd18LD9z0IN4mnBaRaLPtKS69mxxxxxxxxxxxz:16Djx9aalJxUWAi82zzVB18RzYmBacDL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654714204, "uuid": "3acc1b83-fc72-4eee-b78b-ba719a31664b", "value": 80052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654714204, "uuid": "02a7f53a-551a-4852-9c3b-f4403d9a4ea1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654714204, "uuid": "396ebc0f-3e16-4965-871c-addaf64519a0", "value": "gx86-20220608-1850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "427286b0-e6d7-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654657274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657274, "uuid": "d0623c7f-5c30-4d62-9d78-6286e3fbacd8", "comment": "Malware payload (RedLineStealer)", "value": "02c78a1f2a18c9c341ee697616bac107", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657274, "uuid": "56e31d67-2024-4bc6-b17b-acd9b725d742", "comment": "Malware payload (RedLineStealer)", "value": "8c3cbfc840d46b4f3883f676504d6ffc11e9fca908e0b02a5b7471862a169afc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657274, "uuid": "5b44d40a-2a33-4745-a2b8-89669bc3b680", "comment": "Malware payload (RedLineStealer)", "value": "fc4ed86fef67c178a3d3229ee63ed52e4129fdec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657274, "uuid": "c38223dc-a96c-4d2f-b694-b8ccd2af22ba", "comment": "Malware payload (RedLineStealer)", "value": "e84f9672bf9e929f37859d9e6a22c73497927e8f3f1a5799aa0b473cd8592c2a1fc4fe7d4266b32f87a822b05cfc2fb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657274, "uuid": "deaefced-1174-4dbe-86cf-ba5599106c8c", "value": "T1E7B509036A8B0E75DDC23BB4A1CF533A9734EE30CA269B7FF609C53599532C5681A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657274, "uuid": "fc7bb8eb-2345-484d-a89a-70603f76e6d8", "value": "d0dfe559e003c7370c899d20dea7dea8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657274, "uuid": "a27c3900-a9dd-43f2-a69c-6998c663ea00", "value": "24576:KofQL0YjKOTrGL3Ld91pw8CA3DuQOjuVYia9RQgJLYpWW2+N3uQ5V3h35D:KofQL0YjKOTrG/DcUBOjuV8HJLpY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654657274, "uuid": "b92e36aa-b7f3-4865-86ee-cdff544beebd", "value": 2344398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654657274, "uuid": "cb727e68-3be2-4fc6-bb0e-d97f22514bea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657274, "uuid": "4bfbeb0d-647c-495f-891f-6d6b6ce947da", "value": "02c78a1f2a18c9c341ee697616bac107.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "834eb3c8-e768-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654719660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719660, "uuid": "b70a01cd-9467-4105-8868-38419d21c03a", "comment": "Malware payload (Mirai)", "value": "ad3aa0a8180d2b22a5dff24f3e922d07", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719660, "uuid": "719840fd-69e0-4bbb-bb52-8a714f16ac26", "comment": "Malware payload (Mirai)", "value": "8c8f5152946aaae828da6ea0e2e08245664462f3245d93a39c1b7d7e8677970a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719660, "uuid": "b4605dc0-6f38-4c1c-a212-9292907c7a04", "comment": "Malware payload (Mirai)", "value": "c3e4386e0c930f7d6527980fa2c28fe5d05572aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719660, "uuid": "db765c0d-be5f-4b3c-8c2c-b09d7ba24a99", "comment": "Malware payload (Mirai)", "value": "8a5c9dd7b75f77707e0173e3b30c4d2d66b2599013b491ad5842adbc27cc87443c09850efd1b5c2055d086248b050e75", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654719660, "uuid": "d94997d9-baa5-4352-8a12-0dbd80cb7b48", "value": "T164B2E0BC3E8114F4F960A8F918950B542E364FA59223BCAB294DFEC38D82D7538132E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654719660, "uuid": "eb1a6bd5-43ba-4443-bbd6-a4358f106c2c", "value": "768:1v8mJxLiW1ejobWeRDmfEojy98JgGlzDpbuR1Jrj:1v3FF1QobJgZhVJuB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654719660, "uuid": "5a46b2fd-cc74-43df-90cf-d04df1df9cea", "value": 25420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654719660, "uuid": "9baeb948-dcf7-4eec-8fe2-6f58fe1ea6ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654719660, "uuid": "66ff1bbc-7f70-4b73-86dd-f439c8945878", "value": "ad3aa0a8180d2b22a5dff24f3e922d07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "991a8c47-e76f-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654722703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722703, "uuid": "1e33f5c1-582d-48ef-8bbb-4e77d9b4efb6", "comment": "Malware payload (RedLineStealer)", "value": "86902fa6fb73aad68e04e2fd83efa49d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722703, "uuid": "be83f1f9-e284-4d85-a195-0f84c1f1897d", "comment": "Malware payload (RedLineStealer)", "value": "8d119118603a53029f45ad6d363a82ff66d1618dbed205a70ae96976e5eff6db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722703, "uuid": "bfaab380-1e5f-4480-8d55-1d0e6943a315", "comment": "Malware payload (RedLineStealer)", "value": "b296fd8ca4e75d9fa493023481292034aae3f072", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722703, "uuid": "29b61fde-43c1-4174-8748-dee7a0b649be", "comment": "Malware payload (RedLineStealer)", "value": "d24eb70ddd92efb5001756a3996d0ae3894c23766ab76db2d37b09864a5162c25d01a11a670f0a5f6bba026ae258c784", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722703, "uuid": "e0712523-1873-47ad-85aa-ea1de779f733", "value": "T10D74D73F3A2D1AB2ED0DF1B886018B0ABB63BB037280999757CB35C8874E5665D75CC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722703, "uuid": "a3af3925-c68b-40a8-8eb5-05603795bad1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722703, "uuid": "3b7f33c8-106b-408d-af51-da8eaa15e2d5", "value": "6144:Ny5objnnaLNTvYj9GO1hqQmIloMORR24+kzZ6I66+YMCAL:Ny5oHnnaLOjg9lj2TYMCAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654722703, "uuid": "0457cfc2-5a5b-45b3-bc7a-36e7f4b2841a", "value": 358400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654722703, "uuid": "9783e7d6-3c4c-4df4-af33-06ffb0784e71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722703, "uuid": "d1208b05-76fe-47c1-ba0f-8bbd4f620ac6", "value": "8d119118603a53029f45ad6d363a82ff66d1618dbed20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7375c5c-e73a-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654700044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700044, "uuid": "c8b47492-748b-42e2-9323-da1425f2a2bc", "comment": "Malware payload (AgentTesla)", "value": "3b88fad4833387097746731328746363", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700044, "uuid": "8642247a-23bd-4aef-9c47-661de8a302af", "comment": "Malware payload (AgentTesla)", "value": "8d75529a8c51cb0ba57f63afe69cfbb3af95c5087946ad4de20634c86a5abf3c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700044, "uuid": "b55b38a3-3bcb-4205-9762-4f8f5bb003ae", "comment": "Malware payload (AgentTesla)", "value": "4bde8f848ff800fa54b10f1bc785824e63a9d8b5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700044, "uuid": "1b1b5fc5-96f6-402f-8ad0-ab1d317cdbca", "comment": "Malware payload (AgentTesla)", "value": "a2845a8329f6cd2e42635f948cb4f7d2beef2cbb35a956daa6e2fa761a95b5fa788bf292b2f8e0485e6cd483b8edf598", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700044, "uuid": "3944039d-e604-44e5-9d9e-dec2733cc07f", "value": "T16805D003A5B7CE72E6D50777C0C68110D7B7958AE1D7E30B378812E9AA477EEC982247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700044, "uuid": "edb18d77-2ca0-405b-adae-10addcecdcaf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700044, "uuid": "fa4760e5-e2ab-4f90-88a3-ca4724686047", "value": "12288:E0e/vMu/hc9qmxrR08P+vMhpfCzF4Isk5xoGXBD57SqaxP+bgnEt5dD0MUH:i/hclxrRx+vYfCzaMZz7SZxPO+43u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654700044, "uuid": "9c166a83-5e12-40e7-976c-d1eee99d9025", "value": 820736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654700044, "uuid": "bb577f3a-8cce-4ee0-b111-413d11cd64b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700044, "uuid": "7dd0dd7f-e6aa-4e52-8786-c754a9d4f2cf", "value": "daz94JmJvuHJjXT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c4144c8-e77e-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654728963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728963, "uuid": "eb37bdbc-4ff9-48b1-a72d-f24a80107dc0", "comment": "Malware payload", "value": "6aa69f960e4e77310a40063688ff5ba1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728963, "uuid": "ae7824b5-4c53-4994-8203-48db12aadf65", "comment": "Malware payload", "value": "8e0c0ad384c5382541b6c2e3780c8204db5dee5b69f6474c5b7f8e53cb0bd2e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728963, "uuid": "451ebc74-3aef-41a2-b8d6-6566f569589a", "comment": "Malware payload", "value": "0b3a91a9923e7ac03c98e9fbdae5774da38cb34b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728963, "uuid": "b3895858-b372-47c6-b52f-dfed91e51db6", "comment": "Malware payload", "value": "14967e1a1bd9d9a02099974b1c0b2329fb0fcedee893a37bfab3c333bd14b7ba83ddfc177ef3e13c2c2bcdfa60e8ce12", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654728963, "uuid": "ed0d8cce-8117-40f1-adfa-8f95d015cb00", "value": "T192E2B017F3E84A26E9750BB02EB313414FB478538C12D7AFA981950ABD333A109A67F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654728963, "uuid": "67ebde90-5f99-4cea-9cbd-40748dbc200b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654728963, "uuid": "f76113e8-bd34-408e-88be-16a1576de9d1", "value": "768:JJj64b9g9Nf7oSFYwQTXvLWRgcL0ST8iNxy2N:H24b9gf97gWRgcL9HNxvN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654728963, "uuid": "0b9a31a3-9492-48d2-a299-8899c4f2d96b", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654728963, "uuid": "4d660e47-0e1b-4417-952d-54b72c3ab139", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654728963, "uuid": "f8bdc905-12f7-49ba-b5c4-062451fda247", "value": "6aa69f960e4e77310a40063688ff5ba1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd98acde-e6d6-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654657159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657159, "uuid": "81194c21-c7c5-428d-a09f-94b2140331ea", "comment": "Malware payload (Heodo)", "value": "d24332f30a0dc508f4f01ad2bd7caa9b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657159, "uuid": "3029d12b-76bf-4ba3-98f9-85e31c710869", "comment": "Malware payload (Heodo)", "value": "8fe093024e464779c4dfcc9d2f01a48bb9094eb05029282e5cebc890fcf024c1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657159, "uuid": "54003da1-2f99-4737-a595-f8095e210a2f", "comment": "Malware payload (Heodo)", "value": "141e1df6947b07861cb5a5bed24379dc539d4389", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657159, "uuid": "fd385b6d-3de5-4535-a67a-a518029f2c86", "comment": "Malware payload (Heodo)", "value": "a7460174ba3a1fcef44e4fb363e391a0915bcea585b598c333f386c7a3cb404ac50b34170650aa61bae52b82a41fee40", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657159, "uuid": "41ac5e9d-0681-47c4-9230-39fcd4a6d6a7", "value": "T1CC04023EE5031A98C22ED8FC58EE6DF9D5F634006258063A1BA77E7C1D71661C11BCAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657159, "uuid": "aecf18b4-5085-4f8e-9fee-a4718a005a9f", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657159, "uuid": "ff6d621d-a593-4cdf-8f6c-9b9e8317d030", "value": "3072:VpjftnFs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VRxi1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654657159, "uuid": "fc2dea73-14f5-4a21-ac12-2b12beee88b7", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654657159, "uuid": "fff5dc4d-2a7a-4bc1-b526-8c3e0d4befc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657159, "uuid": "42994af7-c18c-497c-8de8-6463b6e27fbd", "value": "d24332f30a0dc508f4f01ad2bd7caa9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "406cc92d-e728-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654692060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692060, "uuid": "1552d166-e263-42c8-95eb-87b0eaa06ca0", "comment": "Malware payload", "value": "8ad08b672f7eec333de5345336ab12c9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692060, "uuid": "565823d0-c4d3-4168-b801-d0ffeac1d42f", "comment": "Malware payload", "value": "908ffea6d1679c016f1fb29ae754f49da1faf04fd25b52134cf91bd691600777", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692060, "uuid": "f4e9cfce-1ed2-4031-bbc2-b039e85c59fc", "comment": "Malware payload", "value": "f483004826ffa7827375ac1a90aaf94f66299eb4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692060, "uuid": "4dc8cebf-f86b-49b2-a9ff-c0a80fff0000", "comment": "Malware payload", "value": "69c68b61d6e3353eeb2a79861b3480223e683236f688cce5efcb623e271df6d1a7a421225a4a8afddc15a85fb64182e6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692060, "uuid": "fe17b8c8-8ddc-4912-9487-be6cfeb4ad03", "value": "T13BB2BF34D70EA4AEEA575E3DDC6A0EFBE1194162F702589F653B8B49CC24D630365388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692060, "uuid": "25230100-979e-4c19-a25a-fba0460fb9c3", "value": "384:PM9EjByEJh/9TqR1W34jrCLLckLuDNxt/ZtNNlEso8wVLa+0tZcP:EYX7VTEW3Nu5xllNl2/+Zk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654692060, "uuid": "64d4becd-9ecd-4479-a4c8-3326394bed44", "value": 24144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654692060, "uuid": "55b55c47-cb96-4224-94b4-6a90c3631b86", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692060, "uuid": "9508e1d9-74ce-4553-bd5c-32b409bb0c74", "value": "Doc.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "715d9999-e721-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654689136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689136, "uuid": "72418faf-76a1-4d18-a1ce-9a4bf0189a2f", "comment": "Malware payload (AgentTesla)", "value": "ef3bcc7cef945872b676e7766a4e5d05", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689136, "uuid": "c2b0475e-c4b0-425f-9628-53294f65067f", "comment": "Malware payload (AgentTesla)", "value": "90f3e2a382e1efe084da779a2be353cdcdd024b8a56d7db4b702499af889b223", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689136, "uuid": "9c809111-4c63-4cb7-9973-5ad24bdef92d", "comment": "Malware payload (AgentTesla)", "value": "41e2868865f9a68726fc40a7de8f34d693fe4102", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689136, "uuid": "8ba937c4-a63b-471a-a93c-3800f4b9ed6e", "comment": "Malware payload (AgentTesla)", "value": "0f234f5cc1102e513d9dca488abba6dbb56126ca58b791dec5f5ab5a9b261524bd8f7da09dfcb3053b9cbbb68fb5a801", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689136, "uuid": "8f80e0c3-1336-4110-90d7-1fcf7d848b02", "value": "T1B9B48C9C366C35DFC857CA728AA45D64EA6074AFB72B9107902309EDED0DB97CF104B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689136, "uuid": "86195efc-ccab-4632-b079-ecff6ff2069d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689136, "uuid": "a14a2f11-f5a4-43cc-85b7-a4985443845c", "value": "12288:II+7+9Mzw1ooZitLnSrPvrQze6IjGRk2AMJkd9a:It+AwwtLS7vr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654689136, "uuid": "9b1e2e08-13d3-432c-b630-ff439ce3460c", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654689136, "uuid": "106cbf93-d36a-4e8d-b528-cb8c4b33f624", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689136, "uuid": "6aa26eb7-3ec2-4322-be19-17ceab7379b7", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b90adc2-e754-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1654711004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654711004, "uuid": "0ef69415-1418-41a4-bc13-1787c427b0dc", "comment": "Malware payload (GuLoader)", "value": "d419e5500bbba016abb8107579f00726", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654711004, "uuid": "afe64772-aea2-47b9-9b43-6d7c66ae472d", "comment": "Malware payload (GuLoader)", "value": "92137696e68253fd30d3ce5e0cc5c9b777b0b7b363caec06810f2f8ca7ee40f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654711004, "uuid": "01276f65-4910-4214-92e0-4f1a8660763b", "comment": "Malware payload (GuLoader)", "value": "de70cde08a6851f79bfa54f0b1edcca622cfaaf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654711004, "uuid": "0f5e913c-2e38-491b-9483-74ff432576f7", "comment": "Malware payload (GuLoader)", "value": "7e4b2902b942ec469fbef5f4879e0052a65f79c7135fadad618df5da33868e59713120548c7d43cb6e1a7234e49ef508", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654711004, "uuid": "912beb03-c335-47af-83f3-4f68fbc49781", "value": "T1268533C1A525D972C413B979F8396EF85F549F2BC5225B1B133A7E0BBA38242640D32F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654711004, "uuid": "8b5ed58a-df8e-4e15-a5f8-eafdbd02293d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654711004, "uuid": "f152e5a2-5e16-4df5-95e7-93c478393b6c", "value": "49152:rRoPNWSEUlMZ4+Uu45aVE8ep3SyIR7UK+VeMJ:rR5BUKNUZjBSL5vG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654711004, "uuid": "dd4031b5-bea0-4435-8cac-07ec8f3fefba", "value": 1750986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654711004, "uuid": "8952af5e-3493-44ff-893e-e8a64a2ee5d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654711004, "uuid": "83dd7987-ccd4-483a-b2fa-d784878897f0", "value": "Purchase Orde Finalized Price AFI_Honeywell_NDA-CMM_MD_2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b8de98a-e750-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654709259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709259, "uuid": "2f06b28d-2cc7-4828-8e14-6ab0f673f80b", "comment": "Malware payload (Mirai)", "value": "d7e5a7b7f3fdfd4c948dcb25fa0e1085", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709259, "uuid": "124934db-6a25-4f14-ae0f-29908a5f76d4", "comment": "Malware payload (Mirai)", "value": "921ee45757d0d1fc5e39b8c3c40cdb446530a80bcd852ec54b8b2ac27bfed615", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709259, "uuid": "c067e5d1-a946-4916-98bb-1cc53f74e54a", "comment": "Malware payload (Mirai)", "value": "69ab86e5fbb8068b3570d993fc2895e82f7a1afd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709259, "uuid": "1da68f2f-fd71-46d7-95fa-de09eff4571b", "comment": "Malware payload (Mirai)", "value": "b194ba38e640c82ae5c697c78265116527bed58bea0e495664a01eac50cdfde98cd5a015f7d713964d8797f023e042f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709259, "uuid": "c7d59fc6-477a-420b-9a0a-c95319977d01", "value": "T140430895BC955A2AC5D4637AEAAE008C336177E8D2EF322BCC101B10BBC951F0D73B95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709259, "uuid": "19e04a9d-e2b6-4775-b056-6d8e1f1c0762", "value": "1536:iD9GeMs4zJlvxiDiltkYXjcsnHCmuMQCuXqikxXmNq:W9GeEzHrX40HTuMrIqDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654709259, "uuid": "a48ac949-2654-4f82-b5f3-4db85c24bf5f", "value": 59972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654709259, "uuid": "ef02003e-13f7-4d99-b731-4d4beff2c0b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709259, "uuid": "607a4152-bd7f-495d-ac18-4486ba573bbd", "value": "d7e5a7b7f3fdfd4c948dcb25fa0e1085", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb5a55f3-e706-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1654677771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677771, "uuid": "2359d9bc-f9dc-48a6-9985-17f7babfb71b", "comment": "Malware payload (SnakeKeylogger)", "value": "ad36242958aa5c315e8e0678baf1987a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677771, "uuid": "77e81a0c-8ff8-4deb-94ca-5fff19f03b72", "comment": "Malware payload (SnakeKeylogger)", "value": "923c5e6bd655011a965e2da0a53877e9916810876bff2ae65ee74ecdb91ea54f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677771, "uuid": "f14a975a-32fe-458d-aa53-baf115237d60", "comment": "Malware payload (SnakeKeylogger)", "value": "fc3c37fd47bcad439ea9b7d68fb9423f06fb48bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677771, "uuid": "59783886-a0d2-41e7-95b5-95cc431a46a1", "comment": "Malware payload (SnakeKeylogger)", "value": "5e4b90070be2d3eb1ed564b856768d4abaf9ff01845b4f735f3d27df7a2e18c524141b04fd129debf579c51c2ff04526", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677771, "uuid": "55d5e055-dd84-4f38-ad93-4ebf762982f4", "value": "T1D6F4CFAC766075DFC81BD976CEA81C60EA6078BB830BD203A41315ADAE1D997CF151F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677771, "uuid": "052e9d68-5900-4097-b54c-3d888f313a98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677771, "uuid": "f001626d-c2e6-4ad7-993c-df7d203ad881", "value": "12288:LgZ6+A2iNJEn27/O61AqU2Zo6jeVb6BGtHTG6E1+QkHw+PBskGzuuRgM93zBDX2w:Lq6+A1rjV+qtr+plE11IHYuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677771, "uuid": "e186d393-887b-4e9c-a7fa-f2d5095cc031", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677771, "uuid": "4ab424be-6263-476c-bb14-80cdd5604713", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677771, "uuid": "62874e64-4709-4776-93a4-a0ac1b514f0e", "value": "ad36242958aa5c315e8e0678baf1987a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aafe8767-e705-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654677207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677207, "uuid": "d0273a22-5353-4b99-b2c7-5b2946200b55", "comment": "Malware payload", "value": "1e11c298d9a084c1b6894ed44694e843", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677207, "uuid": "fe69aab3-e2ff-4e24-ae92-f3739b00db00", "comment": "Malware payload", "value": "92a7bd6210e5b70937634e0e3d1ce38c42c6ee8721d45a6083c912897485de40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677207, "uuid": "064c9a1f-1055-4073-a47a-284f5cfc0ac3", "comment": "Malware payload", "value": "6bcad8cd8ce043763d8a4706082b18c6c0adb723", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677207, "uuid": "ef692b85-c61d-4f36-9541-c1b4183fc063", "comment": "Malware payload", "value": "77ecf8792bc05109e06fbd584023b472b35ffb41aa4c11c00add942c291e22895b05c56cd03e9dc1222a09717681469a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677207, "uuid": "a153d1a0-fd96-4cba-94d5-9f8f10c82dbd", "value": "T14942D93B73A8C53EE8F346B19CB2160023F4B74999669E0C28D0A90FFED67814756B71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677207, "uuid": "aa2bc0a5-5dbb-4458-94e0-a2f83b2bc8de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677207, "uuid": "4cd6e231-40cd-4e68-babf-1e5bb0e00dd4", "value": "192:hM/jT+Aon3lnB5i1PoZmXYteslsDOxB5gKL+2:MjTjYRi1PxHOxB5p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677207, "uuid": "2ef056d1-99db-42ef-83d5-f3116e854dd0", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677207, "uuid": "1c37ef2c-101a-43de-8b5b-d29ebef62e22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677207, "uuid": "0f5eb527-02cb-48b6-8273-b2f121cfae40", "value": "\u7d27\u6025\u8ba2\u5355 PO ATCS337911313 ARBOR TECH CORP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb393b7a-e76d-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654721982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654721982, "uuid": "2dc52b10-faef-42f8-ab97-3b4949ae9423", "comment": "Malware payload", "value": "521ff8430177bd2e80f9e3043fcbf5fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654721982, "uuid": "e29efc6b-f013-4bb0-869c-bd48bc5b54f2", "comment": "Malware payload", "value": "93662b291b5761666387300a091facaf06d89cb6417c713ae09e9696b5bb34b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654721982, "uuid": "fc251f54-5f7f-452b-a2a4-1c67af0b41fe", "comment": "Malware payload", "value": "758071e9b7c60ec77cd738faf4afac8c31592638", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654721982, "uuid": "aca7a7a8-5185-4a2d-b33d-6b26e367f692", "comment": "Malware payload", "value": "cd8ba85af823702e8e0be92c6020950ced639d512ce48bbec9d2764938baf7198df2b082902f95762b9c5deff33d99e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654721982, "uuid": "0b46d327-4652-4354-bc19-1bf8cd7290e7", "value": "T12C14ABF36BD8C8DEDB586234F3421E1707516DEC68D6A23C1FDE7A29C530A6A60F8560", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654721982, "uuid": "bc9bd78a-da23-48ee-bcd0-96e5c0c26b6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654721982, "uuid": "db9e5d4c-ed0c-4bf8-ba5b-3a51bf3625ad", "value": "768:Z4bsKhp6kELfJSCChd7ntnR+iEiiiM8n8nsoGGTdjt+++Gvx/bb2exNEzAlgql37:Z4bsWWSjwTOfhhGo8r2PYBU4cISI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654721982, "uuid": "0938d990-e071-4ff5-9f9d-32b6ae0e5f3c", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654721982, "uuid": "8dd37d55-11ab-4eda-9669-987d73a1d8d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654721982, "uuid": "c8d1dec0-1f94-4f2f-be4d-7f53fd176136", "value": "MT00012781.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea6b0630-e762-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654717256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717256, "uuid": "e941c26f-9db9-465d-b6ad-fba1b626f514", "comment": "Malware payload", "value": "c8f8293e3f70cd2da1746d8938de1e6f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717256, "uuid": "631cbc68-1c17-481c-9e47-1dbd2275d1bb", "comment": "Malware payload", "value": "93d4cfa2d6d646d8ea027cf41bcbf18d4f8dd1fa7f205fcd05f88f0121bca865", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717256, "uuid": "ecf5ad3a-98de-4b26-a173-34a3a2877b70", "comment": "Malware payload", "value": "fb0ce9af047b347252025913313d8ca80bcdcc87", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717256, "uuid": "e444921e-428d-410e-acdf-de55632dcec0", "comment": "Malware payload", "value": "1e51e026b2b01e62a761bcf8531178126262da39b23fd67fbd600be6fca4e0214043adb650388d8eac8956b6a91d1ad0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717256, "uuid": "4803448f-95a7-4c10-9e44-adb8368d9541", "value": "T1C603F234430161A8D565773EA9530BF06A240F663B438E93F18971F99EA72297B63FD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717256, "uuid": "4e6d41fb-adcf-4ea0-80fa-d659550faa9e", "value": "768:ZkRdVMqfF6yk6e83nlcZXAiKFLZBphBf5+sqy2uaNAJgGlzDpxYsn:276qfF6oe8OwjLzphBf5+sgAVrYs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654717256, "uuid": "f443cc60-47d7-4872-9c9e-b9656f8ca1ec", "value": 39308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654717256, "uuid": "ccf53e22-dbd8-44c1-8fc3-b5f1e6484d4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717256, "uuid": "2b4583de-9fa7-4433-9e03-d44911751909", "value": "c8f8293e3f70cd2da1746d8938de1e6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3c8039a-e6fa-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1654672551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672551, "uuid": "f69f7018-230e-467a-bc95-927fb0c5963c", "comment": "Malware payload (Loki)", "value": "0044006d468c6f613b1e21b1fe1863bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672551, "uuid": "1cd66208-3d22-45ab-83c0-93d9e719a491", "comment": "Malware payload (Loki)", "value": "943739faf86d5493cbbe3f975c2319103208e96853d956776057b97639c13863", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672551, "uuid": "375b16e6-e38c-437c-859b-0b14f31bb8e1", "comment": "Malware payload (Loki)", "value": "ea8e95d3c35ed27ec6be1bb2682fc28cc33852e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672551, "uuid": "cf982bb7-4bc1-4f1e-ac25-f433d394926c", "comment": "Malware payload (Loki)", "value": "c7f7d0a180332c853ac98857c4161ad9eaf2a28dbef29698a7ea4e6b8333c2a53cf088acbc4e6c11da8abd60f5a6de4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672551, "uuid": "d29ceea6-7802-43e0-9950-160cfd04a39c", "value": "T1A0A31942B2A5C030F7B74DB2BB73A5B7857E7C332D22C84E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672551, "uuid": "37ffcc69-d524-49fa-834a-3cbf682fe42d", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672551, "uuid": "f5ea94e9-9ee8-40f6-b9c8-1c569c8249f7", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654672551, "uuid": "b5400ddc-11b9-4d7c-bd34-2dd89c14e2e7", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654672551, "uuid": "62714953-f8ce-47e6-b77e-f1a1a705a9d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672551, "uuid": "506d0283-6de1-4822-83ac-c483ca23cbf9", "value": "0044006d468c6f613b1e21b1fe1863bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c16a20ad-e6cb-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654652333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652333, "uuid": "06af0f30-3436-4da6-bca5-a67ad7f02516", "comment": "Malware payload (Heodo)", "value": "6583cced2f4582f86bd4d4995753373a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652333, "uuid": "6638edc4-09ab-4eb9-96ec-95e45efda2ab", "comment": "Malware payload (Heodo)", "value": "944927c346dc09bee204bb8434fa10076a362db08e7baac65f577fba8a633a78", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652333, "uuid": "7757b51e-5164-4c4f-aed8-ce9424b9190e", "comment": "Malware payload (Heodo)", "value": "bea62ef988f08fc134a6f7d066e38ea007536b43", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652333, "uuid": "c5c7c52f-4a23-494d-be5e-1c0665543b08", "comment": "Malware payload (Heodo)", "value": "c0c90bad09905d2184bde7210a71d2fb1359497d89e83329382d6c0c3b7af76fc35586ec6ff0de3a3506d450ce2b36a5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652333, "uuid": "d6701cd6-9546-4a59-b09d-510637eabd52", "value": "T1C104023EE5031A98C22ED8FC58EE6DF9D5F638006258063A1BA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652333, "uuid": "c3a534dd-3be4-4760-836a-ad9b3cd2f2bb", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652333, "uuid": "58a7f2f8-19ef-4c46-ae1c-607fb6748a33", "value": "3072:Vpjft6Fs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VR4i1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654652333, "uuid": "8526b12a-7543-47f9-8b07-247bf278a572", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654652333, "uuid": "c666e756-aefa-4839-b7be-ac1a625bf007", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652333, "uuid": "1c616b30-fa74-46a4-9524-7f42bc73ea24", "value": "6583cced2f4582f86bd4d4995753373a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70929a1c-e6d0-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654654345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654345, "uuid": "b84745da-1034-4bd8-b975-d9f5fa8b6870", "comment": "Malware payload (Heodo)", "value": "6135171330e91073d4ae93b71a8cee55", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654345, "uuid": "337750bb-f80f-4569-8dfc-3b3894f70542", "comment": "Malware payload (Heodo)", "value": "946a62e4fb86bdc23c0d7972f75baf894e9d70e4991ab3e1c6bff95de5806364", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654345, "uuid": "6164a959-d7ce-4b52-b6e0-f7dd727190b9", "comment": "Malware payload (Heodo)", "value": "13d1711975d7d28f0932eca4963870fe612ac503", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654345, "uuid": "d0dd20be-3c7e-41e5-ab84-d66a9ed73420", "comment": "Malware payload (Heodo)", "value": "a4c30387bb1530da7d776e5bc00e4f2cf315620f4a4e6cac5956220fb87d5bacc8d24deef7c6a693526c4371a19ac596", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654345, "uuid": "65c58184-d99f-48be-a309-e2e25c200f2f", "value": "T1F304023EE5031A98C22ED8FC58EE6DF9D5F634006268063A1BA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654345, "uuid": "3d760891-58b9-4236-9e75-4eda1eec4b18", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654345, "uuid": "9c8a65d3-ca80-4475-9193-9c13e9ae455a", "value": "3072:Vpjft9Fs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VRXi1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654654345, "uuid": "f98e42bf-5502-4366-b35a-92d5b35e1e6d", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654654345, "uuid": "6da20bdc-0eea-4338-9846-46c1ae24e8d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654345, "uuid": "bb6d2104-5969-4463-b409-14a260cc94aa", "value": "6135171330e91073d4ae93b71a8cee55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b076515a-e73c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654700838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700838, "uuid": "e8caf3b0-bcc5-460c-b2a0-e76f4dd06ddd", "comment": "Malware payload (Mirai)", "value": "0377e266e714b9cdeba8df4ac8009157", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700838, "uuid": "50dfd371-aa09-4bbb-99c6-c6618d28396b", "comment": "Malware payload (Mirai)", "value": "94ea9c65c39e9404872c20bad225440b713efc2abd881fbdb33a38cdaca2a1f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700838, "uuid": "446ce73a-e441-4b6b-b365-6f59ea11894e", "comment": "Malware payload (Mirai)", "value": "c14294030eead756d0d471c3d2fbbe9f81086773", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700838, "uuid": "7a1d35ec-86bd-47a9-8eda-8c77db25ebae", "comment": "Malware payload (Mirai)", "value": "2c02214c3f7b6bb8694ea854f1fbfc3e2bf65ee7945b28a6f6c87764b8bb93010f8fac4a630912ae2429d00876087cc0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700838, "uuid": "a4092c1a-8bfa-40e1-b992-9be362a3ee8b", "value": "T1FB930955B8818B11C5C513BAF96E118E332267ECE3DFB2139D241F243BCA52B0E7B956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700838, "uuid": "14cb5461-734e-464f-868a-c1205a218461", "value": "1536:TEntURIW8y0u8NfDeTos/+6qUbA5r38A+FUqzmP57p2c1zJr8o8Q5FBWM5xjYUc2:DRb8PuEDMoW+FUs5rsRFUqY1YcBCXQvb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654700838, "uuid": "f3403aed-8eff-438c-be34-ff6efd39b66c", "value": 89008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654700838, "uuid": "2053f891-ddab-44a6-9091-19fc0c752dfe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700838, "uuid": "2a5f477e-9ece-41be-848f-2729f2af9393", "value": "0377e266e714b9cdeba8df4ac8009157", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c95d233-e6d5-11ec-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1654656379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656379, "uuid": "1ec53c45-d860-4dc0-8881-7b1ce7dbc73f", "comment": "Malware payload (NanoCore)", "value": "1a9206d71c5406abd2c44bb2ce0acdab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656379, "uuid": "676ed3e2-66d6-464c-94c8-b6a7852abd28", "comment": "Malware payload (NanoCore)", "value": "9530780503c903e1d83738e19e754c3756e067612adddcea2f64c25749b6a838", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656379, "uuid": "9b055911-ceb0-4d55-be91-a00f157609f3", "comment": "Malware payload (NanoCore)", "value": "44e86fb77850d78374de97f6b8354e0198bcec3d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656379, "uuid": "139db1ea-4e79-4a80-8896-6790ab90a138", "comment": "Malware payload (NanoCore)", "value": "b3330162e2d33e7c5d2152acd7ca82927199a47a90b6e360254c24c0604ac98c5f27c3b09e40b4b429ccacba5387ae88", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656379, "uuid": "55b27b30-38dd-457d-a094-f19a2930a42b", "value": "T12615E1407713EC7EE0294E77AC60540427A0965B82AEF76BA5CE32CD744F7CB1AF6612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656379, "uuid": "f1b8f697-b0c7-4d96-8cc3-2ac3bc7568be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656379, "uuid": "dadcc940-9b3c-4efc-a72e-518d83d4dfa2", "value": "24576:IKhDPk2l+421nWa1p16idSACKpLJ/LDwAF+uvFNB:fkFXxr1YUZJ4AX9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654656379, "uuid": "36afbcd3-bc8f-40ce-9183-0fe3327c1541", "value": 897536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654656379, "uuid": "53f6279c-ce16-4db0-b08d-a0bbbdf52d68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656379, "uuid": "b582750c-e581-46d8-9007-7138dc89fc17", "value": "1a9206d71c5406abd2c44bb2ce0acdab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a5d918-e738-11ec-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1654699021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699021, "uuid": "6f3a6f37-619d-4172-b693-c39e8a8518f5", "comment": "Malware payload (NanoCore)", "value": "c3df5ca79a0e67e0628c9d95f8da54c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699021, "uuid": "631f92bb-36ea-476a-983e-d8cfc7eac5e3", "comment": "Malware payload (NanoCore)", "value": "964ed2b5f5aec6a94c1674d3d1358ab0189b957f4bb16aaef1c6d6f0fed4d911", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699021, "uuid": "6d1aef9c-f053-414e-baf6-657a5f61b6e3", "comment": "Malware payload (NanoCore)", "value": "a9b61ba81c0476e842b792e2cc7e3c68c5d2dc6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699021, "uuid": "9d0a1fc5-0c55-4c75-b6ba-342875135de5", "comment": "Malware payload (NanoCore)", "value": "e32af6b95234a1849db9da8920979ce4a80815c264b923a59512f3eb68aa1555d0dc6f222518f270bf6b636065db5d2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699021, "uuid": "8ce49272-91eb-47f5-b56d-9acaa6fc5c4d", "value": "T100A4931C7B175B72FC0DA07058010A54BB220B5362BBB9CA63DB95CAA75F1A5FDC4CE8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699021, "uuid": "b5978f53-5529-4304-a179-effeae799a92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699021, "uuid": "1b3b49cd-7fb6-49a5-88e1-59fa5da4134a", "value": "6144:8xFMuartMhzMh+bJQjXV50Aseb8vbn26RazMY3MukzFzixbBgZl1iCa+8LS1a:8xFMu1why6XDPz6RazMYxxbBgZG+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654699021, "uuid": "acb1e1f9-6247-4a44-bbff-627834960587", "value": 489984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654699021, "uuid": "8b8087b0-fff5-4e1b-b1e7-611ef57d795a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699021, "uuid": "2d5548f1-58ca-468b-8dc1-d4125b5233e6", "value": "IRSFORM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18198dd1-e70b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654679537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679537, "uuid": "2f694886-9f78-4c18-9e69-6ef6df99eecf", "comment": "Malware payload (Heodo)", "value": "1df293d877106b1fe3760464c85baad2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679537, "uuid": "de614fb1-b8b0-4806-9037-7235161b63b7", "comment": "Malware payload (Heodo)", "value": "96919d2dd3b558a133566316909ee2b1670cf8160ecaaa3a0210ad9c55081775", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679537, "uuid": "4d45e5b6-d579-448b-b34b-1616d5610426", "comment": "Malware payload (Heodo)", "value": "9efc18253e0857a13d6dda4689c6ebeef1a94c36", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679537, "uuid": "98b7af4b-0860-475b-8f29-b891e88a4179", "comment": "Malware payload (Heodo)", "value": "f8e5712dbf267a2078fef123193f38e134291ebeb834c8632ec484f7dbd96b9ef17ffe848b587312a5821bb356d8dd8a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679537, "uuid": "5b3b5832-ac63-4187-a3c6-195811ce5efa", "value": "T19B44C089ABE1ADDBD51407798DD6D324333EF2814B8387076B2598390F23BA4BFC5A45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679537, "uuid": "f5b0e2fe-99fa-4fba-9198-dbf878f1f692", "value": "963f2e88a5b03877d0583808b2526c1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679537, "uuid": "6f72f2c1-45c3-41c9-b50a-c58771c47128", "value": "3072:7R7be82w+Oh+UjuFJrfr7CS/FmikytkqroMdjaWtHCqPZ4PEx2ES2vZg3f4L5ZJi:7liJuk4uFxOmFwytLVxDtfPZ4PE2sPs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654679537, "uuid": "da20d8c0-30bf-4e18-bc2d-382f626f77be", "value": 270403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654679537, "uuid": "f40b9049-9553-4564-b9e9-ed42f653a6e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679537, "uuid": "ba335534-8cd6-4d89-97dd-6e63a69809a2", "value": "1df293d877106b1fe3760464c85baad2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdcbd347-e732-11ec-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1654696673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696673, "uuid": "58e3c83a-5530-4e42-a2a1-6df57a17ca95", "comment": "Malware payload (Gafgyt)", "value": "acd59298a27dde03334816f1e207d6c3", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696673, "uuid": "b38662a7-02e7-42a5-9e9c-654fbdada02c", "comment": "Malware payload (Gafgyt)", "value": "977c8e948d315cfdab0bd145513ca2ce1693f9c5cf75853651f2bcc43213a4ad", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696673, "uuid": "0cf26024-fe1f-45fd-b2f9-160cf56a297a", "comment": "Malware payload (Gafgyt)", "value": "583b7c3ab29f4c64df4f11fcdad60eda99bdae8b", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696673, "uuid": "5a6296a8-b5d5-4d19-aa78-40058b8673b5", "comment": "Malware payload (Gafgyt)", "value": "f1c778afc3100092705f8d24a4dcc8c954f0332479d3e79eca7d72d144886ffbde80dcfaa61bd89d2bce1cc0b16adce1", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654696673, "uuid": "2761e57e-5b0e-4575-b6f4-e7f1b3477932", "value": "T11413E1A78B67DE34C7E27C7865096710B978FE16B0820B18799D70F6EDB39C20979318", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654696673, "uuid": "d3dc6132-c73e-403a-af8c-c6ed7465f02d", "value": "768:l3n4ki9o6e8BDBbDWlN85weSB1erK3sv9sPDYy2xZ23x:l3YQ8BdbiloS74KcFuDt9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654696673, "uuid": "a4dce746-f9a1-4eb1-985b-5ed349069e82", "value": 44856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654696673, "uuid": "07a0a1e9-907f-4c9f-8ba1-28a24007b300", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654696673, "uuid": "4441fd35-daa5-497f-b36c-19fc638f89f4", "value": "gummy.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5489484-e6cb-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654652394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652394, "uuid": "f807eaa3-52c5-412a-b0ff-d469e58cfa2d", "comment": "Malware payload (Heodo)", "value": "733c184b3e8cb798e2bfbf526ec78fa8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652394, "uuid": "aeb3f2a4-c0c8-4f37-a23b-d2d4cd788f58", "comment": "Malware payload (Heodo)", "value": "97adf7ebf3991ed8bcdbdf505b142468d7c69842f7c5d78a8b3b20ea031fa3f6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652394, "uuid": "6c18b728-68a8-4397-827a-88a4408b9445", "comment": "Malware payload (Heodo)", "value": "844215bb8909d26cacc0e350baab6d973aee7aa5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652394, "uuid": "1c206a04-99d6-4fe5-b8ee-1e6ba6e491d5", "comment": "Malware payload (Heodo)", "value": "9d535dcf57c2fc65d19e98911a432e2e9387f90c612f738dce809bbc230af1b04e1829cb8979c65c5026b9119bdfa2d2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652394, "uuid": "7051e729-77b1-494e-9c98-d500527abaff", "value": "T18D04023EE5031A98C22ED8FC58EE6DF9D5F634006268063A1BA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652394, "uuid": "818a22c6-4edb-444c-af83-ba70ef32b47d", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652394, "uuid": "d258fe8b-2fee-44a6-9ea5-f7d580341019", "value": "3072:VpjftqFs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VRoi1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654652394, "uuid": "8ca458ae-46b9-4aef-a39d-a561101fc410", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654652394, "uuid": "e3472a87-7d0c-4d59-810d-68c7432b23eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652394, "uuid": "294e8c72-69d1-44fc-bc38-ec425a79e23b", "value": "733c184b3e8cb798e2bfbf526ec78fa8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5dc11c5-e6d6-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654657119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657119, "uuid": "1635157e-7c72-4e2a-a924-6d047a8a5bfa", "comment": "Malware payload (Heodo)", "value": "1dd19da76a7d4da4956740b9aba8270d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657119, "uuid": "70cdfaca-82d5-445d-aaac-a580ee2e8044", "comment": "Malware payload (Heodo)", "value": "9860447ccd963eef029da95b7744256be12867d9c649cb1ce0db1585fd69bedf", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657119, "uuid": "7af1fc38-31dc-467b-b840-4b82efb971af", "comment": "Malware payload (Heodo)", "value": "368afad1a2c5480d131dec1b2da3bda49a4ae9e1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657119, "uuid": "4c0be4a9-7bec-4768-a06b-9e8e9eaeb914", "comment": "Malware payload (Heodo)", "value": "0f111347c358163935b60287d38050735be55cd27e5646e9a85e9fadf1e480a1b769756dd8f0cb4435aebc9a74de5fa0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657119, "uuid": "0c9d9393-1494-4402-813d-424f14bd14f4", "value": "T1B804023EE5031A98C22ED8FC58EE6DF9D5F638006258063A1BA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657119, "uuid": "b95ca315-82ca-4989-8146-8593b851f80b", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657119, "uuid": "a338502a-56cc-4341-943c-cfb485490632", "value": "3072:Vpjft3Fs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VRFi1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654657119, "uuid": "f6a2465e-fbf7-4327-b917-8245f96da21f", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654657119, "uuid": "5a2d223f-38a0-4eff-b31e-42d42752d364", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657119, "uuid": "e4dfc5b0-631d-4954-8921-89c526ea9332", "value": "1dd19da76a7d4da4956740b9aba8270d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b5f66a-e77d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654728605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728605, "uuid": "fc8ff8e1-cc5a-4350-8203-229e0b6c0c85", "comment": "Malware payload (Mirai)", "value": "941cf938901dfb1a574834f323aeef11", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728605, "uuid": "30882d3e-1c40-4d8e-a017-4ea215a26258", "comment": "Malware payload (Mirai)", "value": "98701fb5e211002cfa59e39752fab89425fff24b3c9a61b6a70d0443c094749d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728605, "uuid": "0bcc4681-0701-455b-a1cf-79653005b1aa", "comment": "Malware payload (Mirai)", "value": "237183bce62c6cd846fd9c7bb3981dc67ec5bc59", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728605, "uuid": "ba42c194-5914-4a4f-80d1-f75706448b0e", "comment": "Malware payload (Mirai)", "value": "111e206efbab5e709046d114736657d5f370d29eec5892eeec59f1decf6507253e57f37a5fe153986e980174f53fbc50", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654728605, "uuid": "6d191ea8-023e-4923-b1e9-a4d03fe3cad9", "value": "T107C2D0386A394E35EA60053A8766C6C2769715BC90F832771304DBD0EAC491B7EF5BCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654728605, "uuid": "29761600-1a63-4fd6-890b-7de252a9893a", "value": "384:2Pt7sMLB5mIQrdoz6MgijIjvyPbybdzrOFURhOswKc7rWtBRDmhymdGUop5hO:65jQhoz6MgjvGbCZqKc7rWTMs3UozA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654728605, "uuid": "aea24f24-63f5-40bd-8abc-18d90ad54393", "value": 28092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654728605, "uuid": "8dc1c8f7-319c-40d4-b124-5cacf5dc4fdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654728605, "uuid": "b686d229-c17b-4838-b39f-1ee06ac486d3", "value": "vailon.arm-20220608-2250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b8d18e-e726-11ec-93bb-42010a9c0043", "comment": "Malware payload (DCRat)", "timestamp": 1654691182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654691182, "uuid": "ca51d273-add1-49ad-9fa1-f7d78ddec71e", "comment": "Malware payload (DCRat)", "value": "3654cd9f5bcc17c39abae0b2f1fa2b7b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654691182, "uuid": "9d7f756b-e61b-430c-a2a8-11a0b42b8af7", "comment": "Malware payload (DCRat)", "value": "989e25e4e59ab6778b3d50459aeaec98c97211ee9cbdea8b75c140bda008770b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654691182, "uuid": "b81d50af-a8c8-41e7-9a95-66ce0c50098e", "comment": "Malware payload (DCRat)", "value": "1797f8b9c9106026526a04b9ea16929c74513b74", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654691182, "uuid": "9a5c6049-b01c-4989-a05a-b67b53a3cc9c", "comment": "Malware payload (DCRat)", "value": "d4c48a4904ab2af9ee2ce68c0b25fd26c3300d0f8cb6694a7a1b0bfe69d3a6d60f5c859652a5caa7bb6a8a983106590a", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654691182, "uuid": "4e8a79e8-4ae4-4c23-8e8a-6b68753d5fc3", "value": "T15C757C017ED0C931F0581633C2AB7D244BF49C50EAA5E71B79BDB6ED1521B923E09ACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654691182, "uuid": "d4dc9834-ec38-4d10-b3c9-e2370a8cdda4", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654691182, "uuid": "f9cd05e2-8dde-424a-a21b-ac07586077b8", "value": "24576:P2G/nvxW3Wh0gaYT5JNef4wm018HsbNRJSCTkEgDGX1Xt4V3xX:PbA33gBNn10mHJcYGXlti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654691182, "uuid": "c6e506ae-6135-49cd-89c2-5788c8020414", "value": 1700483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654691182, "uuid": "1da95e42-a45c-47a4-b765-5de94f540b71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654691182, "uuid": "7c50d83c-0114-4287-a6df-ce5349340e60", "value": "08 06 2022 \u008d\u00ae\u00a2\u00eb\u00a9.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b65432a-e740-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654702521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702521, "uuid": "c1562d52-dd2f-42c0-ba53-7abf10d8e1a7", "comment": "Malware payload (Mirai)", "value": "5b5a302c4c5855b329bb9615f9c3fc28", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702521, "uuid": "cb66b28e-f85c-4956-ac55-c4ad1347f315", "comment": "Malware payload (Mirai)", "value": "98ff7939b67f2ac665363526569604e9309ab910100bcac484d69b7569676647", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702521, "uuid": "ca502552-f822-4f2c-b55f-a4cbfc34b196", "comment": "Malware payload (Mirai)", "value": "e36f5159a35c540ab46a42bdd915a67411297121", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702521, "uuid": "56ca3520-2b71-4cec-afae-34050279d2d3", "comment": "Malware payload (Mirai)", "value": "8b700855efd37348dcb353a25399b51bf445ffc4fa2a1ca5bc8a2ce4c739c78bb3d0e1037accb43569595eb008398649", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702521, "uuid": "34637dac-366f-4820-8e85-6987e592cee8", "value": "T108B2D070D0691E4FDB7EAC715C86E640F3E20BABFF05C66380999765A11BB3AE6043C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702521, "uuid": "0376ba3c-4f13-4a0e-a510-c3686c1cf774", "value": "384:mvPgX5g1IsZuoBl8XUlxJusBZhaCZfBHQ/l4M2eeFBRIM4uVcqgw05VxJB:mngPsh4XUusxaCtBvVrRX4uVcqgw09r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654702521, "uuid": "b6485c86-781c-49c4-a0d8-2596cb951518", "value": 23488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654702521, "uuid": "c0584236-b5a9-45f3-9151-a4e20c44108b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702521, "uuid": "20ded485-875e-4fea-9baf-d33096e8aea8", "value": "5b5a302c4c5855b329bb9615f9c3fc28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef286e8e-e70b-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654679898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679898, "uuid": "93d174a7-42a2-4f13-8e88-dcdada6263c9", "comment": "Malware payload (RedLineStealer)", "value": "edcdfbf1bd5eab04738e6c60c063a8b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679898, "uuid": "f448293f-1d63-4ddb-8830-2e8afa21550d", "comment": "Malware payload (RedLineStealer)", "value": "996e5567771ebeb69969dff513513388abb6f6328e084f5261c2c68e0f5bd66e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679898, "uuid": "ac8765ff-0c8d-46ab-ab34-63dc54ddbab2", "comment": "Malware payload (RedLineStealer)", "value": "f43881457d364c5bf50b6ff57bcd9729bc0c252e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679898, "uuid": "ccb09f76-5d46-4156-b8fc-1aeefa5b467c", "comment": "Malware payload (RedLineStealer)", "value": "464941ab361bf69187ce6fff7e16f9c563b57a9f7a509b87d553ebb125f2a7f48ff9a8b6e59ae2e62caf142e767f149f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679898, "uuid": "07eaf294-aaa8-40fe-8260-6fda734ddc57", "value": "T1A864F15077B2C832E2F346780434C7609A7FF96361708A4E7B6443698F71B81AEB5767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679898, "uuid": "1af50ef7-67bc-4057-861f-96fb83b4848a", "value": "36661493c289414c02e25c0b7465e587", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679898, "uuid": "0f43e545-e561-41ff-a65f-6043f8392750", "value": "6144:1qbJPtHfpSy/xIJDZoJg5x0w+VM49XKTmqLxkXL:1qbn5/xIrDX66SqLy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654679898, "uuid": "05decc2a-f7d0-47dc-b271-9a77c703d20d", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654679898, "uuid": "c765b459-c945-49b1-9c31-50989deee901", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679898, "uuid": "083bde0c-2b19-4486-8428-6e5afe9a4f85", "value": "edcdfbf1bd5eab04738e6c60c063a8b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "877a389b-e72d-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654694327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654694327, "uuid": "78f61846-2f07-4335-8857-9e74cbd9785c", "comment": "Malware payload (AgentTesla)", "value": "5d5ad29dfe4f761802da76c47dc94446", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654694327, "uuid": "6b9291c9-ed26-4bc4-af0b-173d8278806b", "comment": "Malware payload (AgentTesla)", "value": "9a16729a0163be1d5eaeb28c98fae4574668d657af10e0b7f669993c1cf609d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654694327, "uuid": "628ad6c5-5932-4074-aceb-d2174445390e", "comment": "Malware payload (AgentTesla)", "value": "5fc492c045ff5fd729a157024fb9c15ea4b9fcd6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654694327, "uuid": "976ef343-9db2-4e95-bfb0-f5fb06dfedc2", "comment": "Malware payload (AgentTesla)", "value": "30f5a906171ccb56a6f3d67c82cb84c27523fb49b9050d84ba6d937b7ed5bca0e61f636d15820f648383d95726031c27", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654694327, "uuid": "53ac645b-cd32-4247-89f3-18e3fe3cb921", "value": "T171E402A83AEC4F33C6EE05FEDC46056527F8D1DA5C6BE7878D8175F64582BA00A4321B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654694327, "uuid": "3c1e2ee2-76d5-4728-a1e6-1fc0b2250141", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654694327, "uuid": "ae235bf9-279f-4242-a93e-17c4c0300d13", "value": "12288:uUf8/GPynnHarCzIB589sp+9dGiQ7EEiL3pkUCdLYKuuVkOT3yTWr2XUe+vg2boj:uyWGCXGjAEiL2ukM52boj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654694327, "uuid": "7600e9a4-517b-404f-8cc7-eca11b2ce41f", "value": 690176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654694327, "uuid": "e8751e87-ce2f-4b82-8150-590243a8e820", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654694327, "uuid": "e82baa86-309a-403c-b757-8b54d7ddb67c", "value": "pre alert documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d103d877-e70b-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654679847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679847, "uuid": "40cd9202-e1f0-4ac9-8594-14f2c8594a02", "comment": "Malware payload (RedLineStealer)", "value": "37b9d3ae6f8f7d70a2224d50f7fd8fba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679847, "uuid": "a5e64dba-7a2d-46cb-9e0c-97aa8ca73dae", "comment": "Malware payload (RedLineStealer)", "value": "9a7f16c30b7f11b537df4809a1047bb4b53069c4b00ba23a68b189556ff95264", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679847, "uuid": "8969f892-c7eb-43ad-8b24-f8673da74d21", "comment": "Malware payload (RedLineStealer)", "value": "24ea90e816765162a6f460b24bcfab4baa9dbbe8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679847, "uuid": "edd741e1-09d6-4f9e-a9e6-5ef19e5f286e", "comment": "Malware payload (RedLineStealer)", "value": "ebefac99e3904bd46efe4bf5c2c62d1322bd0f7d44daf36595eda97d4846329ebf21ce8e5ecf8743ccb1c1b8f00aa60d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679847, "uuid": "a6a9ccfc-9c76-44c3-aba7-5c40cc4b7b99", "value": "T183450172B9D4CC22F4212975C9E4EAF0232C3C99B4509E8B61043B5F7973B52E29779E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679847, "uuid": "f7e99562-488e-4aba-a602-49d94b813ad2", "value": "59fdc9cf44445c51b55dc51f095af280", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679847, "uuid": "49588afe-ecf2-4540-92db-10c5ab8637a8", "value": "24576:0uUfMaksktRFBoVQuZ8sa484biPhCT8s/k:h2pFktRFBoqg8sa484biI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654679847, "uuid": "1bab210b-c692-43c5-9219-5dc6e20cc7e1", "value": 1208760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654679847, "uuid": "03579e76-ceee-482b-92ff-3c59c0b8b8e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679847, "uuid": "5a281e50-2cfc-46a1-bc93-e8de6a1c7ad8", "value": "37b9d3ae6f8f7d70a2224d50f7fd8fba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c9ef1a0-e77e-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654728937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728937, "uuid": "b65606cf-3bb1-4aa3-a6f5-942157173903", "comment": "Malware payload", "value": "ee6fa6e939a44b7b673610405d5400da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728937, "uuid": "202c5a20-6739-4ea7-9db7-6d6de8a06ac8", "comment": "Malware payload", "value": "9b44edc422a53146c9e003fd7da2917f101edd15916260a9d41642b43a278bc3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728937, "uuid": "29dbcc0e-5a2f-4230-9b31-0c4c2d807f2d", "comment": "Malware payload", "value": "e35e71248fc79cbe6f0aa2bd45cccc9a308a17e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728937, "uuid": "71047bba-0af1-4523-a45e-acbb8ebcfe15", "comment": "Malware payload", "value": "b9964063f2cb2b0e521b5b7a79b5787ee77378864c2a4918645cbd7ef980dbe78abf52b3c231c30514cde935f0d14e32", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654728937, "uuid": "6fe91ecf-8580-4429-ab91-74da96f2eb60", "value": "T167941E52E25AC1B1FC9BABB20B728C7C5962FC795DB0451E209EFAB5BF772D20004197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654728937, "uuid": "950a17c5-9c6b-4647-8db7-854a44c5e548", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654728937, "uuid": "a953488f-1bcb-4fdf-9d72-c24c2b3b93ba", "value": "768:c28Ld3uGMOXftkKQw4aA3PorA0nJlj/kwmrFDTIbMb+B9lGi:c28Ld3UiSKqaA/ornJlIw+duMb89ci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654728937, "uuid": "6b658c76-f847-4ace-a32e-8650d969689e", "value": 424960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654728937, "uuid": "2fd3e736-5dc1-4615-bdee-9c0ee96e5e63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654728937, "uuid": "e244b513-b34f-4f05-91ab-5d2b2c2d4d82", "value": "ee6fa6e939a44b7b673610405d5400da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "369d1427-e6f5-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654670139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654670139, "uuid": "c8f0651c-ffb7-4b48-bf42-83e9a77104d6", "comment": "Malware payload (AgentTesla)", "value": "891017dc9b0c828821ccf02d4fa3e663", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654670139, "uuid": "4a215f27-ad40-4945-8e75-05dfaa2413e5", "comment": "Malware payload (AgentTesla)", "value": "9b9b1017693154faab964c74d2e937806a9586b0a1ee32f2301c13249021df06", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654670139, "uuid": "207b675d-b0de-464c-afe4-d8aec6fa4f3a", "comment": "Malware payload (AgentTesla)", "value": "bd18d6e09423caab22bb65b959b62de5d9e84677", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654670139, "uuid": "c06f3561-0c63-413b-a0b8-5d8f7799b24c", "comment": "Malware payload (AgentTesla)", "value": "cb0e3e0b2f7d26adf5d9b63b39d55b15f7351cbb8029d4ef5cee0a6dcd40b28fc0051f1f44c39564cf9659bb1f898121", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654670139, "uuid": "0639e082-2d6b-4bca-95ea-605b9d7bc69d", "value": "T10373F101B245C97BFF65B23A2AA0A15CD1EE9C3D1D6BEE82E5217F8836391D01DF421D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654670139, "uuid": "d9f7e0b6-ca0b-4665-bcfb-ef366efaf8c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654670139, "uuid": "d3e08e56-c013-49c6-a071-f66a01a813a5", "value": "384:5S9N34wCWFJAVBREkP4b229+2535mYm2YXhYgjF1:5SmwCWEbEK4bxXiCaF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654670139, "uuid": "54e80106-992f-4f37-b0c2-784e1a4f43aa", "value": 78848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654670139, "uuid": "e5380418-e758-411b-984a-15c05ec731a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654670139, "uuid": "f1682752-d38c-4832-8a77-f7e8c58d0017", "value": "SecuriteInfo.com.W32.AIDetectNet.01.24132.11594", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1d987e5-e728-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654692251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692251, "uuid": "625cea96-6bee-4bce-99ac-82c098fef0ac", "comment": "Malware payload", "value": "c36b71b0bba97585e08124990b37e573", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692251, "uuid": "91070148-ef8f-46fd-a6a4-f31a9245e1f7", "comment": "Malware payload", "value": "9bb1526810fd9d9746329d2121934a6dceaedb9fab0673ac88b83078e1a6052b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692251, "uuid": "fed93866-88b4-49e3-bd8f-5c7a44121e26", "comment": "Malware payload", "value": "90b904785d74d2af54cb972b45b82bce3e722a9e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692251, "uuid": "a4e71ccd-4242-414b-b406-3eb816ca7dad", "comment": "Malware payload", "value": "5b26d2d3a555b61a0cf8e09d66c030e15ccb94439f6f8f5d603ea8d0ef97a1e59dc68188821cb008e1012e6465dac91e", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692251, "uuid": "82064cef-482b-463e-9bdb-5f73b23c5b17", "value": "T12BE3129A49FA6F72CFF2D5F97829D87951DB200C84DE4F0ACFD38E052805D2A61584AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692251, "uuid": "b9cff638-a0fa-4850-9563-37984321a2e4", "value": "3072:m/e7UFJJXReIynum47FkOE2yonn3l288VnrvTQEgFMo4eJKvr1:in1RepubqOEnun3l288VnrgFMjQ6r1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654692251, "uuid": "f25e9d57-3a33-4408-be78-a484924611c4", "value": 144066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654692251, "uuid": "7205d966-26e6-4b1d-9c2b-b65b27e03bd8", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692251, "uuid": "b2facacd-92eb-43c7-a832-5c952455786f", "value": "wiwiwiwiw.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da434c4d-e6c3-11ec-93bb-42010a9c0043", "comment": "Malware payload (Quakbot)", "timestamp": 1654648939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654648939, "uuid": "10bc63ba-ed07-493a-bf36-ec42a0cf3b22", "comment": "Malware payload (Quakbot)", "value": "e4382d11b26c733137abcb346e0beaac", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama186", "colour": "#D28FAA", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654648939, "uuid": "4218c3ff-43b8-42e4-a2eb-bccd772e6509", "comment": "Malware payload (Quakbot)", "value": "9c06f77d7a0dda6a4be399e69344e0583fc854db449b9f85333261518946f910", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama186", "colour": "#D28FAA", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654648939, "uuid": "d70c81a3-3dc5-4d9a-8cf0-c0eb2a279549", "comment": "Malware payload (Quakbot)", "value": "1413371b1c9071f9b84bbafa3bdf77e5443fc63a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama186", "colour": "#D28FAA", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654648939, "uuid": "4c3e10dd-9265-4686-9913-2f168d18ef65", "comment": "Malware payload (Quakbot)", "value": "eb553874debe6ed767dcd065b99a10f6ecf48583da7c8895704a5e0f4879ac0ff540b0320d0e4de7fe587cc78f682d37", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama186", "colour": "#D28FAA", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654648939, "uuid": "a23560d7-c3c7-47a8-bdc8-013d68eca9d2", "value": "T1A0656C21B2CEC737D4F3267C8D6FB659942A7D111E38945A7AE40E4C0E3A6813E2D6D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654648939, "uuid": "f3f86a06-848f-46e4-92b8-c1f2177a2ee0", "value": "ba3f74b1c1ea8ef5b9ede9dc13ddf9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654648939, "uuid": "4d0dfea6-7bf9-43d4-bec3-6af29a4df86c", "value": "24576:a80Ra7rJwVXWqZLSPZF5BQjaM+R4YENZrfrzfQkD6CJ0:at8kRKZ29+I4kDLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654648939, "uuid": "eb0fcadc-580e-4715-a2c3-e7f2a99f7a26", "value": 1437696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654648939, "uuid": "264ff801-1c21-451f-ad10-79cd805deab9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654648939, "uuid": "4804f346-7c01-491f-9eb2-76935d364b6e", "value": "9c06f77d7a0dda6a4be399e69344e0583fc854db449b9f85333261518946f910", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e91008d1-e6ff-11ec-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1654674734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674734, "uuid": "ee017067-feaf-4f44-9929-c16e15d5c749", "comment": "Malware payload (SilentBuilder)", "value": "f0dd921f72742dad1d913e6cd5429bdc", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674734, "uuid": "568cb7d3-dd83-4560-b27c-88831332f18c", "comment": "Malware payload (SilentBuilder)", "value": "9c47690af6d41f545b2f1a1b1698d9f4d69ec4e8925f1ad7856e1ab02cf909c1", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674734, "uuid": "634cf33c-6f5a-4769-8842-7af5559fac9a", "comment": "Malware payload (SilentBuilder)", "value": "15aee5edbe349c27cd09401249b5db89d4c202ff", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674734, "uuid": "f5c535e3-e34c-47c4-a88f-7887ea73de9d", "comment": "Malware payload (SilentBuilder)", "value": "2712e78ec82bd2b9034602649ea39f3e332bad92a24a31c397fcc65119efa72ceb7c2714287c16ab65ad1a438e26147c", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674734, "uuid": "4828e9df-e322-437a-8ad5-9867ee8bff15", "value": "T10B634B59B769884EE9198B3448F747D62323FD308F6F0A433259F3926FB95A05703A0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674734, "uuid": "c4afffb1-01f2-4c24-b611-7ce93d316307", "value": "1536:DhKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+J+hDcnTLiQrRTZws8EX:FKpb8rGYrMPe3q7Q0XV5xtezE8vG8UMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654674734, "uuid": "a95e8062-9e79-46f1-9c88-86e773e6de4f", "value": 72720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654674734, "uuid": "15c97de6-32ef-4486-bbdf-6135d6aea50d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674734, "uuid": "d11af622-e337-49ec-af79-169fd326238a", "value": "2022-06-08_1342.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eba6325f-e6ea-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654665719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654665719, "uuid": "05896727-c7b3-4126-af44-d7243cd57b4c", "comment": "Malware payload (Formbook)", "value": "0ced014149fa28726c41ac5f9351548f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654665719, "uuid": "340f0ea0-8d99-47ad-b41c-9ec0d4249a6d", "comment": "Malware payload (Formbook)", "value": "9cdd36e441f512cbc2bcd44c3f8344979205bc8f81d01f011d9c328ce216227d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654665719, "uuid": "1d2487ee-a095-4012-aea9-2996a0389972", "comment": "Malware payload (Formbook)", "value": "c1ed490840d5fa5a1a39bc0fbcbcce6322417465", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654665719, "uuid": "d24fc64a-b8c3-4e4d-aa00-b7603fac360b", "comment": "Malware payload (Formbook)", "value": "6b8fd101dd2671fd9c49f2ca749395ad5ed21812d778a5de123ef0662105aa7311055f1e6731b3d1a4d63a4466ba0278", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654665719, "uuid": "e2c451c2-a682-42d6-ab1d-62b3130131a9", "value": "T17A148AF36BD8C8DEDB586234F3425E1703516DEC68D6A63C1FDE7A29C530A6A60F8520", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654665719, "uuid": "0d36568a-a49d-4763-8737-3d44aa704996", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654665719, "uuid": "9b26caa0-44a6-4e48-9dfd-4243922f3c3b", "value": "768:DXzWhp6kELfs6CChd7ntnR+iEiii38n8nssGGTdjt+++Gvx/bb2exNEzAlgql33c:guS9wFO1hhwo8r2PYBU4cIsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654665719, "uuid": "f46998ca-3923-4fcf-897d-58507442f699", "value": 198656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654665719, "uuid": "6b53f338-1456-4bd1-9414-1c8e964e6d4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654665719, "uuid": "ae6f43c5-dec7-48e5-94c7-089619d99307", "value": "P-S-8622.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8525df3-e706-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1654677739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677739, "uuid": "21452d57-e94f-46e8-8d0e-44e7bf1b5cfd", "comment": "Malware payload (SnakeKeylogger)", "value": "e96961e843f30128cfefe260c3a40485", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677739, "uuid": "dfcd90d9-7ba8-4249-930b-fe4808a23ffc", "comment": "Malware payload (SnakeKeylogger)", "value": "9dc79a693fbd3bd9d9d7dd03e7597d5174a1d87fbd983c2242c9f238f732e918", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677739, "uuid": "ca72c2fe-1393-439c-990d-932c6f77e462", "comment": "Malware payload (SnakeKeylogger)", "value": "07597410cf70e07c5dfd87500001e33fa01344d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677739, "uuid": "df7fb16e-a894-41ca-90f5-a7e0d61f03d9", "comment": "Malware payload (SnakeKeylogger)", "value": "b87b338c4f376f8ab5ea07f298836185f55da6bb0a04b3e54ae4147b8b24c08f25d6b065605649c4159df81bd522710a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677739, "uuid": "02a52ec7-76bc-4917-b2a5-4b0dc6d927ab", "value": "T18D22E605B7AB0237DD610F72D56212D10BBDAB03A9A3E76FDE9041195EA23484EE0BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677739, "uuid": "dd4e8046-b2ba-4209-8335-2bf089e0d08e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677739, "uuid": "ebd8cc42-2f3b-4583-bd0d-616856e39b21", "value": "96:GXhrD7o9HstmAsyO6PhD+THEzmbbZDEzibSZift7wMKLXLG1E0HHsoEZ5MiyjsXI:6rwxR96JOHEzmBDfcG1LM5Gh50A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677739, "uuid": "130a7eed-da98-4007-a2d7-87abad2252fa", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677739, "uuid": "9368a051-191d-4195-8887-c461cd482cee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677739, "uuid": "d3ae1511-1092-42cb-8dbb-a84e232082c2", "value": "Swift Bilgilendirmeni.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37f23728-e6f5-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654670142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654670142, "uuid": "8c0eac6b-86bd-4593-a25c-c7e2c32a9add", "comment": "Malware payload (Formbook)", "value": "2859208404282d544ba2b46c4609e7b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654670142, "uuid": "17680a8c-eda6-4141-8abe-ceb1f0bef956", "comment": "Malware payload (Formbook)", "value": "9e6168b2963d8a01b080552dcedf4260d62d0ee643cbb33d5461bd23369d12e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654670142, "uuid": "88d45625-f745-40c4-9e37-7ddd5c97ddd7", "comment": "Malware payload (Formbook)", "value": "1354f7e073d64a722b4d3cb6f7e2bd41c743f0c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654670142, "uuid": "3aba4507-eafd-45f1-b53b-86a0f4c5aba0", "comment": "Malware payload (Formbook)", "value": "377d141755b7469e5e24d6b02f7fd59e297ba60089ee3fc2d3dbcd86f6dca9f2a4fe86f864973d7170788f6c3e94829b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654670142, "uuid": "0f733168-2a0f-4e66-8be6-60de30dc446d", "value": "T110D4122837FD0BA3C67D2BF9886901404775EB2F4A4BF34D4E81A4EB0F22F848566657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654670142, "uuid": "6e7988a1-2f23-425f-bc1a-5f600ee79d48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654670142, "uuid": "593e74ea-a771-48bc-b31c-777832dafe74", "value": "12288:RR9crE0vCcJiPUkxeng+/l7FJU0qoAGLqT8SoAcebo9q:qQ0KcJiPUkcgahJUdWLuoDebo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654670142, "uuid": "044a5500-acc2-4f90-966c-877e59ec5d98", "value": 645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654670142, "uuid": "4478e4ef-4756-4c7b-a0ad-9815b1c189ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654670142, "uuid": "4c390866-e9d8-4ab2-811c-d85dd750d582", "value": "SecuriteInfo.com.W32.AIDetectNet.01.24041.21930", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c4bc1c-e77e-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654728946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728946, "uuid": "ed344b9e-2446-4a51-b4ad-c7ceeb0ff89d", "comment": "Malware payload", "value": "c6dc2b99c92bb9be6985e61c204df780", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728946, "uuid": "ce721c43-f0cd-41c9-b62c-36d7d9c43b51", "comment": "Malware payload", "value": "a0346659004b517cc8d1b9e59f24c9a7fdbcff0d4f0b9e49f686fa8de1697f2b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728946, "uuid": "42eba348-d6aa-4030-a2a6-ddf834d322e5", "comment": "Malware payload", "value": "9cf7829fd11724ec0cbc9045667641116e06dec0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654728946, "uuid": "bf40a601-f134-4022-a5bc-8bd6f2263ab4", "comment": "Malware payload", "value": "edcdafc923b1ce204e66e656b50bec9a578e4115723ced1cea45d2deb96f7f15a8088f243f1473b9844e1631e20a9ac7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654728946, "uuid": "e4fee6c6-f979-472d-a8b1-b36713bdfaa6", "value": "T146E2BF07F7E88B35E5B51B711DB313410BB4B4678C23E76FA888654E6E223A409D27F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654728946, "uuid": "783495db-15e3-40f4-bad7-8a8209a115d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654728946, "uuid": "c2d852e5-67c6-4b33-a468-df9758ddeffc", "value": "768:pstiNjix0GF9Nf7oSFYwQTXvLWRgcL0ST8iNxy2u:peiNjixhf97gWRgcL9HNxvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654728946, "uuid": "9b861f99-2fba-4354-a62b-682d7be2a6dd", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654728946, "uuid": "f702c1d0-37b4-48be-9f3a-275ab1466227", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654728946, "uuid": "16de4c98-1502-444e-b76f-483d97addccb", "value": "c6dc2b99c92bb9be6985e61c204df780", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acaf2cbe-e720-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1654688806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654688806, "uuid": "0a75c192-f7ae-415f-b3eb-fa11b1e7204a", "comment": "Malware payload (GuLoader)", "value": "65ac9ad9688f29c008ccf1d620ff2644", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654688806, "uuid": "a235089d-029e-431b-9068-645165fb30e8", "comment": "Malware payload (GuLoader)", "value": "a0849dcda8553ed70f6de0cb329622ff88e217d744455cf78285ed6a9434d19c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654688806, "uuid": "18e16a6a-6177-4d7a-88c1-ccfa37caf9ea", "comment": "Malware payload (GuLoader)", "value": "acc7c0a26495c27bb797e7e69f96c94494ec579c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654688806, "uuid": "7c0829a0-02a2-4914-a74d-df9e3eeaea54", "comment": "Malware payload (GuLoader)", "value": "98e4fd7acf0d68fc748a30bf0b8346cc5aa6711faad8cf6170916d28f1491cda27031c1431f87eb9252587e6127e2f35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654688806, "uuid": "1f749cff-3a61-4be7-84f4-21f3941a9801", "value": "T1AA44E06867A4CA27D4D318746A75F8AEE5F4FC215866C45373223B1EF63CA42EA0D313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654688806, "uuid": "5c04286f-10eb-411c-8f9c-92d5f279d427", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654688806, "uuid": "9ad32269-9c35-4fbb-a364-11672c8f44ad", "value": "6144:yYa6lE5sZUkn5jXZKgp8t8SM+eiQLNNl+:yYnEUUmNJnp8XelNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654688806, "uuid": "c4c3a18b-1bbb-4894-aa59-29bbe3e2e6df", "value": 274491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654688806, "uuid": "57b82297-59d4-4d4c-a9fd-73032866ce16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654688806, "uuid": "357bcbe2-b25b-485d-89b7-957a7273589f", "value": "ENQ T1214778-08 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4ed3c60-e70b-11ec-93bb-42010a9c0043", "comment": "Malware payload (NetWire)", "timestamp": 1654679800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679800, "uuid": "0c9058ef-278c-4488-92c7-91cc59fe90a2", "comment": "Malware payload (NetWire)", "value": "883415b5c38501b0a86c1f1644d9de6b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679800, "uuid": "a5c22332-6d4a-43f8-8c9f-1551a5439e97", "comment": "Malware payload (NetWire)", "value": "a10b62cee82e9ef618dc5b4f1d391fea31b92d472ae43f20b0c52964df103ced", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679800, "uuid": "60ca3f06-4a6f-4839-a639-3048c9d09be3", "comment": "Malware payload (NetWire)", "value": "457108e7e8f74f8028293791d9d38df95fc9686a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679800, "uuid": "4c14b2e9-48f1-40bb-b1f5-d6fdfee7a5d0", "comment": "Malware payload (NetWire)", "value": "025c9c072e0f2bcfd078b235dfa6dff911f81b0335fea1685a261a217a89a070426df7e0e4053976faf74cd40508de75", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679800, "uuid": "1922a319-6e58-4f79-9987-8990b777bab4", "value": "T10B5463A4645F09B2E3059D1E2A64F1406DBAFEBB30D1447123AFE174CF6AAF6CEC8550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679800, "uuid": "1f19e741-c04b-48ad-87df-f4fe980e2fd5", "value": "1536:iAs8m3NbEtalaJ6j1Dv7TIrOorlToBo7Vr69DB9ZdzFz76mAg5eeVhMDw5wfLc:iAqSLfrlTidzFtr5RDAw5wfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654679800, "uuid": "35b3d326-a629-414e-9f84-2c49f4c817ad", "value": 283075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654679800, "uuid": "23531222-3ffc-4c6d-a339-659e0bb8b39d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679800, "uuid": "21898f23-7ccd-4347-b1e3-65898da4fe00", "value": "Proof of Payment.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9431cd0-e6d1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654654897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654897, "uuid": "5d6dbbf5-0207-489a-ba2d-b313a4622065", "comment": "Malware payload (Heodo)", "value": "2eca2d6e501f356db86916b0a7f68c16", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654897, "uuid": "ff14462f-d72d-47c3-b0b5-a3c765f36592", "comment": "Malware payload (Heodo)", "value": "a1bcb834e4f34560b5de13ef46f03a829d578978485f0bf8299163eb721926af", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654897, "uuid": "068c7e39-a7e6-43c3-a92d-18818dc67dd7", "comment": "Malware payload (Heodo)", "value": "5130eb22ad1e29d7e78d963a148dbd9529db9c1e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654897, "uuid": "d4a2224d-421c-4ae0-9977-776ab6edf442", "comment": "Malware payload (Heodo)", "value": "1961ce91da3d02ea679cafa69d2e603f09b2d46fcace9646c5c0bb3521d266f4b0687c034691a6e0d89ccdaa02781c09", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654897, "uuid": "efb16fad-0acf-4f11-9905-61114f41d202", "value": "T17204023EE5031A98C22ED8FC58EE6DF9D5F634006268063A1BA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654897, "uuid": "5f3da541-39e3-4c0f-8696-6f0e0a321daa", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654897, "uuid": "100287ca-23bd-42cc-8803-f048ef093b27", "value": "3072:Vpjft9Fs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VRDi1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654654897, "uuid": "0fe65d70-5fab-435c-989b-84eaf7275716", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654654897, "uuid": "565afa92-8483-40f4-a279-5687b6e95a43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654897, "uuid": "0755a0e7-baf9-4151-a29c-57118333906b", "value": "2eca2d6e501f356db86916b0a7f68c16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c21fd2-e720-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1654688710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654688710, "uuid": "5a696378-a32c-4af0-ac81-6f85fb257d49", "comment": "Malware payload (GuLoader)", "value": "89e22de9815e0d520c75a5b3982d1ad9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654688710, "uuid": "8dfc34a8-667b-42e3-8fdf-da1ac4e8556d", "comment": "Malware payload (GuLoader)", "value": "a2b7f488ba3cf6e7eb873a46893a72875a9a26926b487f0896904a9f701d2885", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654688710, "uuid": "87118c29-3a33-459d-9e31-99b39e50c6db", "comment": "Malware payload (GuLoader)", "value": "6f20cf4df3361b40a4c363301421d1482ddb18ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654688710, "uuid": "977d4795-e3de-4ed3-808b-5a82ae6e8a97", "comment": "Malware payload (GuLoader)", "value": "74fbeb3ee9f6742909555099a35ba3cba0dd43ec1fcac405e71dec3f6241e9e35c2f329f869b9e78b82bb7fdd5c26819", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654688710, "uuid": "f80af17b-fc0c-4d2c-b8ea-48922cd713b6", "value": "T1D544E1299794C927D8D30D349A31A55EA8F4FD125C6A8A5373213F2DF63D283DB1A323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654688710, "uuid": "440de6ac-e995-4292-8d99-29732054ad78", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654688710, "uuid": "d23f0f10-b3b5-448e-bcb9-9d18e3f998d7", "value": "6144:yYa6lE5sZUknB03Q7+lOW4e+z96JQJH49O0YwYhT2q:yYnEUUmBoi+4pooH49O0Cd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654688710, "uuid": "62fe328f-fb8e-44ba-8998-876928b7ecb7", "value": 263650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654688710, "uuid": "3f5dbb9b-f0a6-4347-b1bb-74f6b12b7247", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654688710, "uuid": "cde9ef4c-084b-47dd-a0a7-7a3ed5081abd", "value": "SAMPLE IMG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5372c6a4-e6fd-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654673624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673624, "uuid": "039ca50c-4707-450c-97d4-cea9fea4ec56", "comment": "Malware payload (AgentTesla)", "value": "534faea775ca056ba1335980938c5fab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673624, "uuid": "2abd1069-d33f-4360-9dc2-191eab70ad58", "comment": "Malware payload (AgentTesla)", "value": "a40edc7cd33020f9e1b599da3356fdebecd7ddcf26081aa028d42873ea882916", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673624, "uuid": "35f4532f-95e5-4abd-8b79-b689996d8904", "comment": "Malware payload (AgentTesla)", "value": "0f3ab74a079b6ba92e7e15d79271b90d849982c2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673624, "uuid": "9f72a8fc-3b2f-42ed-9f91-1580b04f88c8", "comment": "Malware payload (AgentTesla)", "value": "b3f4ff346da5cd90ce69a675b100775b2d039d324775f405a9363472682c4437fd7ce20698aaa99310020411a852bc71", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673624, "uuid": "4e84467b-6b90-4933-83f4-dfc0885ee17c", "value": "T14BE4122477FC0BA2E5BE57FE5469004043B9963A241FF71D898230EE4E7ABC4C965B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673624, "uuid": "50fc6557-6427-4925-9a84-084e8013859f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673624, "uuid": "5ba0e16b-4aeb-4e7b-9638-5c3c4cf684a5", "value": "12288:hV3bSQiSdSyCKIJYQPtCs5gDl7oslQ90ua92a9jAmp8bo9q:LSQjSNSQIs5gosoA9F8bo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654673624, "uuid": "d20d10ee-e27e-4bc4-8317-d10c8e8a9d9a", "value": 685568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654673624, "uuid": "194eadc6-9e65-460f-9f31-4e89107d1fd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673624, "uuid": "c8baf64b-891d-4310-9990-553f9b5a1e83", "value": "SecuriteInfo.com.W32.AIDetectNet.01.14659.3243", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b10afab5-e76f-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654722743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722743, "uuid": "3f409527-61f2-4e01-ab64-c0ea72b94870", "comment": "Malware payload", "value": "bf2d860e37cd1a2564b2822e88467ce9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722743, "uuid": "c4f2a4f6-342e-44c1-99f8-49b3fdd2c03e", "comment": "Malware payload", "value": "a416b74d9edcb7c30d65dddefc0deddf21c30fd40fb4873854b74158c794e8f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722743, "uuid": "cffcf244-b2b0-4102-b15e-d919790fcdc5", "comment": "Malware payload", "value": "c7a2d268cd18f384a59c6bb44b35b95f96bb27bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722743, "uuid": "67c50091-1f03-47d3-95e6-96615fbac647", "comment": "Malware payload", "value": "a14501a261f4e9e432e0e069f35b069432a0b0541224be42e23a34ed38a1117c950969535af7d5524b17eb3cd9fd97fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722743, "uuid": "ab28c106-11ae-4672-b47a-d64c579dd1f2", "value": "T1C8051947E77341FCC96BC97483A6A732B930785841397E2E4F84DB226F61F20952EB64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722743, "uuid": "c3207304-b714-4eb1-9c6a-f541ef9aeeda", "value": "733e4ccf9ef47c6e471d93270b5eb898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722743, "uuid": "7a7ebb5e-5e88-426e-a88e-505d59570ffc", "value": "6144:Jb5xjIShSnbDu6ee0WU3LdUsypcNfAsubd5x991A6HUPV2m7rlb4rZxcg47wsuIO:JdNIShSnbfaLdUsypcRPub0+mHlY9uA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654722743, "uuid": "084c9b10-f048-428c-b6db-7aaffea08421", "value": 845824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654722743, "uuid": "a1cd42c1-e7bc-40be-8fe1-2c4d898dea1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722743, "uuid": "90104971-dc9d-4479-bd5e-80fe24dfbbc2", "value": "bf2d860e37cd1a2564b2822e88467ce9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df21d96-e776-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654725610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725610, "uuid": "6f53abd4-6f64-4d76-9eeb-8325184759b7", "comment": "Malware payload", "value": "e461b8ffffb8af5369d73490a3472a4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725610, "uuid": "41cd2f4b-11d5-4d57-8b82-5f51446f502a", "comment": "Malware payload", "value": "a48054e22d7c1f3f464e5b8f1f5d36b660737d37215f7c927a753be13434624d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725610, "uuid": "c430db56-f53a-4ef2-bf4c-d5d8ff2d6819", "comment": "Malware payload", "value": "4ead454170a45da6dbba61ad10afcd639ddc4b9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725610, "uuid": "2afeff9a-51d7-442e-824f-f0d53f51a0ec", "comment": "Malware payload", "value": "91c619862526a9de8cdd53a1a7b1e7076bd0dc02bd24fd73e6d07d91a6d29cb20193c3ab3b0083bee044ab4eab897508", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654725610, "uuid": "0306f01c-fcd1-4bb5-b6a3-097b536ee515", "value": "T19F051947E77341FCC96BC97483A6A732B930785841397E2E4F84DB226F61F20952EB64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654725610, "uuid": "cade5f85-e963-4c83-ad84-0c933269914d", "value": "733e4ccf9ef47c6e471d93270b5eb898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654725610, "uuid": "8080be7e-ae8a-45d9-9eb7-f0f956d0f345", "value": "6144:Jb5xjIShSnbDu6ee0WU3LdUsypcNfAsubd5x991A6oUPV2m7rlb4rZxcg47wsuIO:JdNIShSnbfaLdUsypcRPub05mHlY9uA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654725610, "uuid": "a8e374bc-1c47-40fe-a1c5-3451d20ccf3b", "value": 845824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654725610, "uuid": "7c54bfd3-695d-4077-9ec2-22e59bc1b8a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654725610, "uuid": "8c527fd8-fd6f-48ac-9997-f948a95e908e", "value": "e461b8ffffb8af5369d73490a3472a4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e78754a5-e706-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1654677738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677738, "uuid": "fde82778-85e1-4db5-b22b-8ff2355b0d58", "comment": "Malware payload (SnakeKeylogger)", "value": "4c01b7dc338766db49124a65f852197a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677738, "uuid": "3e5165df-a7d9-4378-aead-472e12c15a50", "comment": "Malware payload (SnakeKeylogger)", "value": "a4a929e03d9ad6d0894ca069d45c8f534a26e4b7b5116514d71bfc1522c4dce2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677738, "uuid": "44f4d1c7-e3a8-4b9b-802a-7dd3d7d05da3", "comment": "Malware payload (SnakeKeylogger)", "value": "6e61ce36aa1c4f3010992af156a865ccc0a31c5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677738, "uuid": "915a13d5-7a21-4e61-9198-f30af6bc82c9", "comment": "Malware payload (SnakeKeylogger)", "value": "2f1ca002e43ab15d2942ff84353114a4d48784ae6904ee7fe09f3e649e1e05957d58959b81e4f25d5f7871df014d1b71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677738, "uuid": "80ff6da3-e49f-4119-8daa-80de3e2c6847", "value": "T14AE401D17E3CBB12D9AE57F4312298BC13B36D6E7621D75D8DA3F8CA6479B4001028A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677738, "uuid": "3bdd06c8-140d-4153-add6-ce43078d6c89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677738, "uuid": "a11ea799-9f60-4ee8-93b0-34f2e550f91f", "value": "12288:ODAjtcAaW/LWQrX2MXsN4iUljajZKrZKv1ksYMWLNtVnabXVTrcSIO0noo4v:1tNLZb2McmiU0jZKrZMGoWLBnaJ/cSxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677738, "uuid": "58772ab1-1b12-4df1-8aea-ebc6e04fc27c", "value": 693248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677738, "uuid": "7f0a7d5a-d8dc-4413-9fcd-8efe554a9a89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677738, "uuid": "63edfb56-c6e8-4a8b-b003-3ab5843fd684", "value": "4c01b7dc338766db49124a65f852197a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e6b2183-e750-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654709371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709371, "uuid": "45e98afc-ca92-422f-9e92-dff63d06a595", "comment": "Malware payload (Mirai)", "value": "b1790d631182a264b961aaa706982219", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709371, "uuid": "c28a276b-f687-43f6-96ca-3d640f867e2e", "comment": "Malware payload (Mirai)", "value": "a53dc688c4759251ab39e4a29b8002e6ab12446f73e92ecfa2ad5ba6e0116e7a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709371, "uuid": "28b5a43e-c7b7-4033-a12d-cae97c370ffc", "comment": "Malware payload (Mirai)", "value": "478b0092ef5a17bf8a72e1db09e4651d23239c8e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709371, "uuid": "02c126dc-5b83-4aed-8254-e3820277e5f0", "comment": "Malware payload (Mirai)", "value": "e620baad3a1c325533cfa40f4848105d48aaea4955a83d9edaf04412d8cf7bdff80e5e85954a4a4c21c179551bd61ce4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709371, "uuid": "90b9f0ac-b743-41a6-9c31-f599b200056a", "value": "T1D75328C5B48B46F1D803583860AFA77FDB32E5BA4070A6ADEF8A6F31D927701521634D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709371, "uuid": "0ca9fab4-3645-4dbf-837e-f9f521de792e", "value": "1536:LREnhqfrbx3pD5o2TdWoAY2pL3o268apTWxxxxxxxxxxxxxxTqxxxxxx9xxKxUX:NEn0x3N5oSg37oPloxxxxxxxxxxxxxxI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654709371, "uuid": "e3809ca0-2cc5-4307-9d74-c77e6dc61ef0", "value": 62576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654709371, "uuid": "e6db849f-45fb-4a4c-9ec7-050a22d670c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709371, "uuid": "538fc7a7-2443-4b3b-aba7-cff92356ffbc", "value": "b1790d631182a264b961aaa706982219", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115f878b-e763-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654717322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717322, "uuid": "b22865cc-a94f-41d2-9326-f4044c62ee18", "comment": "Malware payload (Mirai)", "value": "38973fd7fee55a23b773d60d4f8143c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717322, "uuid": "a19f49b7-896a-496d-afb1-f9a6cc8448d9", "comment": "Malware payload (Mirai)", "value": "a5bf03cb8670cb64000edd4562074ed52e30ed155894b2f78e286f9628b23560", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717322, "uuid": "5e572915-7829-47cf-b513-2050ee597bd9", "comment": "Malware payload (Mirai)", "value": "9995bca0fd25748af3a3635ea4115736e239ed9a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717322, "uuid": "32d845e4-15e0-43e7-b25c-8bff616f2617", "comment": "Malware payload (Mirai)", "value": "aa39c9359ad0f72c47c9d9b9ff861dcb6d16bdde6efa9b42809ba74c52fa957e52e226fdadd64a70f8e525ad1d0f7092", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717322, "uuid": "94a08c91-abc6-4c0f-928f-da8b8e4d285a", "value": "T13B834BD7F800DDBDF849D73A84934909B130E3A10A921B3273637D6BFD761A45826F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717322, "uuid": "a7ae66aa-0631-4f9a-9a8b-89e93ca9fb41", "value": "1536:jBE1FUU6nfCnD0w2LHEHsiq8twbR8tMJvnyrSv/1lLEdjLX5GjmH:jy1+nqnoH4RtgDJvnyrS3zL8imH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654717322, "uuid": "60502fd8-b59d-4b95-96fc-a9b2baf21f18", "value": 82796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654717322, "uuid": "373d3817-b938-4172-b984-35aa81b51e63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717322, "uuid": "f1b69cf5-5a50-4889-b02d-256ec9362d81", "value": "38973fd7fee55a23b773d60d4f8143c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df835211-e76f-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654722821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722821, "uuid": "01eb6210-ab13-4d84-a99e-5eaedac82a08", "comment": "Malware payload (Mirai)", "value": "0761ab3d4fbc25de66882c31eaef9c59", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722821, "uuid": "7be58673-d26a-4175-aa25-c975ff8cc6f4", "comment": "Malware payload (Mirai)", "value": "a75f031444a8ed7dbe6638626e970266888bd3a6be88a363048df3b064bed11a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722821, "uuid": "83a77394-0b03-495b-b314-82d647f621dc", "comment": "Malware payload (Mirai)", "value": "d8e7bbf0b835a980969901b5c85f2aa696fbae40", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722821, "uuid": "cbf04c2a-0bf8-4b1c-8b97-bf0ed1efe971", "comment": "Malware payload (Mirai)", "value": "a730a8f84b82d17cc2bc352518f715d5774edd879caedb7d7351c190d029def8a5a1b6bd4fd643001a9917d2a23bd55f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722821, "uuid": "8f0f8b8a-d479-42b0-86f6-c058b8d41528", "value": "T1B8539FB7C4A89D98DE255578F21088399723E008A5A73DF6EA46C656D05BEECF00C7F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722821, "uuid": "1afde86f-1533-4924-9f67-8015ce52b7fb", "value": "1536:I/xN6GOJeaUV7Y3bQIf2sOqBqX4sUEfs3C+/sMDr3d3C0K/a:IJNsYjY3bQIgqBqXlf+/Lrt37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654722821, "uuid": "f16c1a50-d90c-4352-809e-f8994c91f2f4", "value": 64344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654722821, "uuid": "2ec9b33e-8b6b-4633-ad2a-65ea2d1d7cca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722821, "uuid": "c914ff7a-827a-456b-b3e7-4e866b24f660", "value": "0761ab3d4fbc25de66882c31eaef9c59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf727b52-e706-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1654677697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677697, "uuid": "d9f57e69-5b87-4341-9e66-f167adac6f51", "comment": "Malware payload (SnakeKeylogger)", "value": "552797868cb283e601f3b809a191c49c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677697, "uuid": "23bfdfff-0645-447d-b454-db81457ebcc3", "comment": "Malware payload (SnakeKeylogger)", "value": "a801290ee9a300b09e633da58c9c8701bf007815b39f061f6232a339894741fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677697, "uuid": "68f747ed-4036-45a8-9928-3e43a12b21ff", "comment": "Malware payload (SnakeKeylogger)", "value": "3013bcc047e364d139d166e6827d9fcb96182ddd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677697, "uuid": "32995028-9a03-482a-972c-3683867a41c5", "comment": "Malware payload (SnakeKeylogger)", "value": "0e9054cd125893da744fd2e7717b1133ed1e7b85dc77f1282a473c3e827adf09e84d80460887a718eccc1883ce8695f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677697, "uuid": "861659ab-b1b3-4361-a096-d36bfa179676", "value": "T1C0155DD1F19088DAED6B0AF1AC2B953015E3BE9C54A4810C569DBB5B76F3342209FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677697, "uuid": "e05b9e6a-85cb-4a8e-8b69-d29200213ba0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677697, "uuid": "a363943f-657b-4aea-bc43-bac7506b726f", "value": "12288:zKTsIfPKzgyHJDdVGw/Nh5QRRt7LALqm8G3HP1hdZ3C2+Rbo9q:2sEKzgqSw/n5SpLWqtGXP1sJbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677697, "uuid": "60549bdd-00da-4870-a121-a69ed2f77a87", "value": 888832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677697, "uuid": "0690f2ad-b9a0-4ea1-99b3-50db6af9fec7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677697, "uuid": "73ad3f8a-716d-473c-bb9d-6b36c8a29f0c", "value": "SATIN ALMA EMR\u0130.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9233462e-e740-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654702505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702505, "uuid": "b0b70039-597d-4c8e-bf76-c355ad460585", "comment": "Malware payload (Mirai)", "value": "07d5cfa8c50f4cc69d7dbc5c98c471b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702505, "uuid": "c8cd5108-e554-4809-bfaa-7618e1902502", "comment": "Malware payload (Mirai)", "value": "a83e5d75da96559e15bde7d7d8c15fdc75f2d152e14f934889ebd1667bdf305e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702505, "uuid": "5ab20b53-2f1f-44f6-8ecf-69d8ccc90583", "comment": "Malware payload (Mirai)", "value": "cc13d7b897814efc5001935b52ea2c5b46be08f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702505, "uuid": "18e2c3b3-a438-4759-a932-2126ad8ff11f", "comment": "Malware payload (Mirai)", "value": "a1cfa52a4d925bea2b49796509fb70e0c3f9e93d1d9197f0847f86cfe58833cdf810f35f1f0f2f2d64bccfe0c1fa5f20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702505, "uuid": "f4de5faa-2fd7-4729-9af0-782c09885f7b", "value": "T116C2E00DB2A1141ACD9E1C76958E0756ED3A71E031D96B89A72D0C8CA93CF1FB94E174", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702505, "uuid": "074b5789-7f56-4a19-b518-dc417e054cc6", "value": "384:ssGn5I6st3EqycK1s3m5wywZxBqIq7dYtUoNgNPEENXdoHRWGVCz0NvJ0:Wn5ot33ye3Adcw7kUQi6xWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654702505, "uuid": "b629636b-62c2-46ea-8f7d-0ccaa176870e", "value": 26288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654702505, "uuid": "0415d84c-fda7-4dc1-9338-962a68f4ebe3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702505, "uuid": "4da896f6-248a-404a-b257-d65904c2963f", "value": "07d5cfa8c50f4cc69d7dbc5c98c471b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b75b5b9-e73b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654700293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700293, "uuid": "90196333-5a36-4587-ae7e-cb59367f7718", "comment": "Malware payload (Mirai)", "value": "61d137cd3033c7610426f3d0d06d629e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700293, "uuid": "258947cc-ac8f-46e3-b049-0024664b0035", "comment": "Malware payload (Mirai)", "value": "a8668a72deadcfee63c54f0080f8a731e2bd6a2b03f90a4e2de1c04ac9ba4090", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700293, "uuid": "91c0e845-37ac-4fe7-8567-ff1dc20dc1fe", "comment": "Malware payload (Mirai)", "value": "9ea782befeb7989c5fec7a946789415d7970abae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700293, "uuid": "7398842c-8bea-4bdf-85fa-40ac513052d2", "comment": "Malware payload (Mirai)", "value": "6fd80b72bcace94f4c8e83b255b42396985c17fd017830aa68ee6192d6d3ba9debc8d220ae09e95880f731aec076dc2f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700293, "uuid": "f1a8a0e0-2e30-4df7-a48d-aa3b0ba9afdb", "value": "T1F6430752B8925A26C6E053BAF9AE518E332073ECD2DF7217CC601B147AD641F0D63F92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700293, "uuid": "b76a6302-2587-4396-9f70-6a1f670fbc52", "value": "1536:Enoc7PlPuuTUbiQlaAo0qZSv2B8qIgH3d54PahKSGu82w:Engvv5q1HNyihhR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654700293, "uuid": "26553c76-3d04-426c-81c2-f9611c453ed9", "value": 58612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654700293, "uuid": "24c32eae-a4a6-4a55-afbf-69ef8f15f9a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700293, "uuid": "b49ae6a2-fe62-473a-a10d-5d430e939b52", "value": "61d137cd3033c7610426f3d0d06d629e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "062ffdd2-e6fd-11ec-93bb-42010a9c0043", "comment": "Malware payload (Quakbot)", "timestamp": 1654673494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673494, "uuid": "7dba0ec8-9bb6-4184-ab2b-6b20873d1417", "comment": "Malware payload (Quakbot)", "value": "b253c301dff5a895325e0b4e13c000ee", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673494, "uuid": "3a8839e7-f75c-488b-a030-e4a34e2f9c7b", "comment": "Malware payload (Quakbot)", "value": "a8e8f83493d04ac9748183114752fe851acad18a00566bd48c57d1cbe9eebb51", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673494, "uuid": "af4d97c0-a5e9-4ec4-a767-6708c7ace57a", "comment": "Malware payload (Quakbot)", "value": "9c8cc02c0410fc38a2a020e3c927e3819706d417", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673494, "uuid": "513f9a12-6b4d-4f8e-81ae-6ffdb9080fe6", "comment": "Malware payload (Quakbot)", "value": "e28e4e086c79c217c68b49bd8bbc1bde6092aaeaeca1f1d8b05d74de231acbe5a0026a5a49454ebed0c748249e516297", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673494, "uuid": "0be63655-4b34-4bde-83fd-3f76ffb4e093", "value": "T1B9656C21B2CEC737D4F3267C8D6FB659942A7D111E38945A7AE40E4C0E3A6813E2D6D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673494, "uuid": "045584f2-42da-4ded-b041-e8a149b016df", "value": "ba3f74b1c1ea8ef5b9ede9dc13ddf9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673494, "uuid": "a4a83537-4800-43a6-92f2-6d4e47973e36", "value": "24576:a80Ra7rJwVXWqZLSPZF5BQjaM+R4YENZrfrzfQuj6CJ:at8kRKZ29+I4ujLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654673494, "uuid": "fc2be029-ac5c-46e7-b91d-b529c8e68884", "value": 1449162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654673494, "uuid": "1a39e985-7ec1-4236-b36a-ea09f716bb21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673494, "uuid": "ddff3864-2b76-4214-b0e4-813082524ebe", "value": "a8e8f83493d04ac9748183114752fe851acad18a00566bd48c57d1cbe9eebb51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c69a285-e72d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654694255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654694255, "uuid": "615e4913-9519-41eb-a3d0-4f9b78d8b9fa", "comment": "Malware payload (Heodo)", "value": "ee9e447dffccf7689c302daac38989f7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654694255, "uuid": "b7afcf78-4b0d-4743-8b87-722818c19e2c", "comment": "Malware payload (Heodo)", "value": "a97a85f3b8e2b4c6b90b814374b80a13ed1d142e6f658012ccb52d83e85304f1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654694255, "uuid": "01214437-0feb-4c34-beec-251abd816db7", "comment": "Malware payload (Heodo)", "value": "afaf3e83b3d104487e637838532f4cad5e1b7c5d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654694255, "uuid": "fd2be395-03ec-4d33-898a-a675a279b83d", "comment": "Malware payload (Heodo)", "value": "52bd846d5d4214d1097ac180fde5eff3e3b919b86798625f22bb66799748a475e8df35c42f519e2d6b265a2dbbf9494d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654694255, "uuid": "246ff33e-0901-4f05-a0fb-1ff31aee5f7d", "value": "T14544C089ABE1ADDBD51407798DD6D324333EF2814B8387076B2598390F23BA4BFC5A45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654694255, "uuid": "139633f1-2538-47d6-8370-d20e9f198e89", "value": "963f2e88a5b03877d0583808b2526c1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654694255, "uuid": "0da035fc-775c-458d-847c-b495e609f78a", "value": "3072:7R7ie82w+Oh+UjuFJrfr7CS/FmikytkqroMdjaWtHCqPZ4PEx2ES2vZg3f4L5ZJi:7llJuk4uFxOmFwytLVxDtfPZ4PE2sPs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654694255, "uuid": "704a63ff-0643-4c10-bb78-c973f977d15d", "value": 270403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654694255, "uuid": "153a6989-677f-4ab1-9b6b-ace86ee08882", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654694255, "uuid": "9aecf045-30d1-443c-8ecb-db002ce07721", "value": "ee9e447dffccf7689c302daac38989f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "740bdcde-e722-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654689570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689570, "uuid": "7966a7e2-5232-4719-a330-3d3c09a67a0b", "comment": "Malware payload (AgentTesla)", "value": "a5df961d33043779bfbe15d9d00e65bc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689570, "uuid": "e76a2e0b-7f42-4c2c-9f53-403c6511fb95", "comment": "Malware payload (AgentTesla)", "value": "a99abe3b5f6f7c42d24d00d149a859df076b9cb8f7b91bd4a0c04cf8a404cc50", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689570, "uuid": "45a76fb0-e992-44c1-a99b-dd0364b09f5d", "comment": "Malware payload (AgentTesla)", "value": "2f54dc5953b0f7339c300e89b2a0bbd63de213d9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689570, "uuid": "b2072e44-043b-4395-9b00-88eba8678d6e", "comment": "Malware payload (AgentTesla)", "value": "cb4b8887686604bc94f1146a3932aa88b2da64368ad6a65e8c7750eaa34b8762d92e61da9585797b22ed0b4c50c76c8b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689570, "uuid": "da322ce7-3b80-4d26-a435-71d8aa7c6f21", "value": "T1D305E101A5A7CE33E29A077BC4C60618D3BB8157D597E31B321712E6AE837EEC945783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689570, "uuid": "1e1f8014-4eb0-4011-af58-5f51c4375053", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689570, "uuid": "fe41c328-628d-4439-827b-6d6feb3a9228", "value": "12288:iK0inwXwKIl8hr9qsNLly2lq/kcC+iYKVbmdlbsQvKbaK1OStBeNMy2ENi1PpQLf:b/Rahr7c2lf+ipeBsQvSOrHNkpW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654689570, "uuid": "603515e2-5002-4d5f-8526-06463adcf39d", "value": 812032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654689570, "uuid": "19659680-5e2d-4979-9a29-503ea1c979ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689570, "uuid": "37b44926-35cc-4b2b-897d-618c33af9bd5", "value": "SecuriteInfo.com.W32.AIDetectNet.01.9904.14910", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52887ae8-e705-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654677058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677058, "uuid": "60994a7c-535f-415a-bdbf-f2140ddb0328", "comment": "Malware payload (Heodo)", "value": "8201e35f39e69f3de0fa722460ae433a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677058, "uuid": "33c98d6a-6877-4162-a7f0-2d71d9bcc8c9", "comment": "Malware payload (Heodo)", "value": "aaa9108f118220f7a860274a4d0ba4b00e0c58643f2a3eed78024701931fdc1c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677058, "uuid": "3356cd21-e33d-4b2e-9b9c-962fb8b85e42", "comment": "Malware payload (Heodo)", "value": "c6232f96a75a40d0260dd9f78893aaedd1f959d2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677058, "uuid": "81357305-56f1-45fb-8430-3529a7ef5d44", "comment": "Malware payload (Heodo)", "value": "b83f3168f118d8bf33d4c5a8c0fd8deb2fcedb4788591f8d79f5ba46c658947ee3247c0b49d0b4e604f460651dd66061", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677058, "uuid": "1c3042bd-1510-4d08-8d4a-eec83a8d9020", "value": "T19744C0C5A791ECDBD92503790DE68364233DF2806BC74B033AB59A360E73B646FD5688", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677058, "uuid": "cf92bfc9-8161-46d1-b4bb-9aa98b4c4926", "value": "963f2e88a5b03877d0583808b2526c1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677058, "uuid": "bc2f2468-29d9-4258-85ef-2f51c41df248", "value": "6144:M1/yqUcchr3fdAdmG9rjcOLDNffPwz3GzMc5:MYccxfzGBcOxfHQ3GzP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677058, "uuid": "cf1b82da-c3bb-453f-bcf3-777abecb7b6c", "value": 274499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677058, "uuid": "4ce1495c-114d-48ec-a256-71d557832226", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677058, "uuid": "0a98da48-ce7e-4a88-b492-8b7cdd83f442", "value": "8201e35f39e69f3de0fa722460ae433a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be6d12ad-e6d1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654654905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654905, "uuid": "5f5e7af2-c5a6-471b-9904-49cdd0abd047", "comment": "Malware payload (Heodo)", "value": "385a575267bf37ffd3dbfff2bd97e115", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654905, "uuid": "1f50a046-6f04-4cce-9caa-0494a7a06a9a", "comment": "Malware payload (Heodo)", "value": "aab713c5a0604461bb785a07db9994f4d4f12572db59ad45d069cb0ac923b05f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654905, "uuid": "3daca879-fe10-4f3f-9724-602bb6596c37", "comment": "Malware payload (Heodo)", "value": "d77b963c0f173a70f76f424b8364eb02760247ae", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654905, "uuid": "53b6b44d-90a0-4e7b-a22a-ad3dd502490d", "comment": "Malware payload (Heodo)", "value": "98670650f6246abfc05864892fde7cb38b33f52c5bcb2f067cf6caa8849e34e553fc05df5dc01bd416686bdab41a33ed", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654905, "uuid": "58053804-b1d6-49ae-9681-02a6c9ec2125", "value": "T1B204023EE5031A98C22ED8FC58EE6DF9D5F634006268063A1BA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654905, "uuid": "27762c0d-167b-4dec-a8d1-93296a42806c", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654905, "uuid": "756dcefa-93e2-4d97-82c9-34371d0ba1c5", "value": "3072:VpjftDFs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VRRi1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654654905, "uuid": "764d6ce2-3a5f-4f2f-8361-f97ca5ca8f60", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654654905, "uuid": "6773c193-b8c0-4997-a6e1-ce5855d8f02e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654905, "uuid": "bcbeefa9-ccb2-4265-a256-2c319bf6d786", "value": "385a575267bf37ffd3dbfff2bd97e115", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "027b7218-e740-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654702264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702264, "uuid": "4df6f75c-db6b-44bd-9a90-37c71ea56413", "comment": "Malware payload (Formbook)", "value": "3edd64918354fee2f5344e2e06185b81", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702264, "uuid": "2872e3e5-bf99-443b-9214-19556294c9da", "comment": "Malware payload (Formbook)", "value": "ab71ed12f07041f90618ac4b0217cf77a0e1dea6dc4d8a8a00d89b1b638f9d42", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702264, "uuid": "8b195f7f-1bc8-4b35-9c1d-5bd481426fb8", "comment": "Malware payload (Formbook)", "value": "4f3714c4d54a552acb5245baf4900f50c38f5671", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702264, "uuid": "34551ab3-bc65-4da0-bb46-78045d7c6213", "comment": "Malware payload (Formbook)", "value": "2960ec74405cfeb85a8e4acfb54fed89f2d6b16e0032e017740e126260affdb03035fd9111d94998d50053749bcd24e4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702264, "uuid": "82ad2b79-f71c-4a17-a119-827978696479", "value": "T1A7842241759C8303EEABACF84334324723A2EFF447FDA56DDF9A72096970604B626257", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702264, "uuid": "6f5f210b-beda-4457-a7e2-3fd551acdc81", "value": "6144:p7SWE4MQYHP8TLDeslIXdYXPdxLaB8P2P5seVguHKNZ9apumLFmdu87PwU0gQjbw:44MQYHse1udxq8PAL6uKNZ9suCmdlT+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654702264, "uuid": "fd6569c9-0a73-4e48-a775-838a2bed581b", "value": 388920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654702264, "uuid": "452f993d-3118-405e-9b81-60866fbaac36", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702264, "uuid": "081df98e-8ef5-4845-abce-e73535019212", "value": "NS ORD 22.161.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e47227e3-e71e-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654688040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654688040, "uuid": "44ed9272-aa0a-4468-9246-254c9b0f46d3", "comment": "Malware payload", "value": "2f590e50a6b7881633ae48e404295e92", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654688040, "uuid": "24024595-3c4f-4718-92d6-f46c240f3452", "comment": "Malware payload", "value": "ad63ddae6520f3c4ad0c9067e6ae55e9418560429470b3b7fbbb79de9a911d78", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654688040, "uuid": "ffd64b7d-8ffb-458c-901e-4dc6f4ebaae3", "comment": "Malware payload", "value": "4fada9c41b773e5e8bfdebf25da2e6313455bb2b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654688040, "uuid": "01968f8a-8625-4980-b33d-0756a2ac7000", "comment": "Malware payload", "value": "459411c04739f01c447191e912d6921639529c8e884d4dd4f47c47187327fe83ce75019da8d5a6f3720dfda136029aeb", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654688040, "uuid": "a0f54522-75bd-40c9-bcae-d48553902986", "value": "T1C6227E3A812E3D70DD6B9774F1616E95E84C04CBF6973E64B01DAAB349C37CC5235A50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654688040, "uuid": "c5574edf-34e6-4af9-8125-4d31f35f4635", "value": "192:yEhM6cUUCf4Ghey9264wp1gb8g7Z/c+8poF1d3jvvtlGLTWrGxjPoy:yqBczCf4GAy92hwcbdcfa7pr1lGLKyxh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654688040, "uuid": "210ec0a8-6381-4819-968c-9cdfbc34d7f4", "value": 10698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654688040, "uuid": "508febb3-dbf4-4a77-bf05-804fa0f9a82f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654688040, "uuid": "c07b9024-5722-4f6b-b567-c664e064db96", "value": "follina.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ed3a8c7-e717-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654684756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654684756, "uuid": "43aea448-b89b-4e75-9279-7a1de03d0d70", "comment": "Malware payload (Formbook)", "value": "c4723c42ca06345730bde94eb5a237a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654684756, "uuid": "17cd2f9a-948e-4afd-9a32-74bb797ac7fb", "comment": "Malware payload (Formbook)", "value": "ad8661c97d7e3f447f757f0aa1976a82d1ce1397d557d3082156cacd5edc176d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654684756, "uuid": "333dfb43-7f41-4177-8d78-e79da0c4976b", "comment": "Malware payload (Formbook)", "value": "6357f022323dee392eda165597cd411b263e9494", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654684756, "uuid": "02eda0f4-8255-4646-97c1-7a8fea007a89", "comment": "Malware payload (Formbook)", "value": "1b1b9ef6b384bf1c623ffff8e0b154c9293299b5e015a43cb11f82ae2890a1e4e026d5f7179b84ca08ab3402d3d71f5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654684756, "uuid": "0ef7d9c2-ae39-41a8-8eca-7c48d2d70fc0", "value": "T10B241242B6DC4DE3E06685350D35BB79F7EB936611424E8B07180FFBBE6188A8D173A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654684756, "uuid": "fd2a2510-1af6-47d7-992c-2fb538476801", "value": "dd1742eadfc6df18ded3c26ae64ad610", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654684756, "uuid": "222d118d-c50b-4802-95b3-145463a18f89", "value": "6144:Fbcbo+Y3xRXvfRFoT/IE99vlnPcmopiV643:4oxRfHoT/IErNPcmX643", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654684756, "uuid": "4897f628-d469-483d-bbfd-ab95faa75019", "value": 221138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654684756, "uuid": "666e2f60-50bc-464a-86c1-adaf81fd0c3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654684756, "uuid": "097b7b66-3f09-41bc-9337-573e1603cef5", "value": "SecuriteInfo.com.Variant.Tedy.137414.25339.13319", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f41aabf6-e6cb-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654652418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652418, "uuid": "1c0f19e5-c9d4-40aa-8521-591914d23b39", "comment": "Malware payload (Heodo)", "value": "1d89dd82ed4975bb211c2e5046d51f0b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652418, "uuid": "e2f06bfa-e780-4a8b-9317-0adbe98a9424", "comment": "Malware payload (Heodo)", "value": "ade5b26841b78e679c9426aafda30776a2cfd03dbdfc4ce5dc2f5faf183a196a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652418, "uuid": "8684ddda-1730-45b3-ad1b-283aae98f747", "comment": "Malware payload (Heodo)", "value": "ce080adcd7435e95fcbb9a39ab12ce83e6c41923", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652418, "uuid": "360cb471-870b-4240-8788-f1862cfedf0d", "comment": "Malware payload (Heodo)", "value": "97f09e42395e2075992344970bae1e9df1e1f1d6ff2afb56832d4760e1a1d36cfea7c06d79087a957bb60e7caa81bc1c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652418, "uuid": "21124ba9-2907-4bcb-86ae-32a4036273d4", "value": "T15004026DD14C06DDD611137CACE90F3392FCF980A0262B5BBB70A6774BA4B96DB5B900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652418, "uuid": "1ba5e4c8-966b-449c-b212-1bc6926cca21", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652418, "uuid": "a61637c9-7d60-4117-9d0d-99734b16e081", "value": "3072:rpjfuFcO4J8FYMh1PAzu8GmeR8dk5pL/rRn/02QBgjVcoe5Uy5i6zNL4ZNgzPKcQ:rRmWW6u8QKkXzN/09gjV/eey5/NsAziz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654652418, "uuid": "7ab128df-7f2a-423a-a6cf-83100ad69cd5", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654652418, "uuid": "b0c97d6d-15aa-432c-9d1b-79e1eef3ee58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652418, "uuid": "4b7710e8-b335-49ff-84b0-d29222da6cb2", "value": "1d89dd82ed4975bb211c2e5046d51f0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bebe4a84-e705-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1654677240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677240, "uuid": "95758de9-e52e-42b3-9b48-971ac388e686", "comment": "Malware payload (SnakeKeylogger)", "value": "13e317a17ba04c4ea01f36b837f0a900", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677240, "uuid": "a3fd6922-0e39-42a8-90a7-717cd7ce9d48", "comment": "Malware payload (SnakeKeylogger)", "value": "aee0f8e056c16faba62a6203378c57201a9b6e6c79cf862670b5c1d31b19e294", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677240, "uuid": "bb90d4f6-659c-4d41-96d4-14f6a01c1865", "comment": "Malware payload (SnakeKeylogger)", "value": "2aef186c1f2b4b406201f080f77f0885f2fc1546", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677240, "uuid": "f26243ab-fcd5-4e40-8242-c581ee6d26f2", "comment": "Malware payload (SnakeKeylogger)", "value": "34113a3636d8b044ebc04c51396cd9eb9ef38f2f70f4e0634d7e793e5ccd20e6a0f1bc0266ad688513063280f797ee33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677240, "uuid": "41aef941-73d6-438c-9b50-d4955514f25a", "value": "T128D4D03037EA1258C87A5BB10C7191C517BA3A7B7F04C76D285A165C9C73B538B22BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677240, "uuid": "14373edb-5523-4664-812a-9bbc1927a4ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677240, "uuid": "8088af03-c764-4b6a-af8f-e3ecdca2804a", "value": "12288:81CTRvbBynCJHnB5YCVSXUt3Dtdy56OOTDTCDdpbS:8Q1vlynmB5YTkt3G5UD+Hb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677240, "uuid": "3e754bb1-1055-4a72-a17f-61e3ff5563bb", "value": 640512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677240, "uuid": "5f1ccd48-ecb3-41e6-8739-8d60f408f630", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677240, "uuid": "907cb38e-1886-4325-b143-6fc4bd8097e8", "value": "Payment Copy.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "913c4788-e768-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654719684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719684, "uuid": "135812cd-6e19-4d03-b82c-0f5c6fae4d9e", "comment": "Malware payload", "value": "14f8862e9352fd3c9e33fada7e98bcfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719684, "uuid": "85573b85-0260-47cb-87e4-8209966207e5", "comment": "Malware payload", "value": "aeef7b73f75862aecc253f97b5e1b6cf8bee87d50c9d83d25799d8b4b9241ad7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719684, "uuid": "dd53ccf5-c6fc-465b-af8f-8ba6b22341f2", "comment": "Malware payload", "value": "9086681de06952340fad01d7f4a8ce6b3ef59969", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719684, "uuid": "98463cc3-6de0-42e1-a44b-0f620a4dd7f2", "comment": "Malware payload", "value": "99199c35cbb18f122dd79351162959f29ac0f16563a8528db0809d6a6740a3901488902619489013f45e26c8c5cc60ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654719684, "uuid": "d3cee694-de87-4929-a37f-721ff705d2ed", "value": "T15A051947E77345FCC96BC97482A6A732B930785841397E2E4F80DB226F65F20953EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654719684, "uuid": "f42cd522-044a-482f-834e-7e8e025c11aa", "value": "733e4ccf9ef47c6e471d93270b5eb898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654719684, "uuid": "fcf87e85-7bc9-44f1-9f17-067dfdc4c4c9", "value": "6144:v7rc6Wk6SYnaKOai5uWLwrd0jSjc0vNPqBVzLFWMWUPV2m7hzS7583Tg7A+++ncE:vXcFk6SYna2Frd0jSjcc9SMmBZX0TMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654719684, "uuid": "1e454336-6d5d-4a4a-a018-c0c8e79e31c2", "value": 841728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654719684, "uuid": "c3ce1a27-97fc-4675-b400-63998af72df3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654719684, "uuid": "91e5b59a-1bb5-46dd-8669-3d898eeacf23", "value": "14f8862e9352fd3c9e33fada7e98bcfc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82c43d95-e750-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654709351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709351, "uuid": "d1d15c78-2d96-487f-8aa3-a9e2d069ea34", "comment": "Malware payload (Mirai)", "value": "23a4ff54dc616c8eeddb4f6ddc4cf32c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709351, "uuid": "8ca730a6-0b41-43f1-a87b-2b8a06a14dd4", "comment": "Malware payload (Mirai)", "value": "af6ac1c3e0a3ee8df923562ac44815199f672180ef324bf4db257f01c636634f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709351, "uuid": "9f19677c-79d6-4f48-a587-4615ecc25419", "comment": "Malware payload (Mirai)", "value": "9dc0b0f322434dedf26ec05bab1ddb223544dc9d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709351, "uuid": "9388332a-8722-4e9b-a550-5fcea2133782", "comment": "Malware payload (Mirai)", "value": "3f55a647c23e4933c0cc4496a6e03f5fe59259a74642ce7c0f76644849a63a5c2ac590abc9bf91fc9a80473ebb8ee8e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709351, "uuid": "06f20cdd-03b5-4a40-b001-aa5258755d60", "value": "T13A434BC4E297E9F1DC11293831ABDF724E33E93E2425FDD6E39DA637A941702910226D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709351, "uuid": "ada00a4f-30ba-4430-9c62-d449f215e4f0", "value": "768:53Zkl9Wx5pgMF0bEGb5r8ihwn+cAH9bmQPrC2rYkdkAag+0IJp2EbmnMTfD:5JPXgMGv5r8AWoHhr1dag0Jp2GmnMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654709351, "uuid": "dd25c800-a9fa-4584-ae0a-2dd49911ad2b", "value": 58128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654709351, "uuid": "b8c67849-f9e7-4776-bc5e-f96dadfaed75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709351, "uuid": "c48dd90b-c6b8-4373-956b-2962db4df1bc", "value": "23a4ff54dc616c8eeddb4f6ddc4cf32c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d469ffd9-e708-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654678565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654678565, "uuid": "8b5bf8fa-97f4-466a-bcda-ebf91ed99800", "comment": "Malware payload (RedLineStealer)", "value": "b630303cf89e9808a969df1d351c94fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654678565, "uuid": "05fa1dc6-5731-4c2f-bbc6-5bf48b750361", "comment": "Malware payload (RedLineStealer)", "value": "af6d05f2275f3eed906794351188f5ba95a4dd0ef17cf11f74cd74ce9f9b5f5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654678565, "uuid": "48ecccd3-6f35-4d49-a4f9-df6f263acc9b", "comment": "Malware payload (RedLineStealer)", "value": "40dc338329f5f22b26ec8699b9aaab08eca9019d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654678565, "uuid": "b0460c95-a4e1-4294-a532-96fbb2112fa9", "comment": "Malware payload (RedLineStealer)", "value": "030c624c42bda424c6a57cfc82c712b9d2d55e1ae57f92f8f3f8e8d2d385ff8c4c2e34b4c48cf7879d1b55b0db8281c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654678565, "uuid": "78152af7-b925-4c9e-a312-534e8aa49a89", "value": "T1B9449E14BB90C031F5B712F449B993A8B93ABEB19B2494CB92D51BED56346E1EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654678565, "uuid": "8c80bedc-34da-4ccb-939c-861954a27dad", "value": "3215fae786e72310b15953e12ddd6b57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654678565, "uuid": "6d01742a-ae3d-4271-8505-5d33638cf9f0", "value": "6144:KT+IVgdCMm22JWPagIrqMEybgmslorrxGp8580UM:KTDE8JWSBrqMEv7ora858", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654678565, "uuid": "1b8d2a75-2302-498f-8baf-616333e0c898", "value": 271872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654678565, "uuid": "2dc10dda-079b-4376-883c-8849be05f4b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654678565, "uuid": "8b1b94f4-d963-4294-a8d0-e44aad14edf4", "value": "b630303cf89e9808a969df1d351c94fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa47f98c-e72a-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1654693097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654693097, "uuid": "b3790aa6-48cc-4a1c-8c49-64874c8ed1c3", "comment": "Malware payload (GuLoader)", "value": "a4bf1774c9a45d99d288b114057a09b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654693097, "uuid": "8123905a-c713-447c-9420-c42b28f41c16", "comment": "Malware payload (GuLoader)", "value": "afc5450de743df54ed7fb676f14c89559d2202700de4fa44d75784409b1e238f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654693097, "uuid": "d9f6655c-49a9-4b7a-b1ac-11ef22f66897", "comment": "Malware payload (GuLoader)", "value": "f44d9e522e0d1bd6bc3bc12bae8590ad98f87ea1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654693097, "uuid": "59615ebc-4e87-4000-8c0b-e9bfeaca2a5b", "comment": "Malware payload (GuLoader)", "value": "4eb5bcc60dada9cfd034b1c438e43f10324eadb6b1b5fb117fe6bbe353902585a09f69c4de102cd90a6e79011a48a46e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654693097, "uuid": "7f3c5ee2-3eea-486e-9464-8f5b3840ba65", "value": "T1241412053BA7C477E8B256702ABE6B625EF9B6212174830F13605E4C39727C0DA1A77B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654693097, "uuid": "5038b104-07f0-4af0-9ab5-5b2fdd5d32b6", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654693097, "uuid": "c824403c-cc1a-4b70-9958-c8ec808faf5c", "value": "6144:0NeZ2pUmtDP37KjbQXplvzy8R60Ok6rAI:0N5pjJOjbQXqHyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654693097, "uuid": "31667a21-0392-4e1b-9dab-7bf1ff4b7f1f", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654693097, "uuid": "aafd064b-516e-4b6c-9153-6f0ac84a4d27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654693097, "uuid": "1861dc5a-bc9d-460d-8e50-cb3b2c35800c", "value": "second payment swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f95f4e6b-e706-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1654677768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677768, "uuid": "1d5303db-c74c-4d41-828b-f1ef93831a23", "comment": "Malware payload (SnakeKeylogger)", "value": "523d2f12cc498d996d61039d77a91664", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677768, "uuid": "6904872e-b2a1-429f-abad-158405dd8506", "comment": "Malware payload (SnakeKeylogger)", "value": "afcb3cc4c9ae4900e0ae6d6363638e92a816c46e12e830e0f11e34e71cb14651", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677768, "uuid": "48dd67c5-3e11-4ca0-b4f8-cdbecb3ffb67", "comment": "Malware payload (SnakeKeylogger)", "value": "d613833e9ca6bb4e96043c21e636fae2b8e1660c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677768, "uuid": "b62a4778-cdfe-4ae9-8732-9be6dd39b711", "comment": "Malware payload (SnakeKeylogger)", "value": "5fa59602afa521b4ce7032c78359020a2198be87a85ea6fa5d35ef241a54bee95420ad63c31fec8c0c68bc979fe404da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677768, "uuid": "c40972c2-9dee-4ed2-8b5f-1a1e5727b5cb", "value": "T127E4CF90B3BAAF71F17813F36520900807F4791E95A5E23A8ECDB0CE32A5B4259F5E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677768, "uuid": "10cec349-745c-4bb0-8dad-ac6426128077", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677768, "uuid": "bd5e27cd-f039-4b9f-978a-c3f7c2b5337b", "value": "12288:FJkIPCL09qNEJXut+6DRTaOe2o6GXiaavTSzQf0yqm:79CL0DBq2VirvTwQfOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677768, "uuid": "450d8789-3dca-4ceb-a018-4cc1bbd3b763", "value": 657920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677768, "uuid": "ede0bbc5-32cb-4764-82d6-b455ea12c301", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677768, "uuid": "d67524f5-ea71-4f86-8bf0-9f22d239aa88", "value": "HBrvLoTHWLMNBLT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f45afeb6-e6d6-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654657143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657143, "uuid": "8922ae2d-ad2e-483d-aa41-d30749b24712", "comment": "Malware payload (Heodo)", "value": "95d9d0d12c5c183b70e232ee17fa746e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657143, "uuid": "3730c549-4bb4-49f3-a2b3-8b35a11009f0", "comment": "Malware payload (Heodo)", "value": "b00abfef9e1a69123e354f6c5d32ae34a89c7f137e33da35d7f4a5e387af66ba", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657143, "uuid": "dd99f923-4ea2-4c62-af2d-5dce06eb000c", "comment": "Malware payload (Heodo)", "value": "238774adf1860b579aaca086d3fc6e4932f915db", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657143, "uuid": "f4b31aa5-e725-4e4a-8f9e-13c182fefb4d", "comment": "Malware payload (Heodo)", "value": "647645c26854f38af23fbd85f7f4da0c9855b1495e9e34a600f77509e9fa2c9a962a6b8687b055e2ddcbec28b4f19e41", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657143, "uuid": "f197c4d5-d921-41ba-8d10-fb6547dc35e7", "value": "T15304023EE5031A98C22ED8FC58EE6DF9D5F634006268063A1BA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657143, "uuid": "adfa2b34-b6bf-46e5-9472-fa1985d66f23", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657143, "uuid": "379f0313-b03b-4439-b389-a4fac2f8e2f5", "value": "3072:VpjftvFs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VRRi1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654657143, "uuid": "887db23d-a798-49af-817d-a40704ca754c", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654657143, "uuid": "42aa55e2-ee93-456a-b939-b9543d180215", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657143, "uuid": "cb437ca8-8ee6-44d2-a0de-1247f957febf", "value": "95d9d0d12c5c183b70e232ee17fa746e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be95c88b-e6dc-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654659630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659630, "uuid": "3b585ad2-f629-413b-b9ce-68befe3a4e11", "comment": "Malware payload (Formbook)", "value": "7110989b7d101606d840d0c17a8f8bbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659630, "uuid": "a0aa59b3-0e67-4f2a-8d1d-26af7cc3d55f", "comment": "Malware payload (Formbook)", "value": "b0e427b8e2db98edeea688cda0c6b0e33f936fae3a7b09b529a85a6190083df4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659630, "uuid": "1dd2bfc6-bf56-4ff1-80c4-865e0b33009d", "comment": "Malware payload (Formbook)", "value": "ff14cb8ce4716b1fb9699e5362cceddcfcd3c777", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654659630, "uuid": "5ba070e9-e1fe-4749-ad83-0380182c2124", "comment": "Malware payload (Formbook)", "value": "d8d114d5d1e0573a3efe13c2ee489fa0c3992ad05821eba9a920f94a9cf824dfc785e01540ac9d31b9b7c0d0f5ea2d42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654659630, "uuid": "4f20f1ab-e7cf-473d-a513-d31ad1bf48fc", "value": "T1EF05F112ABF9DF72CA390BBF854532105FBD5F6600A6F70D298470D91EBAF408256367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654659630, "uuid": "fcaba202-e8f9-4bdc-bdb1-b5c36c3f4cf3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654659630, "uuid": "c01872e5-f0e2-4840-b7f0-86ea3de5b3a1", "value": "12288:ReLF7Gpx4tJHQWxiTLgGYweJ/yU6B4oj44MXQGGzpA3bo9q:vpx47wWxsLQMUqj44MXQNYbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654659630, "uuid": "593529f8-5716-41a7-b0c2-ea0e4060af20", "value": 821248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654659630, "uuid": "a5288ac3-83c7-433b-aa64-8df10b1750e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654659630, "uuid": "422d3b55-2341-4d3c-a03f-8b0b2a4f6818", "value": "SecuriteInfo.com.Variant.Strictor.267636.28438.18371", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13513cb7-e6cd-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654652900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652900, "uuid": "520c44b1-e82b-41bb-9de0-18392c40f32b", "comment": "Malware payload (RedLineStealer)", "value": "c342639290e42ce0860f250279c8025d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652900, "uuid": "081cbc9b-53ee-4362-89e3-e27484c76423", "comment": "Malware payload (RedLineStealer)", "value": "b2114af6bb8149e6c3860e64aa47475e5c35726dcd8e28891caab5d04054f6d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652900, "uuid": "f0023020-910c-4f2e-94f4-2cae2f059bf8", "comment": "Malware payload (RedLineStealer)", "value": "c659a8d89ee09783177ea36cbb77a207a0ad018d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652900, "uuid": "502d69dc-688f-4d40-ac0c-2dcf6bab7fcd", "comment": "Malware payload (RedLineStealer)", "value": "a2618c8d96ecc0d01a87ca4ebe80e3a3273da4519005b505a3e97992f423ecc9f3202b676705ee4469e742fcc16149ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652900, "uuid": "eda32bbd-c4fc-482f-9d9b-5ec33ef6cf25", "value": "T14F34CF2232E08072D4B75A316475C2712B7FB8326776888BE798163E1F723D15AF9727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652900, "uuid": "43d26919-8d5a-4bf5-b772-4512241b4659", "value": "37da18bdec4c0e34b00fc346c95786c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652900, "uuid": "11482605-b86a-48be-8648-4c603a9d1bd7", "value": "3072:8iFRox0KIep05tQlFKVlmLjOyzA8bdsGQLx/QHDxwiBtddRi:CqD5WlFCU7PbmGQLx/QjxwiRdRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654652900, "uuid": "32714a9a-7238-4897-b614-cd75db3d9b0f", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654652900, "uuid": "388f1279-4150-4811-8b80-e88070de46d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652900, "uuid": "a0b4da56-c66d-460e-adc6-44c1bba4394a", "value": "c342639290e42ce0860f250279c8025d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38a1f7fd-e70b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654679592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679592, "uuid": "ee77ab7a-ca8c-4b26-b262-b61a9e2400e0", "comment": "Malware payload (Heodo)", "value": "40f235ff17fe1cc769a948ba0a6981b9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679592, "uuid": "72e02753-abf1-4121-b7a3-3a917c2d23eb", "comment": "Malware payload (Heodo)", "value": "b211e1b6d848171a382988d5e5b483ea3727c271d3c67f05c52a3066ac562310", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679592, "uuid": "4b56e00b-e01a-4747-b9b7-175b185e82fc", "comment": "Malware payload (Heodo)", "value": "769b781973c68d38afce66494a029a3890c18651", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679592, "uuid": "2844f82d-0cce-4df9-9229-69ce39536909", "comment": "Malware payload (Heodo)", "value": "3cfab236f91db4d3ab433edc1e4bbbedec1cd3532bcc703c0b68b67956ee255a2a4a141a54479763d021b67e69fdd45a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679592, "uuid": "ab56d851-1e5c-4ab5-b471-b3c990acb365", "value": "T13D44C089ABE1ADDBD51407798DD6D324333EF2814B8387076B2598390F23BA4BFC5A45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679592, "uuid": "e0c40f7e-1754-4682-8930-ab4361177bb6", "value": "963f2e88a5b03877d0583808b2526c1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679592, "uuid": "fbf8ea34-dde6-48ca-bdc2-3ac0782c258f", "value": "3072:7R7Ue82w+Oh+UjuFJrfr7CS/FmikytkqroMdjaWtHCqPZ4PEx2ES2vZg3f4L5ZJi:7lLJuk4uFxOmFwytLVxDtfPZ4PE2sPs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654679592, "uuid": "b5cb941b-e9c0-4f4a-ad0c-625cfe563bb9", "value": 270403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654679592, "uuid": "4485d4c2-55c7-436c-96f5-bad9f032b15a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679592, "uuid": "f8032c29-eb04-458a-82d8-e29d61f754f5", "value": "40f235ff17fe1cc769a948ba0a6981b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc6ad37c-e6d4-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654656298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656298, "uuid": "b18c9f80-8c37-49fd-a513-577dfce97c68", "comment": "Malware payload (Heodo)", "value": "eabb04da4e9ee6953ca47800de524af2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656298, "uuid": "8ed2023c-f64e-41cc-b74e-42e6a20991b5", "comment": "Malware payload (Heodo)", "value": "b306c90b429e1635ef6e01099817715d5bf815817a2d498cac229f79f85b95cd", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656298, "uuid": "5cbd0aed-f065-47d0-820f-b3f80319a99e", "comment": "Malware payload (Heodo)", "value": "6d706cbaeb2e667dc9bacf5c4f209ce8952b2f74", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656298, "uuid": "42d3c8f9-7f49-468f-aada-e4398bbe5a10", "comment": "Malware payload (Heodo)", "value": "1836ecd4478597fa6c86d3023ca2f8844529408e1167da8c2cb94298d3b681198951104527360409033900b951cdfae0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656298, "uuid": "6f221f4f-6108-43ed-aa03-191b693a1d6f", "value": "T19C04023EE5031A98C22ED8FC58EE6DF9D5F634006268063A1BA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656298, "uuid": "98c405c2-6824-4d1f-8e8b-48dc692dab70", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656298, "uuid": "f7a11af3-e7e5-4c6d-89e8-bd93d033f6d3", "value": "3072:VpjftNFs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VRni1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654656298, "uuid": "ce0c92e7-098a-4c19-83fd-e434faaea936", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654656298, "uuid": "aab8a0ff-1af9-47ea-aa06-8b1f104a906b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656298, "uuid": "418e09c3-85ed-4efd-bb37-dbc85a84cf41", "value": "B306C90B429E1635EF6E01099817715D5BF815817A2D498CAC229F79F85B95CD.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba07ab1f-e76f-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654722759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722759, "uuid": "54e8f25f-efd9-4c9d-8640-8e755d1d2475", "comment": "Malware payload (Mirai)", "value": "7972be4c7b2acff1b43538b38fb6ff7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722759, "uuid": "ded8e255-f180-4dad-b0c0-e4eba9080383", "comment": "Malware payload (Mirai)", "value": "b349d41296d2131a6578fc1a8b10c53d25fd816983a385dc6c0eee2e010ae95f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722759, "uuid": "4f7f48f1-27c3-44fe-8f32-5ab74fb2786e", "comment": "Malware payload (Mirai)", "value": "081e7846bd6b321002260df51d6d811fdd6ab0a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722759, "uuid": "ae72e0bb-890c-4257-ad54-d3554ee557ed", "comment": "Malware payload (Mirai)", "value": "0b14df3b3af006a2e79551c57425d5a6329220acc2c19561557011e1aedd9d38c754c6ee8835cac5b56970a83723f2f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722759, "uuid": "44f388b9-f3b2-41f0-b2be-d98cc979bb7c", "value": "T1454319827C81AA39C7D057BBEA9F108E3354ABD9D0DB7347CC140B9176CA51B0D67B8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722759, "uuid": "ad0177bc-78e2-4204-a461-cef16e092ec7", "value": "1536:VX3kcPLAR10ydj/BTLU8GYQ0zYJBb07N5z2yYceZW8eXZg:VnXPLJ0R5z2tcwsO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654722759, "uuid": "67407621-5953-4011-a054-8c59ea3dad32", "value": 60180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654722759, "uuid": "30d1d516-e7da-44bb-99d6-6be40c60f38e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722759, "uuid": "d93cb766-1a3d-48e3-909f-475a2dae33f1", "value": "7972be4c7b2acff1b43538b38fb6ff7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3485edb8-e763-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654717381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717381, "uuid": "6f8264d2-bdbe-4b56-b09c-eb6ac82ad2d4", "comment": "Malware payload (Heodo)", "value": "d9feefd7566a5d17352d2e1219aa67d9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717381, "uuid": "b275a46a-a3dd-4d54-8923-2e416d82b64d", "comment": "Malware payload (Heodo)", "value": "b431b63a93e49f6e70b6820244796e18d14cf5f8d907a620adebb5a5feb2eb22", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717381, "uuid": "4da16a9b-070f-403a-b5a5-4f0b8eb7b01a", "comment": "Malware payload (Heodo)", "value": "fed2fda4cec208a4fd7115106b58de1804b772e1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717381, "uuid": "717b2986-6f5f-458a-ad84-778ff2aa57eb", "comment": "Malware payload (Heodo)", "value": "5e85b84f19d7a9c9f131d8eaca160f55938d3417805ac88adf1106ba7c7fff35bd703ee0aaa7efddd5efe700e5b44379", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717381, "uuid": "f8eecccd-be3f-44ba-974d-534ea16d6f1d", "value": "T10B051947E77345FCC96BC97482A6A732B930785841397E2E4F80DB226F65F20953EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717381, "uuid": "fe90a565-4f21-4d22-a538-bb39527c2126", "value": "733e4ccf9ef47c6e471d93270b5eb898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717381, "uuid": "552da16f-38c6-44c7-9d6c-b9e54d0dc420", "value": "6144:v7rc6Wk6SYnaKOai5uWLwrd0jSjc0vNPqBVzLFWmWUPV2m7hzS7583Tg7A+++ncE:vXcFk6SYna2Frd0jSjcc9SmmBZX0TMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654717381, "uuid": "7e3a833c-6273-4009-9d99-de074bb7ef52", "value": 841728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654717381, "uuid": "a901eb72-ce70-4131-8482-9ac6fa5a94fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717381, "uuid": "5c480f29-f285-4a9d-82c5-d8e9b677f8b7", "value": "d9feefd7566a5d17352d2e1219aa67d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dffb2177-e706-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1654677725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677725, "uuid": "951372f9-939d-42bf-a737-33d11a20d261", "comment": "Malware payload (SnakeKeylogger)", "value": "7ec6bfd61cbd6acddca22103628d95f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677725, "uuid": "6c0a3620-fdd1-488b-9138-74d96464885f", "comment": "Malware payload (SnakeKeylogger)", "value": "b4898d7fdf1a32cf0f09c60cc874e704e3d9e4bac9bd6407d13cc5ecc7fe56f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677725, "uuid": "a40bf33c-5e03-4c44-9306-4a3daf87d346", "comment": "Malware payload (SnakeKeylogger)", "value": "1c267718286e947bcae139c9f37cdb7d21c1f739", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677725, "uuid": "7e61f68a-7892-4369-a1ff-10787a136d3d", "comment": "Malware payload (SnakeKeylogger)", "value": "ebe7d927c8663377ec9f26186c6c41f798df0190f089249163d2dfdcb3ff856e5c51fc0196e2acfe27b879b6c0d92c28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677725, "uuid": "68e79a78-c9e3-4c44-9983-275a20fb6c55", "value": "T1C6D4121477ED0792CA7E47FED47900404BB06222951BFB4E1E8A74EA1F27BD2C662727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677725, "uuid": "4f067d9a-a656-4d08-9e2c-1ac2b741c610", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677725, "uuid": "642d6cfc-09eb-4bd6-9d25-3070c14eac19", "value": "12288:oi54jiy6sYsINMcYtueZVPEKbXZZraVrrHl3CiUuh/bo9q:PybUYtuerEKiVrrRoulbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677725, "uuid": "59926666-fb9b-417f-8787-41d9cc56a8bf", "value": 597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677725, "uuid": "3c1f4fa0-d9c1-4b76-a902-4db709b836b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677725, "uuid": "63b4140b-8556-48ff-860d-b40c4d07a5bd", "value": "Export Catalogue_Pricelist_ 2022.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e45e23df-e706-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1654677732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677732, "uuid": "def50b5b-e446-40e3-8d56-4bb5d92b137b", "comment": "Malware payload (SnakeKeylogger)", "value": "1e87096699acf56f59eafc5e983dc2ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677732, "uuid": "8d1210e9-0b18-44b7-8ae9-5faa6e8ab2f0", "comment": "Malware payload (SnakeKeylogger)", "value": "b52ae5cbe34be07ffafabd43bce0d88daa2b58607bb2d20267fecd85a6bc875a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677732, "uuid": "8ec6d477-6ac7-420b-80a9-29b3d9ed78d7", "comment": "Malware payload (SnakeKeylogger)", "value": "027f4e082ee5f5ac7006a56564ce23124d9485ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677732, "uuid": "3b8925f4-56f4-404e-810d-ee82faafb4d8", "comment": "Malware payload (SnakeKeylogger)", "value": "62a6c4a05e17d1150220f33830328860eb4c1e24b5a5341c5b5c398e31bfdaac0da7b70d32aabea19f792babf6be3201", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677732, "uuid": "48c40442-d6ae-4183-8e59-ed08e0a7c0e1", "value": "T146C48D90573EBC75F519E333A06198281F145E5EF9F1D02E269E75CF26B238210F2EA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677732, "uuid": "e5ff34e5-60c8-42cc-a06d-0993aaa05910", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677732, "uuid": "c9c53523-0f0c-4ccd-9429-bfcb46314a00", "value": "6144:tz/PxVQ7seQeERzAya+0RufjIH4T+zRGTiVr+255PJnDODM2WZLmyUCRukIBFqn:tz336sBZqbJwfkYCtGOVSoMD47R6Bcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677732, "uuid": "921e4848-a9fa-4095-9593-763378c75e2d", "value": 592384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677732, "uuid": "193e45c8-6fd9-4b44-92d1-13986e05bb5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677732, "uuid": "54062fe6-93b9-4cb4-8927-8b946f16ef42", "value": "Balance Statement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc8864a8-e738-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654699194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699194, "uuid": "22e7ddfa-910c-4dee-886a-e3d52d715735", "comment": "Malware payload (AgentTesla)", "value": "a2f995e52909c6b6ae316186ed1bd836", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699194, "uuid": "bd048304-cf77-4c16-8a06-2ef4c6b50095", "comment": "Malware payload (AgentTesla)", "value": "b5b90ade53d21bc8d2ffe62101b4529280d03a48bc5a29d259d9818db99030b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699194, "uuid": "def2201e-3982-4ff0-ba10-dc76efe0b487", "comment": "Malware payload (AgentTesla)", "value": "15a5fd26885d4c8a78dd3cd5aa84a9da9620e857", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699194, "uuid": "2ef59133-d9a4-4ac8-a3bd-ed306917f7ef", "comment": "Malware payload (AgentTesla)", "value": "3fe8843a53d186a342ed824daff291db2a218c220e19dc20f79c2f1a25d1fd83db28b48559066d82ec42ae2bdb4b25eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699194, "uuid": "c5e4db21-23e1-428c-b816-b4aec2e319fc", "value": "T1AB05D015B2BB8E72E5A517B7C4D20410D3B68647A1F7E71F328C12E1AE437FEC941A86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699194, "uuid": "50691758-a552-47a9-ad14-03bb01287e9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699194, "uuid": "8769673d-89f2-4b4b-804b-795c874ab3b8", "value": "12288:okzDe1nTnh4Y9qJtJqQnk343ak+EMAMLxKfrk+ZBiEb9NP2BVcKgKFbWftdC:MnTnhpAJbnImjNQ1KA+ZBitcgcdC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654699194, "uuid": "f2e5b697-b147-40b6-9c42-ee6108ad5844", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654699194, "uuid": "02e94c78-f25b-4638-93ea-ad07a34bb1e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699194, "uuid": "7e538684-8844-4d57-bed2-229940136d8a", "value": "Payment Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "372730c2-e741-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654702782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702782, "uuid": "3e6c3be4-a828-43e1-83d7-e169bbdb020a", "comment": "Malware payload (AgentTesla)", "value": "22fcfeb2ee099013ac910b08ae74a6d7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702782, "uuid": "bd4b32c9-7f56-4505-94f4-87f7414adcee", "comment": "Malware payload (AgentTesla)", "value": "b7733cf8c4794621015ba276d9d72fc5e7f277090d1737b474874bfa3b9bd82a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702782, "uuid": "36d1becd-e697-437d-83ba-5259bcafdde9", "comment": "Malware payload (AgentTesla)", "value": "2402f130405020419daa5878908b4720d4f6064f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702782, "uuid": "371cc0fd-c833-460e-bf39-ebc7fadde44f", "comment": "Malware payload (AgentTesla)", "value": "c07298d50567d275a90b8476ff88cd097b85d88b590ec25cabc1b14d1f0f64fcff2a38966c70319b8f7baa73f65c7c39", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702782, "uuid": "e3a3daf3-da8f-4c66-8119-76662c9cd14b", "value": "T151C4BE46362C3942E17ACBF15092912103AA7F4EFE72E53A3DD3398E58D479136227F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702782, "uuid": "ca574a07-9c57-4929-b070-a848cfafe168", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702782, "uuid": "f12c2afa-d042-4a1a-9dca-1ef350d23995", "value": "12288:Gdf4XICLmfk1yalcWxyI4KVjc7xnXBMMMDMMM:8SICCoRHvc7pXBMMMDMMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654702782, "uuid": "7f41922f-7191-4a14-917a-9bc7f2701505", "value": 556544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654702782, "uuid": "664aa395-890a-4180-9c33-18ecbc577dbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702782, "uuid": "2430efe8-f84f-46cc-8228-7ab7bc7dc7a8", "value": "Transfer copy .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf4ea0a3-e742-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654703440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703440, "uuid": "806aaf10-816a-4348-98b9-e1b793d353b9", "comment": "Malware payload (Formbook)", "value": "a19c06e8cebbbcd86e3b5bf6b4c86096", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703440, "uuid": "ddef92e2-85e1-4800-9dae-f3a5ace7667a", "comment": "Malware payload (Formbook)", "value": "b79da8fc07954a6f3c5a1d35cae22315c2558dacdf0184d1a6cc5d29a4216dc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703440, "uuid": "96cc1204-0746-47d0-a2dc-7cbded75e5f7", "comment": "Malware payload (Formbook)", "value": "b41211a0d845573fa8a5c368a9a05935141b89b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703440, "uuid": "4ceb4d5f-3ea3-4408-b139-fbd9e8434eb3", "comment": "Malware payload (Formbook)", "value": "18dfcf2edc699c91065741e9a1f595e0332341f1075afaca1beeb8bda599e436a3b030319713df3220386f26796273f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703440, "uuid": "9267c48b-9997-40db-a321-0636c4fbd9e9", "value": "T1A32402C26AF45C72EA8291320432DF54BB759D3A4511874B0B80FE6F6EF21E64D8B35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703440, "uuid": "60f8df50-aa10-4f4d-9235-0da7302346c6", "value": "dd1742eadfc6df18ded3c26ae64ad610", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703440, "uuid": "80717b06-1814-47a7-a2ec-2bfcb38bbef4", "value": "3072:R14/IIhEDnmJ462Cfza1HiKWyp8p+xF4fzxoGZfL2cqrtIZShFoqCBCKGuS7KcU5:RbqZaLWG8HWGZfL7qrPhFoIKh/nuU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654703440, "uuid": "01a1ce36-fd89-4e0f-8167-aaf90905d697", "value": 215265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654703440, "uuid": "008badae-a9d6-4ff7-8c9f-b76e841a79a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703440, "uuid": "86d4b0e1-e403-4471-a8ce-95d20431e618", "value": "BL of Shipment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2b81554-e6d4-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654656282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656282, "uuid": "f66399c8-1f79-4b1d-8b09-09b3adb372a0", "comment": "Malware payload (Heodo)", "value": "a53341acfd271d253def6935ab9cce80", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656282, "uuid": "d39e2bf5-ec2b-4244-a55c-49e9ddef0df5", "comment": "Malware payload (Heodo)", "value": "b7bb25820934b0f1e60eccb531dcb7b8340714c2ac22abf558b855642cb726fd", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656282, "uuid": "c5aa5e61-cec2-478d-907f-e253b1f72257", "comment": "Malware payload (Heodo)", "value": "a85c29bf3a8e6c77c21b264e9a6b5c8f541a0e73", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656282, "uuid": "7dfdf878-202c-4d3e-8283-6f6159e44b5d", "comment": "Malware payload (Heodo)", "value": "3a6f715ace3aaa652e486f85659fa90359ac24a9cf69857cd0d8fc68c09d4eb3ed24b3762d8553193e32792565ac57c0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656282, "uuid": "14188f38-956c-484c-a51e-999d932ceba6", "value": "T1EE04023EE5031A98C22ED8FC58EE6DF9D5F634006258063A1BA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656282, "uuid": "63e49f3b-e1f7-4c76-9104-207a86aae601", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656282, "uuid": "94703dca-0db3-4255-82d6-2c7af6c06d6a", "value": "3072:Vpjft5Fs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VRPi1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654656282, "uuid": "0a95f97f-bac0-46ef-bfa9-502248e5d845", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654656282, "uuid": "f2d72fdf-1c20-4657-8f51-5d44ba7c2134", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656282, "uuid": "0bb731cd-5d5b-4b41-ae81-ef35feb620fd", "value": "B7BB25820934B0F1E60ECCB531DCB7B8340714C2AC22ABF558B855642CB726FD.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ff3511a-e701-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654675229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654675229, "uuid": "ef19f2d5-dc72-4c6a-b4db-f2b35fda8bca", "comment": "Malware payload (RedLineStealer)", "value": "3456ec5da5abc9f70f6e040aec05efb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654675229, "uuid": "5029e62c-6e35-438e-94d3-a0a8b4607d22", "comment": "Malware payload (RedLineStealer)", "value": "b7bf1de793e0d6dfa04d392dc0d9f3c51a45aee617e7ec27c95d5c2d6ac054d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654675229, "uuid": "d2d04613-f5d1-4446-87fe-e0ccfcb7f6a3", "comment": "Malware payload (RedLineStealer)", "value": "0ce4390f8aedcb4aa0ed7cba4323913428531544", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654675229, "uuid": "f3fa6595-753f-4d55-8c4b-4dea95e2f5e9", "comment": "Malware payload (RedLineStealer)", "value": "3f1d6b1881d637a3d42490fb8a2190b83a68e9df5cf215ec2347728880e40bfdd5f490ae148fc9475e2706242ae53b8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654675229, "uuid": "0bf9b51e-90d0-40d0-85fc-b40d3464eee9", "value": "T100C4022873EC0B61CABE5BFE6865000053F1A22A656BF31F1E8571ED0EA7BC1C565727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654675229, "uuid": "3069837e-0d13-403a-b492-6169be351a7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654675229, "uuid": "37b6a793-bd50-4eb1-8872-2ecd2372085f", "value": "12288:ORFhmK75mhPSuQUe1ENuXErhUHtdXZSY4SHe2tG3bo9q:hK7cBeWNuXENStdXZSY4S+2tG3bo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654675229, "uuid": "771cb881-ddc5-4e00-9cfc-77cdb0f36ef6", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654675229, "uuid": "a3cf8b19-bcad-4a38-a499-46dd03225ed4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654675229, "uuid": "38890853-036f-42a1-97a1-b3502afa0708", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ff109e3-e6fd-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654673618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673618, "uuid": "3ade0197-24e9-4539-b0e4-cd006f1db28f", "comment": "Malware payload (Formbook)", "value": "3c0f257ecb44fee2e5a95882ac891a40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673618, "uuid": "a0428f13-b461-4a1e-9d0b-b917330d26a1", "comment": "Malware payload (Formbook)", "value": "b7c289867d067d3d8f47d1d0b3e0fe63a7d18ebd8c8572037197aed2605a75ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673618, "uuid": "defad18f-acdd-4782-b78a-9cc5cc399951", "comment": "Malware payload (Formbook)", "value": "ce16e2cf79d4808c11b31c5d20d0df5b4d6655c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673618, "uuid": "5202ce0a-94cf-441c-8acd-b94ffd51d921", "comment": "Malware payload (Formbook)", "value": "2b7fcbb3082fb6b9f0539602f0b72ca0639e311c0dbb51ba95718eb3f2cfe36831a2af5f9fca5ea6e7bb48bf37c677df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673618, "uuid": "71697d7b-45b3-480e-a6cc-07578f2c53a5", "value": "T104D4121535E84FA2DA7E1BFA5815014057B5A22B182BF30E9DC234DF1E37BC0C9A6B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673618, "uuid": "c6ea36a6-b16f-4278-96b8-2dfb1179f0e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673618, "uuid": "7da3da07-b489-4230-81b0-381781b413b9", "value": "12288:WHS7kkQfUnRr5IvRz3hw7Utj1Bx5ARGcbLt3iItN7XNbo9qw:7NmUnReRzREwjt5r2dn79bon", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654673618, "uuid": "b00ab114-fab2-4caf-8ffb-11960e8a33f8", "value": 652862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654673618, "uuid": "8225452c-da2a-41e6-ad23-1a3044453abf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673618, "uuid": "05ded7c5-e487-4214-8254-09da062979db", "value": "SecuriteInfo.com.W32.AIDetectNet.01.21853.4500", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "027e456f-e771-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654723310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654723310, "uuid": "f030439e-4147-43ed-b265-20a5adbc334d", "comment": "Malware payload", "value": "080fed882c108907f163d9a704ff1066", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654723310, "uuid": "98587df4-fd92-4a1e-8d7c-d1696bf750ec", "comment": "Malware payload", "value": "b7cea1f983cf8ed41120e2d4a17b7fe2ec6693d2d990172568cdbbd6b9fbd319", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654723310, "uuid": "7a901781-9138-4963-abe9-7cb335187f4c", "comment": "Malware payload", "value": "2d8c0a54723765e6a8f8dd12ee51082746cb9791", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654723310, "uuid": "086297b3-6ce0-4250-9602-7de5ff905448", "comment": "Malware payload", "value": "4a4c761584a510040957a38b7a1989a1624a5e4680d98133d0564ef8b3188f3d5c6e9f34949089429ea68ae57d9b070f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654723310, "uuid": "195aa041-94d7-4f57-9dbc-7bac4fdc0f3e", "value": "T153449D14BB90C035F5B712F949B993B8B93E7EB09B2490CB62D52AED46346E4EC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654723310, "uuid": "7da30a78-7e98-44db-bfb5-67aaa53ec14f", "value": "3215fae786e72310b15953e12ddd6b57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654723310, "uuid": "8a02f653-0c11-42d7-b8d1-d2c5330a3f3b", "value": "6144:1WgIVT9ya4i6pXaXYUJCPS8Fm/c+vNztQ19F:1WdTQbpKIUJCP5Yc+vVep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654723310, "uuid": "6a32947d-0c81-4adc-a681-97b48ab409be", "value": 271872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654723310, "uuid": "b6356faf-0a1a-4902-aece-c3b145958d3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654723310, "uuid": "a8e4e17b-709b-4496-b9e3-c43e60b7199e", "value": "080fed882c108907f163d9a704ff1066", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "299a529d-e6ca-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654651649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654651649, "uuid": "e90729aa-1210-4406-b911-5c32bd9f5afb", "comment": "Malware payload (Heodo)", "value": "a8b679b45a0dabaad7ce1c286b6deb93", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654651649, "uuid": "16afe373-fc0b-429f-b90e-999e43777481", "comment": "Malware payload (Heodo)", "value": "b877807658de3cd1275e54ccdeda8d59add7b8818f10030b565ac3e6347d4af8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654651649, "uuid": "a77336e8-1941-48f7-9794-65504bf73569", "comment": "Malware payload (Heodo)", "value": "8b8cdf268b75722083b6a3be9eae6596ffaeb245", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654651649, "uuid": "052ec5c4-eddf-40db-9774-efb218b995d7", "comment": "Malware payload (Heodo)", "value": "e514df0b60212250693a51eff9918fdd3ce69d6ed23196a9638694c035bb223f2c693b30f25276d6c6828bf4f491adf9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654651649, "uuid": "ca27630b-e03a-4c17-acdc-78295bfb0782", "value": "T1A704023EE5031A98C22ED8FC58EE6DF9D5F634006268063A1BA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654651649, "uuid": "7177348b-b7b3-480c-ba34-e0ab3250f19e", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654651649, "uuid": "c49fce36-3a82-4de6-8976-f911388e4577", "value": "3072:VpjfttFs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VRri1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654651649, "uuid": "96d0fd4c-eef0-425a-8bb7-914f218effed", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654651649, "uuid": "2c01e9e5-b7f3-4988-a674-c7216db55c8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654651649, "uuid": "3a827ac1-20bd-4858-812e-140d92179ffd", "value": "a8b679b45a0dabaad7ce1c286b6deb93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce9d139-e777-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654726253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654726253, "uuid": "7ca5a345-6edb-46a8-bb3d-bcadf0761411", "comment": "Malware payload", "value": "36446379d6ddfdbed698a5b1a337317e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654726253, "uuid": "1fe1f6d9-45e9-4421-8fe7-3cea158703bb", "comment": "Malware payload", "value": "b8a603e2536de299e972296204bdcce4b40454c232e169ce90d2553de3f8cc16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654726253, "uuid": "5f086ec3-05d8-47f4-87a6-067b5dcdad13", "comment": "Malware payload", "value": "bfa2845a2cea7bd7cd7df7416def993976876f15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654726253, "uuid": "cc75c700-5ac6-467f-9e39-dcb2a24bae98", "comment": "Malware payload", "value": "e828551aad2b761f7837782b47fa5f608617f4c3095d627d4cdc84b6e8832346ac7a63271467f5e675f31930ec6f50fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654726253, "uuid": "5fdf9b07-905a-4a08-9c80-745b4aa6b7e9", "value": "T1D9051947E77345FCC96BC97482A6A732B930785841397E2E4F80DB226F65F20953EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654726253, "uuid": "9ddc0ee4-3c7f-4c58-875d-4ebe28088c5b", "value": "733e4ccf9ef47c6e471d93270b5eb898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654726253, "uuid": "388a4361-1680-4380-b771-579891a45f73", "value": "6144:v7rc6Wk6SYnaKOai5uWLwrd0jSjc0vNPqBVzLFWsWUPV2m7hzS7583Tg7A+++ncE:vXcFk6SYna2Frd0jSjcc9SUmBZX0TMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654726253, "uuid": "1ef795e0-d2e3-47cf-a16b-45ce1e3b4fba", "value": 841728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654726253, "uuid": "7ef6605e-2613-4e43-8eb3-39691148eed4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654726253, "uuid": "07d2a97b-5e9c-4e80-85e5-85c13828ab5c", "value": "36446379d6ddfdbed698a5b1a337317e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90847dda-e745-11ec-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1654704650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654704650, "uuid": "c0b16d4f-d5c5-4a21-b43d-d0b3ae537952", "comment": "Malware payload (Gafgyt)", "value": "d0f319c4b4de38e4f36216a1fe6a2921", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654704650, "uuid": "f52de13a-d649-41fb-889f-bb43d51605f5", "comment": "Malware payload (Gafgyt)", "value": "b9a7ae076452b69c7b7ba841462f09ef4416b526cf380da8839e7cbed5ab3775", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654704650, "uuid": "28694688-f9db-4654-88fc-4585952be65b", "comment": "Malware payload (Gafgyt)", "value": "f172e691b1f436eb00fc282b7ab9b538a2a14737", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654704650, "uuid": "2b7a47d9-f61f-4bad-9bc3-32ab9e493396", "comment": "Malware payload (Gafgyt)", "value": "534c99b77a6ef8bbdb61eb774375229c44dd6794b262e3406f103de908a7b2825912b158ec67ce56b535b2129717ebf6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654704650, "uuid": "a81195a3-9d3c-4600-85ae-f88338ea99e7", "value": "T182B30792F900DFA6F40AD77604C34B257630FFE24B931666722739A6AE362D43827F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654704650, "uuid": "5b2ab7c1-bb8d-464c-8fe7-5a048abf99e8", "value": "3072:bg/GJJ8qA00tA4Ky3VKvmm/lpbOLCn/TNO:bXJ8qA0/y34vmm/lpbOLCn/TNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654704650, "uuid": "ba74b96e-92ec-4b18-a162-f0fe0f01dc54", "value": 112432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654704650, "uuid": "bc065700-b299-43c4-82db-3f8effc409c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654704650, "uuid": "0062a740-3d2d-4b8e-9ecc-4964f7564235", "value": "d0f319c4b4de38e4f36216a1fe6a2921", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4674708-e761-11ec-93bb-42010a9c0043", "comment": "Malware payload (Amadey)", "timestamp": 1654716736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654716736, "uuid": "311d5099-9875-4678-a189-6d4d9d2b8880", "comment": "Malware payload (Amadey)", "value": "18744d81b074ea24f489b58b430b7d9c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654716736, "uuid": "736df11c-2657-4be5-8c20-bd8e8cab7ea1", "comment": "Malware payload (Amadey)", "value": "b9ba3633e6ae613c553bb7311affb973b5d3c5f41de5a9e5f1b048cb2cda8a34", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654716736, "uuid": "4196cb71-7748-419d-b9e1-5d122374066b", "comment": "Malware payload (Amadey)", "value": "d36bf939a4cf6ed710ff083306b8e3e20ed9e437", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654716736, "uuid": "cfa40bf0-405d-44e6-b8af-bdb1968b2d13", "comment": "Malware payload (Amadey)", "value": "210a57eeb9fef12d533fd024ccc1ef5bdc09c9af6de3843e94579af279f105432b1673c6f27682645f06cfbad6307609", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654716736, "uuid": "12db745a-2269-4ff0-beda-21bf7f665d71", "value": "T1576633A83B116CEFDDAA91370FED57108D57B3DF00C273028B78250E6D189696EA97D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654716736, "uuid": "e6c97e62-1e79-4dad-9345-bb4f4b2905aa", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654716736, "uuid": "ff2be164-ef83-4afb-9d48-0e2c72928406", "value": "196608:Jy/6U5zwp6+oaFYJa/MLHmTSeOKT3b/Rtvo:Jy/6AMoa2JGMLm2exL/RtQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654716736, "uuid": "528fd7c1-e635-4cd5-86b5-0f2e6d0bfee4", "value": 6568426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654716736, "uuid": "ec98e93a-95d6-4e7e-8b35-71a72677ee56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654716736, "uuid": "c7030899-7ba9-4fde-b86d-da932a9a7b20", "value": "B9BA3633E6AE613C553BB7311AFFB973B5D3C5F41DE5A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "579aaad6-e750-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654709279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709279, "uuid": "f2fbc1bb-56a5-471c-9995-a999e38dbba8", "comment": "Malware payload (Mirai)", "value": "e72328e1f5174042c48eae4b53444ed1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709279, "uuid": "0529b108-505a-40e2-9704-183d31b9549e", "comment": "Malware payload (Mirai)", "value": "b9f70f208ad65ef16155b75139e381b587da4bda00a6328a86822b20374c0550", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709279, "uuid": "101cb878-6875-4d9d-af79-edb5d4b10244", "comment": "Malware payload (Mirai)", "value": "a6f3c787ad6bd68c35ef6520ecd0358e48064008", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709279, "uuid": "eff322db-4598-4199-acbc-cca41fcd2834", "comment": "Malware payload (Mirai)", "value": "08653f63b1d042cfaffc9e0cd0eb16b601807decbb8e2a1b032f13f4f34c30007e5adddd210c118bbbda9d4a4ea70e34", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709279, "uuid": "dbcabcad-9f7c-449e-aa46-31cff9d8820b", "value": "T1A2533B02326C0E57D1A61EF4693F17E083FEEE9116E4B685664F9B468636E731089FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709279, "uuid": "af7f0d06-b0b0-482a-8386-141e9da3db31", "value": "768:ypWBiA7/paqC/Qk3WzRDT8NCzh6VmMUcUFI632X+aI8+z8OW3AINVOtWAFbr11:AI/gQkGzq6xM7eh2AINwtW2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654709279, "uuid": "ad715ef8-274d-42b4-a2aa-c87d41de6912", "value": 66700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654709279, "uuid": "c6cc6a3d-2194-428e-a621-172db15f6116", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709279, "uuid": "7d0ba5ed-72f6-4832-ad12-06bc3f2ae72b", "value": "e72328e1f5174042c48eae4b53444ed1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b361a2d2-e712-11ec-93bb-42010a9c0043", "comment": "Malware payload (Quakbot)", "timestamp": 1654682804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654682804, "uuid": "5b0c4967-d458-402d-b1c1-c3aedfac33e1", "comment": "Malware payload (Quakbot)", "value": "b7339228c2aa1dfc978e5727fb0c0935", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654682804, "uuid": "260f6a83-b1e2-4fc2-9cf3-fb4290bf0bf0", "comment": "Malware payload (Quakbot)", "value": "ba029d043771a8b8aa141be9157149f5d9c53097035ce73aff83ede1a0e68de3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654682804, "uuid": "9a68d234-8f65-452d-aa95-ac3716358471", "comment": "Malware payload (Quakbot)", "value": "4ec4c4ef8d512d4a45030be68c900aea51e23315", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654682804, "uuid": "ef5e23f6-afc3-4cc9-bc36-26e32be7b6fa", "comment": "Malware payload (Quakbot)", "value": "10990e11f4bac56223cbf0091af4c879164e15cced1cfee7b3b533f40e2cde3bd4bcfaa311fa0aded0d3d6f50fa9141a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654682804, "uuid": "bc18a74c-612b-4b6f-9e20-58dfd67ddc7a", "value": "T18F656C21B2CEC737D4F3267C8D6FB659942A7D111E38945A7AE40E4C0E3A6813E2D6D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654682804, "uuid": "6b961f64-8706-48bf-9047-c5e3d9f45afe", "value": "ba3f74b1c1ea8ef5b9ede9dc13ddf9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654682804, "uuid": "a9e70371-0b02-4082-b61f-f053e7f823f0", "value": "24576:a80Ra7rJwVXWqZLSPZF5BQjaM+R4YENZrfrzfQoD6CJ0:at8kRKZ29+I4oDLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654682804, "uuid": "2fd16526-4578-43af-8ada-1fe6449c0dab", "value": 1437696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654682804, "uuid": "575d704c-b674-4149-88ed-60221e13da5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654682804, "uuid": "6b871812-054d-4005-939c-4226cb0cf7cd", "value": "107729532.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cb103ea-e75d-11ec-93bb-42010a9c0043", "comment": "Malware payload (BumbleBee)", "timestamp": 1654714925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714925, "uuid": "3d880cc5-be9f-446f-a019-b25e48a57ca8", "comment": "Malware payload (BumbleBee)", "value": "f7f30fd53a2e2902c8bf09f82c7f6cf6", "object_relation": "md5", "Tag": [ { "name": "8a", "colour": "#C6394D", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smash", "colour": "#896532", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714925, "uuid": "d71c222e-6ea5-40a1-b68d-9f0a660013d5", "comment": "Malware payload (BumbleBee)", "value": "ba46171cdf2ff6253c83fee91568b5b04daf5ac240c2e0fd7f2a127da45c5be9", "object_relation": "sha256", "Tag": [ { "name": "8a", "colour": "#C6394D", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smash", "colour": "#896532", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714925, "uuid": "5d4ff2e7-0dde-4508-950c-1e2aabf3474a", "comment": "Malware payload (BumbleBee)", "value": "1b81c98b0e4addc2d83a8a09483477076e6e6f14", "object_relation": "sha1", "Tag": [ { "name": "8a", "colour": "#C6394D", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smash", "colour": "#896532", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714925, "uuid": "76e5d4a0-7594-4ba1-811a-fb8df0355b7f", "comment": "Malware payload (BumbleBee)", "value": "6c1001248800da0d51fa87b2603826980c22f7d633551aacbc280796e6c30ab7c5a46dff413e4cbb5f160664e07c8b98", "object_relation": "sha3-384", "Tag": [ { "name": "8a", "colour": "#C6394D", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smash", "colour": "#896532", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654714925, "uuid": "23077378-bcce-4235-a8b1-65fb0252c4eb", "value": "T11D85B083D408434ED8EF1331937A9DBD9EF22A9D66B1112C69A36BD16F43F4244FBA40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654714925, "uuid": "fb1c2dd9-a02c-4033-a3a5-3cd025692240", "value": "95f7edd930465714dbf86b38a16edb1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654714925, "uuid": "51040a5c-4206-4406-97f5-93014fdbd885", "value": "49152:Hrz44xPJawihkZqF8JxwYmhwLFO6kiPBXT:HrzgNUp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654714925, "uuid": "b73777f7-bd83-49cd-bb37-3e464def0cc9", "value": 1754624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654714925, "uuid": "6b68f5e2-2527-4aa2-9754-95aae6d123db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654714925, "uuid": "9b825d55-a0b7-43ca-8be8-aa92888fc1a4", "value": "requirements.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c6167e4-e769-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654720051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654720051, "uuid": "b3f6934b-c501-457c-9d58-322c105e0892", "comment": "Malware payload (Mirai)", "value": "a98cbd6d13f5653574c4d464c50baf50", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654720051, "uuid": "be0b8f93-a023-4304-995b-9d5383e07ed1", "comment": "Malware payload (Mirai)", "value": "ba481c081d3a37b0eceb34e9a7b4f8fd21621918b542cdc2b9cf8760a29c011f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654720051, "uuid": "ea4ba62e-c83b-4045-8d6f-634c52ee8b20", "comment": "Malware payload (Mirai)", "value": "76da1298cce9700b1a5a32df6a19917beb8bd8a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654720051, "uuid": "640e062f-59d4-4d18-9d23-f6de3e5a9a80", "comment": "Malware payload (Mirai)", "value": "557426e890a44db09c22e9b23b495c97b686a19f3363fd629326eb5afe5a9887bf08cf05c3b82b55031c1d772971ef8f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654720051, "uuid": "a8853686-a0cb-4d48-9665-f6ff9ae91db7", "value": "T10892D001926AE5F0C5F0183CAE26C6566E5B15F8C1FA303324600D9AE9E611F37F57D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654720051, "uuid": "6154faa5-19e8-461b-8dd3-29ada78be724", "value": "384:4+s5eO+5IouymNQ2eYc9N1yFCzGXvnRCKgBKncXirKHNiGnBS8YChymdGUop5hKh:4+Eehiy0QnYkN1BGfJAKnVrI4GBS8YCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654720051, "uuid": "a50c7cd2-4577-4ca3-8395-41a7f746945c", "value": 20420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654720051, "uuid": "39f6e24e-2dcc-497a-89b2-a32d61ace638", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654720051, "uuid": "8ef5b419-92e4-441a-9d41-480b41ee024c", "value": "a98cbd6d13f5653574c4d464c50baf50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8974af26-e768-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654719671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719671, "uuid": "56f11fd2-be46-4e92-bcd7-039d3f09b363", "comment": "Malware payload (Mirai)", "value": "bd04749ef2194d429cbb904f2f083d5f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719671, "uuid": "2b30ef71-3f81-42cc-bedb-549c28c3df4e", "comment": "Malware payload (Mirai)", "value": "ba4e9b1c410903249092da367a06efe0edadf9a10160575d14acdf652b9318fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719671, "uuid": "83178ec2-d8ac-43b1-805c-97a251440767", "comment": "Malware payload (Mirai)", "value": "e303f063ed509ba1b9bdd2245ca0bfe614c5a174", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719671, "uuid": "5b507751-32d9-46a2-b185-c0e3b942e97c", "comment": "Malware payload (Mirai)", "value": "478c2b4098d460e606279ec0220e97a2d3b20dd2172dbafa7b9615ed62e46cf193ebde3c049e59ef2ba6540376e80f57", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654719671, "uuid": "503223d9-5481-4cbc-83e4-26f4c1b8b5f8", "value": "T12BB2E1BEEB91ED75F960C23338B84D4A71A1F5F4E274C3A1E2543C7A51063E82A325E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654719671, "uuid": "c2d2c22c-38c0-4d63-99ec-4de35628cd26", "value": "384:MMcnZ4Dj8/hG1NHTudf8oNS7md46di6VgaEWocPeuamk1BXEVMN5VLU83yl:84j8/hGLHT8S7mdmyhPejzUVM7JUPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654719671, "uuid": "59528795-0d55-4c20-8779-63756ad6c582", "value": 23616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654719671, "uuid": "ca54ec19-6206-436e-b884-6790ad743e22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654719671, "uuid": "3ecaa70f-6b36-40b9-9b56-46af78378fb1", "value": "bd04749ef2194d429cbb904f2f083d5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3b888ed-e76f-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654722721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722721, "uuid": "b6a97df0-df10-4f16-8fbc-72be28b38f67", "comment": "Malware payload (Mirai)", "value": "7bbfcd64335f38604c3cab9d9e96c91f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722721, "uuid": "5b95c9ff-cb71-4f1f-a16c-4732dbb901bf", "comment": "Malware payload (Mirai)", "value": "bc6c03f9f29182718599bb8cf0ee50a3750b1a47580f66cabdf0d80bbee7c668", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722721, "uuid": "19c8cf8b-d7a4-44c8-a91d-fc8888e5efdd", "comment": "Malware payload (Mirai)", "value": "c46595b72a21a87e2476e7da6704e41007b26b1b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654722721, "uuid": "ec75102b-99b1-4bc8-aca3-83308db8433d", "comment": "Malware payload (Mirai)", "value": "7b2c242171e616e8becea85e61c9d119bbe5cb4bf344ef7de0ea685be7b162e3c62b048886bd545f20860a9f662a2f06", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722721, "uuid": "edea1254-1ed7-404a-a22e-7cc2f7a96d02", "value": "T1EE535C02B3684E0BF9E61AF5243F1BD483AEED8025E4B585A90FD7464235F33459AE8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722721, "uuid": "3226d442-c34b-4d28-bd1d-05d297a3e77d", "value": "768:zipbi/131WUsTETbl1T9Q9n5pY5eEgGsllk5MDZH0a26lBHW2tdFsDMUQSDAYTkh:zT93Egl1wYAzk5a+8NbK1DVoGg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654722721, "uuid": "85557b2a-f7aa-4f00-b309-40eef1459b00", "value": 64188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654722721, "uuid": "14bfb50c-c8c6-49cc-9863-b8b181f0436f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654722721, "uuid": "6b39e683-d611-4dab-b91c-18909f5933a5", "value": "7bbfcd64335f38604c3cab9d9e96c91f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9eaaad8-e750-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654709444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709444, "uuid": "4ef95e38-2439-4be4-b500-ec9a45c57999", "comment": "Malware payload (Mirai)", "value": "ced6020f6641215872540da160a5814b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709444, "uuid": "f39b68fd-7e2c-4268-a633-57e2fa5db125", "comment": "Malware payload (Mirai)", "value": "bc7e9cc94b89daf6994ffdf56d505381a384716a1518b2f8a7736c4f127edf74", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709444, "uuid": "dc50afd2-a487-4fb4-b85c-4ecff6a3bb85", "comment": "Malware payload (Mirai)", "value": "6cfa1fd5e95dd71a697adbf018c54104c5612f37", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709444, "uuid": "abf43b86-a473-4c30-a371-c013319ec685", "comment": "Malware payload (Mirai)", "value": "962e8c108176b130954740ade37c3b242032256bd5c5fd53aec650da2fede1d2879f6ffead05cf28d06ff02faa123243", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709444, "uuid": "c32e965f-5454-4969-b4aa-10e4cdfdcf5d", "value": "T11373754D3E359FBEFB9D817887B74A20A24833D526E2C684D25CFD021E7074E642B7A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709444, "uuid": "68b479c1-a1dc-4d5d-84c0-6f6eda7a4a95", "value": "1536:xlE9DdgduabP7bPf9bPEblMc58if5UZ6TzwqPIOp6/HjR+Y1Us:n6RgEVOif5K1qPIOp6/Hjsm3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654709444, "uuid": "6021cec7-7674-4c91-bfb0-403620067ae0", "value": 79948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654709444, "uuid": "7c869e86-1b90-452b-a874-fe505c41d096", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709444, "uuid": "5f7186e6-3421-4cd4-90b2-f73384ad6910", "value": "ced6020f6641215872540da160a5814b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85f245bb-e6f8-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654671561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654671561, "uuid": "469869a3-3554-4e09-9b52-1131a90f1c4b", "comment": "Malware payload", "value": "631199566b2cb34fcfb225195314af86", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654671561, "uuid": "9e9c0ee7-d838-4af0-b44e-a194a338665e", "comment": "Malware payload", "value": "bd59868d882d19d1c1ba6ffc3469b83f91f44feffb14e38a10f675dc3985f3c1", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654671561, "uuid": "6a5f8e99-fd44-4963-9bd7-706bd28f07e0", "comment": "Malware payload", "value": "33045481d773c9a644f5aad8532781f01b699b9d", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654671561, "uuid": "c123bde0-2853-4872-9e09-f760918d4bd0", "comment": "Malware payload", "value": "c34cc6773238e537c2f971f7829f2a4abf166c5a814cd034fbcbd9c44e184d8c66746731e8e949aa07e1fd8f06a4d9d6", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654671561, "uuid": "f4e13dae-f968-4de4-b3df-6a358bfe2615", "value": "T15E84236526847990DB45B947F9B773D0E002E91379E57DF380A6050BEAF89CE2B028F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654671561, "uuid": "652725c5-d568-477a-9392-cd7eeba830d5", "value": "6144:qcD8gDPuJ37WXZ2lP4igTv2VMv0GIAqIPjeGzUEICFQv2LUPQAQSBu2+bO3dAazr:n8mZ2lQisuVJlAYGzDuvz4AQNrO3d1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654671561, "uuid": "4d3b9760-a826-4961-af2f-1a5e73eec5e8", "value": 396657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654671561, "uuid": "55868f3b-2097-46c3-95d4-af1095887fc2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654671561, "uuid": "666b7891-cbdc-4ec7-89a0-72132ca0df85", "value": "Shipment Documents Copies (ETD May 22----ETA JUNE 29)]]](1).r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f21bd667-e73f-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654702237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702237, "uuid": "9b087caf-9d40-434a-9685-a06beaba996f", "comment": "Malware payload (Formbook)", "value": "382c45fc4da626ac9ffc55eb01308dd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702237, "uuid": "c2ce5749-17d3-4d1b-95eb-f2f301acefa3", "comment": "Malware payload (Formbook)", "value": "bd94e3893a05e8c7da76e73908f93e2239cbcc83d62db72253b045af0225ab6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702237, "uuid": "adc92d03-4354-4c83-91c9-1348dc071281", "comment": "Malware payload (Formbook)", "value": "78efc41d2f864cecdf9150e430b2b219deb98841", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702237, "uuid": "07a3da03-fa68-4a6f-9615-a362b1090ce7", "comment": "Malware payload (Formbook)", "value": "d345a4836f4f64e3236377f6df64696ffdb8b81a62f6bf028a3fa254306e79a20dfe5437641580ab228532ce32fac3e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702237, "uuid": "45329127-d567-4dae-8cee-f28a1baf04fc", "value": "T1E2E4F1F5DEF87965E11921B37064603C37E35E0DDCA5993ADA8BF24B34A66C210E1E0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702237, "uuid": "ad388113-64b5-4646-8789-f2b618155b8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702237, "uuid": "d95bd48e-9466-408f-a3b4-8c28fd60aa5f", "value": "12288:iNkO42iN/I9qL5d7l7rULn0WTggFyZn2PgSJMHUN4kvIqTq9:241pIQ5xl3ULn0uVFyBh2IaM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654702237, "uuid": "a4ca18a4-f8f0-4012-aa16-d93229b540b2", "value": 658432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654702237, "uuid": "2231f9fb-f8c5-43e8-b22d-59a9fe14a7ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702237, "uuid": "7bcd47ce-cfe8-442d-bb07-21b9b21697bc", "value": "RFQ# - T512 RS485 AQ002631-SKY-TH-T512 RS485.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc148238-e6cb-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654652324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652324, "uuid": "854d0e8f-ad80-49e8-a903-05732e788406", "comment": "Malware payload (Heodo)", "value": "98876a2349ca69c02518ce3d92a56e2d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652324, "uuid": "3a05d7a8-de75-4722-9f69-6873779ca773", "comment": "Malware payload (Heodo)", "value": "bed68c9be2d757cb7b43272f47762ccb0f78e5a2d49f6129b0b258be33e21f64", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652324, "uuid": "240663c5-f87a-4204-8680-13c4c7861171", "comment": "Malware payload (Heodo)", "value": "3d7c6b3b633128fbe9dac7247f77899651e901ab", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652324, "uuid": "e14b0bc7-2de6-4615-85c9-374df31a3ded", "comment": "Malware payload (Heodo)", "value": "2aa55083f645ed4bff2c16a4789301fb5703c8f977eb5e87e8e927f09fb47b21ee495b30c5b874e08c03ee16964c907d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652324, "uuid": "2aa95c44-cf2d-4e1d-8558-943c01e9eb2b", "value": "T13704023EE5031A98C22ED8FC58EE6DF9D5F634006258063A1BA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652324, "uuid": "10c184cd-b002-434e-8610-decd98c3cf11", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652324, "uuid": "9d1b0524-0e72-421e-9cca-a83d02fd6a3a", "value": "3072:Vpjft3Fs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VR9i1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654652324, "uuid": "9d9fc4d3-d9a2-4138-a82b-ddbf48f466d2", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654652324, "uuid": "02173823-b1cb-4852-b6e0-62e75b5c2392", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652324, "uuid": "61e5aa97-ce81-4dbe-a2d4-552ca2cd8cdb", "value": "98876a2349ca69c02518ce3d92a56e2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d68b4b-e6c8-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654651020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654651020, "uuid": "6dc201cf-ed11-4aa6-b05e-35912947792f", "comment": "Malware payload (RedLineStealer)", "value": "f52b7b9386bf21d1de67c188b3e76f0e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654651020, "uuid": "0a19ecc1-2870-4d3d-a134-6d11b8e27277", "comment": "Malware payload (RedLineStealer)", "value": "beea56a23dafd425aa57b3b05cd4d44c7615633292b20fb9bb22e08469fa6634", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654651020, "uuid": "2b2223ff-aaf0-4143-b4a5-5fa6736dcca2", "comment": "Malware payload (RedLineStealer)", "value": "e43c5fb6e826e5ac9a4ff9a7ae9a07874c589ff2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654651020, "uuid": "63c56cf0-f8e4-4ba2-a8ea-0142e02d2a34", "comment": "Malware payload (RedLineStealer)", "value": "3cf4f3177f419a79ce0c6d6055e183f022b617d98ee7dcd811d12dc6ff35cdf4e53fa501f3fc0891e41098d13e20b890", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654651020, "uuid": "09bbf62c-e84e-4659-9d14-f5452fbac3f9", "value": "T1F024CF2172F1C432E1B74A31183595712BBF79136730829F27A89A7E2F653E05E7839B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654651020, "uuid": "0c707778-f88d-43be-9cbf-ffff76983394", "value": "0eab09b98c18d699716845418f92678c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654651020, "uuid": "73efc739-92f2-4d99-ac42-4a5d8a16253c", "value": "3072:5K2nTab+ucZrro5c9GiZVQ6a5m4YYKqi:JOyucZr0YGQVQP0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654651020, "uuid": "1a03293f-4e23-4cc8-9ab3-028284e94914", "value": 222208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654651020, "uuid": "46f2fe60-ef86-414f-b066-1d6e922feb82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654651020, "uuid": "eb9c94f4-3f60-4f02-b8e2-b0cd9c8bcd9f", "value": "f52b7b9386bf21d1de67c188b3e76f0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c93905f-e77b-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654727836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654727836, "uuid": "f2cf52df-c9af-4f3d-a5b4-e90690dca0e1", "comment": "Malware payload", "value": "ea454f3392331641d3ce6e68958dd590", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654727836, "uuid": "e5240ecc-c7ee-4dcb-86a4-072a11470ef9", "comment": "Malware payload", "value": "bfd91a316ca48f2a35cf9551e66a1edc5755c4859a3f12a67080e9fbfa80bd9d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654727836, "uuid": "a0822cbd-c8dd-4142-902a-41ea7dd46d36", "comment": "Malware payload", "value": "3664428491197f73858aed7fe54b59106acc05eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654727836, "uuid": "6abe3ba7-4aa8-43bf-930c-d9a448b285f4", "comment": "Malware payload", "value": "da05785564b5dd5fd71afa036fc8a75864602fb848007abfc3d0abfb0718b827f000641d0607bdbcfb18942941dfbda8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654727836, "uuid": "d69fd324-f753-4edc-b8aa-f77e04498718", "value": "T1B284BF10B790C035F1B752F44DB98368BA3E7AA1AB3451CB62D51AED5738AE5EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654727836, "uuid": "4595df6b-f3b9-4213-a86d-e2b16f94c31e", "value": "d530938e11b87f5dcaab85f14604822a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654727836, "uuid": "b4c19e79-9bda-4c4c-bf5a-ba6a33e4ac90", "value": "6144:zC+xGzg4LAb/zYC+gm0/+1sEqtm9DiDcnaOGcxjgNHaguKSVkkhnYO84:zCnvMTzYjT0/+1SyDiDktfMSVFnYf4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654727836, "uuid": "d16978c3-0ba7-4826-8fa1-74e7cbad9c9a", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654727836, "uuid": "75d15d51-29e7-45ae-b382-80b223849235", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654727836, "uuid": "2243c100-9ccf-481f-8314-46113990b7f6", "value": "ea454f3392331641d3ce6e68958dd590", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f66435-e776-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654725574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725574, "uuid": "a78571bb-9ba7-4093-95d5-db493267f08b", "comment": "Malware payload", "value": "c0c0f7a9597d1e0703c6be14a3090719", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725574, "uuid": "f43f52b3-7e9c-459e-8a07-0997da70c867", "comment": "Malware payload", "value": "bfec0d51eaf41b43f1e1f01ef0a2fa0dbf00760249f7d23e8df3b70c4093fe21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725574, "uuid": "854f787b-eb39-41ad-a06d-5b5b34aa2ac6", "comment": "Malware payload", "value": "357b0acb270350ac513c4ce54388752e72c498f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725574, "uuid": "5c704651-9ac0-4dc9-9744-200980caebf0", "comment": "Malware payload", "value": "68894d4d961d49de0cde73b86a8ac041827a7735c79f61ba138ad03071fdb814aa68f378aa024bd755258b42dd2136da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654725574, "uuid": "10c56c0b-0d07-49fe-a933-195a60454a28", "value": "T164051947E77345FCC96BC97482A6A732B930785841397E2E4F80DB226F65F20953EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654725574, "uuid": "5fc855af-dfd5-43b5-a35b-42cbd7982ad2", "value": "733e4ccf9ef47c6e471d93270b5eb898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654725574, "uuid": "4ca682f3-c642-4fd1-8514-c61a5ef96073", "value": "6144:v7rc6Wk6SYnaKOai5uWLwrd0jSjc0vNPqBVzLFW0WUPV2m7hzS7583Tg7A+++ncE:vXcFk6SYna2Frd0jSjcc9SAmBZX0TMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654725574, "uuid": "02ee3bec-c9c2-454e-b847-16efc2028ade", "value": 841728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654725574, "uuid": "d9112c55-6bf3-4107-b0c9-de687f46e6ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654725574, "uuid": "422669a5-1ba7-4c59-be2a-9efe15e7d729", "value": "c0c0f7a9597d1e0703c6be14a3090719", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48347183-e70b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Quakbot)", "timestamp": 1654679618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679618, "uuid": "0a818ff8-1bcb-4958-946a-02f9ca605bfb", "comment": "Malware payload (Quakbot)", "value": "0879d6e200a43d2496bb54ec7908a2f1", "object_relation": "md5", "Tag": [ { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679618, "uuid": "ca0f9bfe-28b4-4fbc-9147-e7a0265bd229", "comment": "Malware payload (Quakbot)", "value": "c091d46e27d2601c081eca39c24085b80ff1be592312724cba6e92a70afb220b", "object_relation": "sha256", "Tag": [ { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679618, "uuid": "25275193-5965-4593-967b-b834c432a87c", "comment": "Malware payload (Quakbot)", "value": "b5db50fcf0beabb0aae7b10858507d2fb364a607", "object_relation": "sha1", "Tag": [ { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679618, "uuid": "7db21bb4-5c2c-4e4c-aff6-eee59372091a", "comment": "Malware payload (Quakbot)", "value": "e02f05da32321deee5921b49de161fee8b6b3e5dc56eef9ad1bc2895ca5ab19557988a157961b8ee8dae470b549e74e2", "object_relation": "sha3-384", "Tag": [ { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679618, "uuid": "9bd7a509-9642-41af-8782-08c74be1b25a", "value": "T1B61523319A7468390548E235F0A97D6D8DB00E47D046FB9CF7E0BACB860A2A15F3F758", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679618, "uuid": "fa296356-3c2d-4b85-8231-43889cabb849", "value": "12288:I+yddyG0oM+NcwCnGo0fw1Q9sJcNgeFds8SiGiX9SOuNbEugPeENJin:ZJoxCnGo0o1Q9sKgCsvQXWSugGAJin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654679618, "uuid": "f506c13e-4f51-4e84-a550-a1063160aec0", "value": 933227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654679618, "uuid": "f6d7949f-bf04-4c1e-a8b6-4b633007bf31", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679618, "uuid": "6f7daa85-dd60-4479-884f-8438c2cd5797", "value": "folli2.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6ece2b3-e723-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654690138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654690138, "uuid": "131bf146-90f7-4088-988b-fc1ff9f83f9e", "comment": "Malware payload (AgentTesla)", "value": "b66f68c79ff54eaec8eced5b4488e0dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654690138, "uuid": "8905495a-654b-4430-8e2c-77b0531b7910", "comment": "Malware payload (AgentTesla)", "value": "c0b8371b956cd3e1a3ff80ec04dd39c7901d2221e646f4dc6ddad6285a5b7fdc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654690138, "uuid": "bff4d5e6-343d-415e-8237-5f04b6f81ee3", "comment": "Malware payload (AgentTesla)", "value": "bf095b800ed976b9136bcb813b0b1db7f42d79d3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654690138, "uuid": "7414fb29-df87-4cde-be94-7e7047b095fc", "comment": "Malware payload (AgentTesla)", "value": "c8a0aff8eed7180810af9337fa7c4e04339486a599edac879da52bfeef907af5fe60b4d56ab95937d59a2b8f3ff9e231", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654690138, "uuid": "4b1c5c2a-80ab-4a25-9d6b-ca6bea2bf393", "value": "T16014ACF36BD8C8DEDB586234F3421E1707516DEC68D6A23C1FDE7A29C530A6A60F8560", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654690138, "uuid": "30c35bbc-b6d1-4f1a-8546-adac6147eb5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654690138, "uuid": "19e9dfe2-9eac-466f-8b2e-8dd7e1e00aad", "value": "768:Kah7G34bxkhp6kELfJSCChd7ntnR+iEiiiM8n8nsoGGTdjt+++Gvx/bb2exNEzA5:nh634bxUWSjwTOfhhGo8r2PYBU4cI4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654690138, "uuid": "6a4bac26-2aba-4765-be91-62bf0dee0d14", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654690138, "uuid": "63869a94-ac97-42f5-8ae5-10acd813173c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654690138, "uuid": "aa57e5a8-0b52-4716-8822-b06247051313", "value": "New Order110.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b1ebe6f-e723-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1654690011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654690011, "uuid": "87f25ded-db7b-4c8d-a723-d3c97ad5e37d", "comment": "Malware payload (GuLoader)", "value": "8d2b17af166809b53c5e556bc61506a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654690011, "uuid": "6097c39c-41f1-4506-a3f1-31a50ec68787", "comment": "Malware payload (GuLoader)", "value": "c116c36a9f85ba6dcb2c007813c310187ea409b9c2c32b29f3df21d25ad1b339", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654690011, "uuid": "7553d6c4-9b6a-48db-8cd6-d6c13551a301", "comment": "Malware payload (GuLoader)", "value": "58e058775098491972d29ee64bb34c02d54df9d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654690011, "uuid": "d281b762-1e39-491c-bb4d-68aa7fcd2bd9", "comment": "Malware payload (GuLoader)", "value": "07e94fbbca46aa617aaeaa80a2b98a5f818ad6454237de07f032ea0348f1e408fc6120c9773eb710bda0197ed257e83f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654690011, "uuid": "c89d9ebf-515b-40e2-89cb-31fce167c75f", "value": "T13864E0527A049027C93E4A30C5B7DFA147B2BE41AA1D1F1F27847B1C3EB32D3961E626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654690011, "uuid": "1a107a71-62dd-4f04-a0ae-86a5503cbc61", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654690011, "uuid": "cd2b72f8-aa34-4c3b-b93a-69d1953aecc3", "value": "6144:rbE/HUyscQZVfFt4jPvLvvZqqEM7kMro7t98sQ/n2d8LxE4Pp:rbe1QJmjHrv5EbMro7tby2gS4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654690011, "uuid": "b8b10500-acb9-45a1-a522-1bff9c953358", "value": 317145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654690011, "uuid": "d8c070cf-9c23-4e00-9b95-3841d8e927d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654690011, "uuid": "0b1d25f1-c7d8-4e0a-9f15-7a99a2131019", "value": "3456789098900987654567865434678434567898765.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43de5c3c-e70b-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654679611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679611, "uuid": "fff0a92b-79d7-424b-aa9e-ba0d0d03e240", "comment": "Malware payload", "value": "494298dd797eff60c8a0e5da5700f6a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679611, "uuid": "b52c3dfb-0671-4bdb-a44d-295609879fc9", "comment": "Malware payload", "value": "c163314e4b432b5bd2955f79a65ce05d0ff92e4cad74c6e2685424946dd87363", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679611, "uuid": "5e29b7e9-1e71-4f57-a638-509d4fd2253d", "comment": "Malware payload", "value": "cbe73e294675abb2c3fadcd430b678c6811ff605", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679611, "uuid": "04c0e0bc-7c67-4210-93b1-58775160ea01", "comment": "Malware payload", "value": "8dc2161658e1b02b26bfdad9497cbac5ee17258f29e5ed9202ac1d45b5c34e0b520b64558d4c291210082df7e31a0a62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679611, "uuid": "3d6270ce-b836-487e-957a-e1de7abd489a", "value": "T13016335724422C39D72B427EDDD268A360F54E3CE368685F076F81996DC88E8DBC4F89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679611, "uuid": "8bf091bc-99a8-4cd1-96ce-3e84977c29e5", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679611, "uuid": "ebc3fe18-08e8-44a8-8b57-cde418dbab23", "value": "98304:++kvjVF/bEb2LrEANU5WgC30qYd9jx42qtvuXhWMxsQrShg:+7bQ2LYAC5Weq89jx+vuXPCpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654679611, "uuid": "82ea2ca6-0632-473f-8aeb-08b59d4414d2", "value": 4223488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654679611, "uuid": "53e153f8-fd34-4485-967f-141e913586c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679611, "uuid": "015a3406-5a64-4fef-bba4-1ec09e3e8209", "value": "494298dd797eff60c8a0e5da5700f6a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea70bcfa-e740-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654702653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702653, "uuid": "cf64d427-2e6c-4a8b-833b-d6a3e15201ff", "comment": "Malware payload (RedLineStealer)", "value": "f486870555952bb1aeffb5328e4dc473", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702653, "uuid": "14406b88-31c8-4d79-86fd-97174210eb61", "comment": "Malware payload (RedLineStealer)", "value": "c25a1c50687dec7a7f5f98b794bafa859d35882c1f57c599b123386a161e1693", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702653, "uuid": "16db10ae-c7ea-46cc-8ccf-57860da1d7b6", "comment": "Malware payload (RedLineStealer)", "value": "c4c3c2876e5c201d53c8622b425bf351a981edc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702653, "uuid": "3abc913c-f1b8-47a0-b26d-158b3ff32d0e", "comment": "Malware payload (RedLineStealer)", "value": "9c3a03a401a86c3e3bcdb513616a3c417fecf50cb99c0d15503939c4f592bdf16249bffb1206dbbae59687d98356e328", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702653, "uuid": "325014a5-29f5-46ac-b8d8-cb468f22c776", "value": "T1F9B509039A8B0E75DDC23BB461CB533B9734EE30CA2A9B7FF609C53599532C5681A742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702653, "uuid": "296fc560-a760-48b2-9938-fc8244a266c0", "value": "5dd6748a8bf8c3a3d51aac89447af978", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702653, "uuid": "a33967be-986c-4d5e-882e-593238a6be60", "value": "24576:2rASjvMY0JJLThFeWQd4o7rZg2BWnSr3G4itM9QdHuQ5p3h314zE:2rASjvMY0/N3lUC2BWn4Fit3yE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654702653, "uuid": "1bf3ce57-df45-4e97-9808-f5f22ee51f29", "value": 2321583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654702653, "uuid": "f71154c4-db62-4f86-92f5-ec8191e35dca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702653, "uuid": "9f7059b3-9b85-40b2-a3a0-f02ca8d0e1c4", "value": "Genshin Impact Hack Modmenu UNDETECTED [2022] Downloader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf77780a-e71b-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654686717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654686717, "uuid": "b33281c9-5e60-43ea-85d0-e1b44d9a5fb4", "comment": "Malware payload (AgentTesla)", "value": "3e2315c37ccb0cc931750ffe449df299", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654686717, "uuid": "61d99476-3844-4724-a515-6df9e1bc6304", "comment": "Malware payload (AgentTesla)", "value": "c25d169ffffb762f002d4f6bfe9fda71abfbc60baec3f1d3d813b81a84af0c26", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654686717, "uuid": "f2308347-d445-4f88-bc10-4bb05af88b9a", "comment": "Malware payload (AgentTesla)", "value": "5f36ebedaa5b50594978d39b85cc98c125d5a0fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654686717, "uuid": "40b08cef-36b1-403a-8405-17f3a62acb74", "comment": "Malware payload (AgentTesla)", "value": "f89fdde7df777fe4f9aed314802cc881ca5adfed6a451faacb3311775c22e40c71c1c4d1a93555de26f487108bdd536b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654686717, "uuid": "be78b3dc-dc99-45a3-adb2-d739a9359a3a", "value": "T1F283A3E1C58101A5FAA50F35563B2D7A41BB6EBAFA54B50E984DB4B36F731C32032E07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654686717, "uuid": "056ca2ca-3373-45d0-9a31-e1b346ade50e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654686717, "uuid": "9cd764cc-fbf9-4180-af4f-2094b7d4bb9a", "value": "1536:XD4bV7FKfZhMXiHRoaWHdQACnJZOenw/yTRZG9hhG:XD4bVpramd7Ygc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654686717, "uuid": "050f109b-9344-48f1-bfc3-ac8f8dd08f4d", "value": 82432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654686717, "uuid": "4dc4d3bf-4adf-4f78-93c8-81da88c831ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654686717, "uuid": "6064bb8b-da0a-4387-b3d1-3b1d2aa87cbd", "value": "doc202208060893999100399302000121.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa35ab2-e736-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654698171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654698171, "uuid": "9b5e732b-6f2e-4cbd-a618-07194fa68a49", "comment": "Malware payload (AgentTesla)", "value": "572e82b278d6b165a1f11d8a8e1aba9c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654698171, "uuid": "e7188fdc-8454-43cc-a1b3-db8b0a3ce8b8", "comment": "Malware payload (AgentTesla)", "value": "c25d63f6bc023b6ae8138413ff4b8d600ff8b20351f536d561bbd07e0fcc959c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654698171, "uuid": "9146fd15-4a70-4482-b221-e289f2e33022", "comment": "Malware payload (AgentTesla)", "value": "a8d0a91adf6505d7be279f7d9d3e143322c86803", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654698171, "uuid": "eb727562-164b-4405-8c91-08224cabd404", "comment": "Malware payload (AgentTesla)", "value": "40358c1331cac63afdcc64125e784a930f7c79c544f69d1a014ea29de76f891e5ea34d1d8d36e5ff934cd1051e6716cf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654698171, "uuid": "c68c2a51-97fc-4fa8-8d3c-ca4075423858", "value": "T1D71512332643FDD76B7B1D44A6863D591DA83A274360A3CAF6C409FA50FA660DF19CB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654698171, "uuid": "945adab3-dc4d-4a5d-be05-8af3593f0c5e", "value": "24576:e94Tz7V9QXlbIzpeOGd/xhf8XjGeohzImIhD:pOhzfrVtu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654698171, "uuid": "c612d08b-a50b-4c90-aaa7-195369368858", "value": 923937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654698171, "uuid": "ff92ae37-ee7a-493d-8d80-ab3fd0f23083", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654698171, "uuid": "c57a8e74-d409-43e7-b183-87b360015d14", "value": "Agreement documents..js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53f4d4d7-e712-11ec-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1654682644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654682644, "uuid": "4b05e670-f8e8-42dd-854b-8183a12c14b2", "comment": "Malware payload (njrat)", "value": "735712d4642eb9e6a21b427081e3da2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654682644, "uuid": "6b72a7e1-2f74-4049-8056-f4b12196bcee", "comment": "Malware payload (njrat)", "value": "c261ad8ea9e9feafa20c0e626183b0ae13974b0300796b8524353b3843916333", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654682644, "uuid": "86556906-e587-4715-b584-fecfce25c5dc", "comment": "Malware payload (njrat)", "value": "e18e6d9eca3c0492cf632e6f35347956143f569b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654682644, "uuid": "d2495df2-1539-480d-9488-6919087acece", "comment": "Malware payload (njrat)", "value": "5155bdd801fdbb15c8f78bce55c1f65f19eafd00813849e842421a596bbcba6b12081f5c7e69bdf7d0d3624ae7185784", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654682644, "uuid": "a823d192-6dd2-4f01-864f-64b8befec204", "value": "T18B13DF0F97AB5222C2380B33CD831548541FE988E0A6F73E69C85B355D635BDD3ABAD4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654682644, "uuid": "28950107-34ec-4e0e-bb41-d3cf1d6248a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654682644, "uuid": "bd189e11-ba92-4aa7-a0a6-92288e49ca31", "value": "768:5QkULHv76KmJP/9mQ/Ot3vhg8IEK6R4L2qGPuH0E41Dio7LtaezVbpwrGPblJ:ikU7mKmJPK5gvV6uKq7H0ZkcV9CrGPb/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654682644, "uuid": "1bd3c4c4-a91f-4ee9-99ad-b768638e7f47", "value": 45056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654682644, "uuid": "515ef55d-b5ff-4f50-bbef-1f156328cfc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654682644, "uuid": "8fdd861f-1627-453c-a2c7-3bf26e2db263", "value": "SecuriteInfo.com.Trojan.GenericKD.39756184.5634.17058", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82fa0556-e745-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654704627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654704627, "uuid": "d35c2e9f-6145-4f1c-bdc8-796c09084872", "comment": "Malware payload (Formbook)", "value": "14d30f3b7fdc0449489e207fb7335551", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654704627, "uuid": "d6f715f1-2c7b-4cc9-b817-a0f676776f1b", "comment": "Malware payload (Formbook)", "value": "c33b26b4e4f428acbe2c4fff00184f4a2328c8bb656e4ca4cf189b782cf4b4ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654704627, "uuid": "85c68ad4-c108-4a38-b94b-da272b7b1c58", "comment": "Malware payload (Formbook)", "value": "d7d5ead143507bab37cca353fdba10149a1081e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654704627, "uuid": "7e7300c4-82f7-4d29-939e-ee122e07d51d", "comment": "Malware payload (Formbook)", "value": "813e77b68063ba87140c9ee4392d9b145ee35e791e7d0db7f7c494daf5ea0824cb66b831707f1729caeb4eb0aac627b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654704627, "uuid": "a7a4b48f-eded-44ea-a5ea-d9e51e5eac45", "value": "T165B4BE06361C7A02E176CBF44092866113B96F4EFE72E53A2DA3388E99D579132527F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654704627, "uuid": "0531e069-8b4e-40e9-9a3d-8a10e38b9b59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654704627, "uuid": "d1d636a9-9153-419b-a9df-c86505d4cf1d", "value": "12288:Mks4XIC8hF6xspUqCqhqlQETXuRthcLDqP:SSICOF6xsGqLcmQoMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654704627, "uuid": "100d9ad1-45dd-4554-82f2-09a5dc6a7308", "value": 539136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654704627, "uuid": "55e0c651-aaea-448e-9d7a-ad215f18052f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654704627, "uuid": "4cb16a53-8ad6-47e5-b2d9-edb0787036dc", "value": "shipping document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3372811d-e70b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654679583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679583, "uuid": "db7d6cf0-4912-4ebf-9e67-5e88e5934d4b", "comment": "Malware payload (Heodo)", "value": "dc2143e59a78b100f798041ee1aafa71", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679583, "uuid": "5b3a900f-b843-4c98-a50e-d6909372c33f", "comment": "Malware payload (Heodo)", "value": "c3b2507ab811b265a936dd47c4f17b39d12f1fb92ae7c19095f178d0a10e90d7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679583, "uuid": "f3693f85-8031-470d-bd4b-1e8651f66e40", "comment": "Malware payload (Heodo)", "value": "7dd36d0bfc078b0b802aaf86177e89037fc9d3e7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679583, "uuid": "b1a7504e-1399-4291-987b-8a5b2bb5d707", "comment": "Malware payload (Heodo)", "value": "8e65b4aa91c861c08b2af5a8a5b83f29820fa925add75bd2957cce6c4fd8cc16b4898bce46c3de38325fe82feff7d1dd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679583, "uuid": "856fa5de-ff3e-4e16-8fbe-dc673cbbcf15", "value": "T13444C0C5A791ECDBD92503790DE68364233DF2806BC74B033AB59A360E73B646FD5688", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679583, "uuid": "88685c4e-5259-4f55-a8fc-8b114c13de32", "value": "963f2e88a5b03877d0583808b2526c1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679583, "uuid": "563370bc-c542-41db-b6c4-37428aab30d5", "value": "6144:M1oyqUcchr3fdAdmG9rjcOLDNffPwz3GzMc5:MFccxfzGBcOxfHQ3GzP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654679583, "uuid": "b64cdde7-062b-4698-9289-a6d1a03f9ec1", "value": 274499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654679583, "uuid": "6eee516b-4d2e-479b-8e10-3fdf083673d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679583, "uuid": "875010a5-d845-4587-8767-0ba83ebe6acf", "value": "dc2143e59a78b100f798041ee1aafa71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c602e1b-e6cd-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654652889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652889, "uuid": "d989102a-ab7a-4f8c-89b2-0faac20f58d8", "comment": "Malware payload (RedLineStealer)", "value": "f69e49f838da258b40d566afbec0c8c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652889, "uuid": "cd27dd16-3ba4-4a26-9c70-0510e4319dcd", "comment": "Malware payload (RedLineStealer)", "value": "c404cc3a18e98ff81b63518df694118ecdec9948ce72f511cc828f93af5c4e7e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652889, "uuid": "1df31890-c587-4597-8266-fc25bd4cc7b0", "comment": "Malware payload (RedLineStealer)", "value": "b7f6986b9d19b84127466fc56d6a5fdde141b958", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652889, "uuid": "d38ffaca-e3a9-4ba5-8b53-181ecf18b2fa", "comment": "Malware payload (RedLineStealer)", "value": "37a38de7040d59e99ef1bebe6b8d0a533d2270919274b265ecfd9886a679be1d0465d1edbf15c2b64c7bbc218ffe0342", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652889, "uuid": "8da0e698-91e2-4611-8cd3-12d511f6e24b", "value": "T10624BE2172F1D432E1F71A310475D6A16A7FB852777081CF27A8127E6F206D06AB93AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652889, "uuid": "7128c0ba-4385-4205-b5c6-35b130e7523a", "value": "0eab09b98c18d699716845418f92678c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652889, "uuid": "7cfa9812-ca53-4725-af7a-afdb11912a55", "value": "3072:Uqk1FLQnWKvAc/KCgNQef9o5Q94ogk/k5LaOX+q:IFLQnFFgNQeik4vk8BPX+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654652889, "uuid": "96541d04-3b27-48d3-a9c0-8d56cc5e18a2", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654652889, "uuid": "d413b7cf-e0cd-4f91-955e-fce21e32c00a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652889, "uuid": "bd516559-1815-484b-8a12-bfe42d33d56c", "value": "f69e49f838da258b40d566afbec0c8c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f08356a6-e751-11ec-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1654709965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709965, "uuid": "7e1a0b28-6d23-42ff-a25e-440000238b56", "comment": "Malware payload (NanoCore)", "value": "5ea9c448fc8c41beda5ef0017653f3bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709965, "uuid": "c5e127fa-944e-4bbf-aca7-e2a5f38a343c", "comment": "Malware payload (NanoCore)", "value": "c476684da387e80f519d941396b2219ad7f1587bf9b2debd7b7489f7d05cf108", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709965, "uuid": "59550ed3-58cc-4eb9-8466-ae65a4514823", "comment": "Malware payload (NanoCore)", "value": "e9d980a014aba5bfa0012f67012f73162b1db3d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709965, "uuid": "02ddea9c-f35f-48e2-8c9a-17fd9d7fb59c", "comment": "Malware payload (NanoCore)", "value": "0ad4b3e3fb1d6b9b5f4beaeeb2279ede5c8ce155d71a14e2132b789272295b8ddbdfa7c15d6fa166fe6c19ac89bfa8bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709965, "uuid": "5350e605-d522-4a45-9374-a7b9b6a76f8a", "value": "T145A45F2C7A055AA6FD0F8171CC110AC4BB660B577384A98A23EF5FCA875F1A53F44DCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709965, "uuid": "4f5e9bf4-4510-4039-90b9-0eed3288743c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709965, "uuid": "c9268085-28ce-485b-9378-8973a037e01b", "value": "6144:WrCb9PEzq1WhdZniwtUdxdzQdqH7Z21/kUPpRP+fO:6CbFn8LTqxds07Q1/kQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654709965, "uuid": "0df36896-5938-4264-98ca-9e385d1fc6e0", "value": 488448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654709965, "uuid": "82d2ee01-738e-43c4-84d2-8f44ced3c58b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709965, "uuid": "b7c5037e-e740-42e3-b012-1e37822198d8", "value": "SecuriteInfo.com.Variant.Cerbu.138179.3529.31659", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a206f5-e740-11ec-93bb-42010a9c0043", "comment": "Malware payload (Hydra)", "timestamp": 1654702642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702642, "uuid": "ed7d7016-2e46-4692-a587-d09bc0599a95", "comment": "Malware payload (Hydra)", "value": "116fea8c63bce4908ec1307e20ed96ba", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702642, "uuid": "fe9da295-2b9d-455b-a269-478cb46211a6", "comment": "Malware payload (Hydra)", "value": "c7300e6de3d9c6f1ad622a1e884f00d43340c381fb87c87514ef3ca2156fdf5b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702642, "uuid": "7692b2e7-f2eb-4d7b-8bff-53ff0c4b2866", "comment": "Malware payload (Hydra)", "value": "4155c71ee1e03cefe5b67bc89c2235266327baa4", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702642, "uuid": "de73c70a-3ccf-41af-a0ce-c07e6817fa5a", "comment": "Malware payload (Hydra)", "value": "a5ac24dce494cc565a4360c61a89df0d62edfa35b6ead448dfac5a35f8198f4165d5cb99f1878f3c6352d997fdcc9653", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702642, "uuid": "9777e209-2ecb-42f6-9367-450d11e48fe1", "value": "T182F52355FED46D19CC4EB974A01ED00399688E890292FAA6342D71B55B3ADF00F63FEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702642, "uuid": "95e38e43-bcd9-4570-b15b-7338a9752973", "value": "98304:SGeGKlxOt40CxbBlLn237uEyurmeQesvB8cZN5:aNxY43Ln23pbnQeeXP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654702642, "uuid": "276cca8d-4d65-4818-a19f-1734542b25c4", "value": 3351502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654702642, "uuid": "40b68ff6-0fa3-454c-a4f1-9b37f7d125f7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702642, "uuid": "d147905f-4c5e-4794-9214-cbe6b3395b53", "value": "doc_hy_0806_obf_3.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db864025-e6d7-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654657531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657531, "uuid": "216fbbe5-0fa0-4eea-b14b-42625d2e5ed0", "comment": "Malware payload (Heodo)", "value": "3a19c038d7c0040df40e438882f4c493", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657531, "uuid": "3bae3c0e-030b-47ad-8227-d7225fe1d8e9", "comment": "Malware payload (Heodo)", "value": "c790dbeaff4792ca3a3968712ed3ae24f849fffb0b4afc8c575ec9dcee782478", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657531, "uuid": "b5d1ad47-0a4b-4414-adb4-0ae8da07e979", "comment": "Malware payload (Heodo)", "value": "2e92f6fb1c193576e46e12c799e260a8b74bc80b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657531, "uuid": "b13cfd34-9ec7-4106-ac31-f259dff379c1", "comment": "Malware payload (Heodo)", "value": "c95b7df8b03e787657e3576f901e8ae3edf1947f1cbe7a63928fd9e9c6d5074ec92c539ff33382e3ff17bf5890605701", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657531, "uuid": "c98932cc-8a33-4cac-a255-83740c2c18b3", "value": "T1CB04023EE5031A98C22ED8FC58EE6DF9D5F634006258062A1FA77E7C1D71661C11BCAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657531, "uuid": "42b14054-56d9-4ebf-951a-0526409eea13", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657531, "uuid": "200b0f63-dfcc-4580-8049-05893e0959cf", "value": "3072:Vpjft8Fs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VRKi1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654657531, "uuid": "87cbd173-0ead-4037-8cac-d94247c67c66", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654657531, "uuid": "c2cce10c-a4d4-4cfe-ba09-858670cf09dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657531, "uuid": "9fe6721c-ae12-4a0e-98cd-6c47afd402a1", "value": "3a19c038d7c0040df40e438882f4c493", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60e0eefe-e780-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1654729910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654729910, "uuid": "e8bbed0f-9284-4af8-b0f2-872311dfd9bf", "comment": "Malware payload (RemcosRAT)", "value": "d920a438cd8ebca7b0002b1389940c86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654729910, "uuid": "0dc1ade8-7e64-46de-a5ce-dc7ef4efc7ed", "comment": "Malware payload (RemcosRAT)", "value": "c7cb76d321564081d5a107d235b5a413db2bdddbded1ee3f4d62ce8aa3c1d48f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654729910, "uuid": "8a7275c4-e50a-4368-8c0f-6a62b7f5eab4", "comment": "Malware payload (RemcosRAT)", "value": "147a02cb8dbc00044c7a9483c2c77aa06870207f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654729910, "uuid": "068a5a2e-012e-4f25-8aaf-67768bf11e1f", "comment": "Malware payload (RemcosRAT)", "value": "8a3658cc52d150050b752f8a7d0795152a8d2effc8fc6db0087b6cd5a23bbaaccbe9c83f63b48bd4e936d339db946d37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654729910, "uuid": "93e2dcd1-b1bb-457b-b1ca-61cf964b5521", "value": "T16BF4225578DDEC27EE6984B10C75F73AAB7118449821838337825E7D3EA82F9BA033C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654729910, "uuid": "3f6e81db-79d9-449a-b29a-daf3d00b31e3", "value": "dd1742eadfc6df18ded3c26ae64ad610", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654729910, "uuid": "6ade9668-a3e9-422b-af93-ece1e6daa1db", "value": "12288:ZM5aw6SouQBqg5pJonRO9u7IBfWKeY0SHzVXmkISVk1u2Ruzt4CJbxrCnDPp+983:2cA5EqAongQ7IBf+NSH4kbVAfI+TkJB0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654729910, "uuid": "977fdb71-eda7-43fc-9e3b-e14bad45c12d", "value": 741196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654729910, "uuid": "9f822eec-b87e-4e26-9a1e-1e2b41ca3901", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654729910, "uuid": "cf85b75a-79ba-4fb0-8cc5-55eabb7e0bf1", "value": "RFQ-227980840247477_00083758GT924__PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b8c3ac6-e73b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Quakbot)", "timestamp": 1654700266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700266, "uuid": "d3ac8e8d-2d76-484a-b2fb-67d0c30e352b", "comment": "Malware payload (Quakbot)", "value": "fef9543ce43bb3e2574f14a21fcd11a2", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "obama187", "colour": "#0BCF63", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700266, "uuid": "4e1d497f-445e-470e-91aa-f49938d80e37", "comment": "Malware payload (Quakbot)", "value": "c7d4272fd706f4a07973bc644501afc0d423a9cc47c21fd4cad45686c4a7cd80", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "obama187", "colour": "#0BCF63", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700266, "uuid": "b0ace14a-2ac2-4556-bdff-c663f1ce5ea4", "comment": "Malware payload (Quakbot)", "value": "b5c45486ff5d31d5f34818b77080b33d4dabaab3", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "obama187", "colour": "#0BCF63", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700266, "uuid": "b54a96c8-45f4-4103-86dc-0b866ba89f16", "comment": "Malware payload (Quakbot)", "value": "476b48450eca821b3bcdf8128c20e6d91ca8f1637ca29c97d29df76bdb1c2f6bf054fea394aa40e26b9f142e12e380c6", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "obama187", "colour": "#0BCF63", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700266, "uuid": "9402b45c-6e26-4f83-b76d-2e7f87bb449f", "value": "T110A5AE22A7914836C2631B788D2B776899377D103E3A98C76BF50E4C5F393813B6A357", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700266, "uuid": "504e1e1d-dce9-4801-886d-28cd83de2bd7", "value": "12288:8MAUUXXEHA5sfLt6JfZPR2r7E43UDSXoMyvgulzMyvgul:G2fMJfNwEhOny5Wy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654700266, "uuid": "81c64a29-2c87-4af2-a13a-fe86428cdba1", "value": 2097152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654700266, "uuid": "4c543010-db98-4c65-95d1-c9b8198662fc", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700266, "uuid": "40ce5173-5afe-4239-947a-6e502222f68a", "value": "ScannedDocuments_7003402.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc34a1b2-e765-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654718494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654718494, "uuid": "c3c0cde4-0e7e-4c98-8408-bbb0d9bf388c", "comment": "Malware payload (Mirai)", "value": "2f10743badcc8b5d48d141b52f52d720", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654718494, "uuid": "8a01e253-16d6-430f-b24e-f28309d05a0e", "comment": "Malware payload (Mirai)", "value": "c8ce52259b73852e2075f07942540eacc72b86610e1f288e75a026cb69702cfd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654718494, "uuid": "0952e870-d916-424a-87f8-283be149f5fd", "comment": "Malware payload (Mirai)", "value": "bb2bc47465f269bf361288c6ddfb6115e61002c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654718494, "uuid": "804a7d98-816e-4572-8db2-89539e6af9ca", "comment": "Malware payload (Mirai)", "value": "1e4de4736b852b6515f230ae07a56968727949ab5cce1f9ea5de952d4ad593a934ddc35a589cbe7c60e4d44d75823b66", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654718494, "uuid": "156f2909-8ff8-434e-8401-d6ca6727bf0a", "value": "T144635A25F8392E27C0E4A57B21B78764F2F1674E25A4C61E7D720E8EFF1068021677B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654718494, "uuid": "3fac359f-409a-4911-a724-6cef1491393e", "value": "1536:mAdTC1VSGJta4ZpKRzXERrweBO4DvEWG5:AUWxnDOsvE15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654718494, "uuid": "afe1ba0f-978f-4e31-b81a-92eae2dbfd70", "value": 71820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654718494, "uuid": "ff71e70c-2a7d-4c4e-9536-d43e0c5ad49d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654718494, "uuid": "a3c30913-7864-4992-a549-b896fc68319a", "value": "2f10743badcc8b5d48d141b52f52d720", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aaccde8-e70c-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654679944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679944, "uuid": "200b0abc-85a5-4309-b805-c0d0552a03f2", "comment": "Malware payload (RedLineStealer)", "value": "7dcd27c5788108d0a4af62cbc52949d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679944, "uuid": "47373b1b-ed76-4b56-a072-42861cfe3475", "comment": "Malware payload (RedLineStealer)", "value": "c95c51f2e042dafcbbf984a25ccb44f823e4a9f7186fb38e1fd589e34518ee82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679944, "uuid": "8f6a6841-a834-436f-8750-5ccfcf2cd7f4", "comment": "Malware payload (RedLineStealer)", "value": "e954bd3311f6b1787551d38a964747e942056bca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679944, "uuid": "b9c90d51-fea7-4943-87c2-8b03061e631d", "comment": "Malware payload (RedLineStealer)", "value": "ca2f747ead0608f80097b0e6e36d24665e160ffa2ee42570d33e00d4d7eb2d89311fe2fcdef50be9a30dfcc9e8fc4e69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679944, "uuid": "6609be17-66b1-4154-932e-d5d08b8640f6", "value": "T15BB509039A8B0E75DDC27BB461CB633B9734EE30CA269B7FF608C53559532C5681AB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679944, "uuid": "fe48e149-02b3-4480-b3ad-2e05b27ec1bb", "value": "1c09d997bba3225142a0281004608efa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679944, "uuid": "7192c8ed-0fa9-44a1-8c4e-af1cf35fa09c", "value": "49152:L8jXLcyjy7gzzGpYXoAeWgkJJFnIQXIavK+:L8jXLcyjigzzGpYXoCgkeQm+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654679944, "uuid": "82f0096d-67d4-49e2-891d-8cb3b4cd6f67", "value": 2375762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654679944, "uuid": "25d1781e-ce5b-406d-874a-40547562ef54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679944, "uuid": "80c92514-cc3f-418f-83b2-33b90f362a44", "value": "7dcd27c5788108d0a4af62cbc52949d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27636e49-e70b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654679563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679563, "uuid": "0df8050a-84b6-492c-9546-e7dc1354fc4a", "comment": "Malware payload (Heodo)", "value": "eb9d3c1f80af74f6915b192f8a9caaab", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679563, "uuid": "263c9c19-d6b6-44fb-ac23-049a78a7a081", "comment": "Malware payload (Heodo)", "value": "cad442506f01adf4175a329fd9bd68f3b356916c997e29fa989868facc80cc57", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679563, "uuid": "3efa5f97-8a37-4ec4-a05b-a0b19a52b7a3", "comment": "Malware payload (Heodo)", "value": "de55b56b057b58242811f49c12c5f023eab2dfbb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679563, "uuid": "9eb276bd-e48e-40c6-842b-55a29c627a18", "comment": "Malware payload (Heodo)", "value": "f27c25c7c97fa40d322bd002da90c79bbce329d4edae7d38fe6dab8a07681998ae3ec79713cacf85d779d30864a46816", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679563, "uuid": "eb14da5f-d778-425a-8a03-9012495c85bd", "value": "T18A44C089A7E1ADDBD51407798DD6D324333EF2814B838B076B2598390F23BA4BFC5A45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679563, "uuid": "b8149be5-41b2-4f7c-8421-31b90f87786e", "value": "963f2e88a5b03877d0583808b2526c1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679563, "uuid": "46107a83-d417-4391-8d3d-7d75559b4077", "value": "3072:7R7ve82w+Oh+UjuFJrfr7CS/FmikytkqroMdjaWtHCqPZ4PEx2ES2vZg3f4L5ZJi:7lWJuk4uFxOmFwytLVxDtfPZ4PE2sPs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654679563, "uuid": "2cfce805-294a-4116-ba86-ba920567ff36", "value": 270403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654679563, "uuid": "93dc37f4-1b76-427f-bf58-037af41e11d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679563, "uuid": "bddc20bb-abd1-4210-8e5e-43f8b1608904", "value": "eb9d3c1f80af74f6915b192f8a9caaab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c2b4e67-e6d0-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654654365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654365, "uuid": "8a747d5c-0dd8-4049-83f9-baab30b28afb", "comment": "Malware payload (Heodo)", "value": "125dcbe5814e91755716df252a5a69d1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654365, "uuid": "f63c8f2e-cfad-4f0f-9650-58d5b8f46332", "comment": "Malware payload (Heodo)", "value": "cb0211a2705dc2fad1c52b81ab7d73a12634c8182877d05314742a7f811ac79a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654365, "uuid": "0523fb79-6953-4c9c-82b7-7ca68408fe55", "comment": "Malware payload (Heodo)", "value": "91921740eb21a18ced23633c9e78a492914a0fa5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654365, "uuid": "6717582e-0562-4985-9549-0290c3987f8f", "comment": "Malware payload (Heodo)", "value": "e1b96661c53257e77e5c9611df3dad790a4a4271156112b1ca887c7537502ed89445c940e5893c4d941884f6307c985d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654365, "uuid": "23a799dc-2042-4976-bee6-112d983451c9", "value": "T19C04023EE5031A98C22ED8FC58EE6DF9D5F634006268063A1BA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654365, "uuid": "ddee2c35-da77-4c82-9f7b-04371a253c5f", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654365, "uuid": "05660ea8-77a7-4f4d-8e9f-d17ec7bad7ec", "value": "3072:VpjftfFs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VRNi1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654654365, "uuid": "b1b2abf1-a613-4afb-8594-9ea45af06cbf", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654654365, "uuid": "2204b577-38ee-466c-94f3-687ed100bb0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654365, "uuid": "38520617-1e35-42b0-af33-85544c04e0a8", "value": "125dcbe5814e91755716df252a5a69d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8c48f02-e6ff-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1654674760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674760, "uuid": "6691090a-b522-4c92-b1da-f50efa50bf0f", "comment": "Malware payload (Loki)", "value": "9e207679343ced47c5739e6a1593fff7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674760, "uuid": "80c1e9eb-6f56-442b-8bfe-c79adf103265", "comment": "Malware payload (Loki)", "value": "cb65b3fc65a1a1c68f0d8bbf3d46f3fe49063f0065ef5cbed58029136169c01a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674760, "uuid": "df32d4be-0058-4f08-96f0-b341ce704bdb", "comment": "Malware payload (Loki)", "value": "222c062336f83a8921f2bc1d85d7ce60aae09aab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674760, "uuid": "9b45cbfa-b709-43a3-a918-e898f0fcda96", "comment": "Malware payload (Loki)", "value": "65871870accd0de8d6819d8ffb81a26f10996d8147c875d1f8f5824360df9046e81ab074276b05260ee32d491998fc06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674760, "uuid": "636d37b5-f975-4004-b789-8c323c135346", "value": "T12EC4022537EA0B72C67D47FED499044083F1A226711FFB0F5E8438EB1A66BD4C626663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674760, "uuid": "186fa20a-8ddd-4396-a565-726bea18ada1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674760, "uuid": "a54bcc06-93ff-4a42-8d19-e693bd3d9668", "value": "12288:0bLxDZw3mIbFAMCawMMlL1oEyLmDBiG5emSWlb6ibo9q:mDbqGMpIHoDiZl+ibo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654674760, "uuid": "991712f7-8d66-47d2-b1e5-d020b45a88a4", "value": 552960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654674760, "uuid": "aed14b3b-0689-419e-85cc-edf15c70bd3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674760, "uuid": "c5bf14d6-5c5a-4770-b6f0-83e7ee4e031f", "value": "DHL Receipt_AWB#2045829822.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "305d35c8-e764-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654717803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717803, "uuid": "d479d767-a9e3-4bf0-ac11-a6b4d55a3acb", "comment": "Malware payload (Mirai)", "value": "6dee2f1bcb233682f49be3d05af925bd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717803, "uuid": "2b259b59-c85e-448c-a4cb-09dbbc8226c8", "comment": "Malware payload (Mirai)", "value": "cb768997e9b5cd01617e1af4f0bab98df45383a7f1106916078eeedf5641341d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717803, "uuid": "61ce2039-f684-4f12-bd44-88550e32656d", "comment": "Malware payload (Mirai)", "value": "0f13f55fb86c86d4e0c1a7053ece3f76b43a4037", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717803, "uuid": "cd57e74a-0990-43ed-88e7-e89edcd814c7", "comment": "Malware payload (Mirai)", "value": "6d4249ca3faa55e7868eed46dec6ab8a52d3fadfb4ee53f2abceae8ba438e2845c64483de964f46598cf784cc235e96b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717803, "uuid": "5d4c5d28-28a9-4143-960c-5f1e61f26c8a", "value": "T1F40316536050C1FCD549C6704BBFB52AD933F07E5235FA9EA3A47E2B791AE210B0AC49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717803, "uuid": "f278d089-ac2c-4a95-8075-1c8dd6a8551f", "value": "768:QR6K5c3ETMhZinITltI9Sy7VyDKzITcTRL:jt3wM6nI4/7VEKznRL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654717803, "uuid": "d7b95087-4b55-49a1-ab9a-df5f4fff6868", "value": 38144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654717803, "uuid": "8a82426b-71e9-442c-bd71-73436c45e99e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717803, "uuid": "24863264-b733-466f-a4ef-1691a90f71b8", "value": "miori.x86-20220608-1950", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2313de89-e763-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654717351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717351, "uuid": "16ac1734-22ae-4490-bc0f-c7812ccdab4e", "comment": "Malware payload (Mirai)", "value": "960eec9ff5f7f7454b385e30cd35d9cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717351, "uuid": "4452284f-6c8f-412f-9d00-59930fb4bda3", "comment": "Malware payload (Mirai)", "value": "cba04c8c1d93d32d78184a8d3dee2c260ff4c39ac6eeeac14067777b8f510303", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717351, "uuid": "d2764e8f-98f7-425b-a89d-50b008d08672", "comment": "Malware payload (Mirai)", "value": "6bec04b7229c64e06fa6fb70d56c6323a26cf43b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717351, "uuid": "f85d9f15-db68-443e-93c8-a4dc49d68495", "comment": "Malware payload (Mirai)", "value": "593bcf9acd9e48b4f722d8c581288f359dcaefe0f2f76a780fcfa3ae7a67a2de8eee39fa9cde42986c7f201cc47ff5f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717351, "uuid": "f1ad9453-6161-49ef-8c66-62d39da47957", "value": "T1FC639DB2C9641E18D2598AB1F128CF3583639504A2973FFE9169C76DA443EDCF5183F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717351, "uuid": "458ee418-730a-4f36-95e8-c95b13651357", "value": "1536:k6ICOnrFOwlhO6xMmwo99i29r3mCriMXwKQ10cm8RK:3Aw2O6xMuL9r3mqXQMYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654717351, "uuid": "af66ccc4-716a-43f6-b6cf-3462620f150c", "value": 66928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654717351, "uuid": "5645fedd-bef3-4b32-8bd8-79cc28d86061", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717351, "uuid": "98b82f0d-6ba2-4c27-a5e5-fab89faab982", "value": "960eec9ff5f7f7454b385e30cd35d9cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec08b9b6-e751-11ec-93bb-42010a9c0043", "comment": "Malware payload (NetWire)", "timestamp": 1654709958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709958, "uuid": "78d766d6-a75f-4f14-a99c-0bd02d0c5808", "comment": "Malware payload (NetWire)", "value": "5c4ebff7354cbe3e81dca6588a93aa17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709958, "uuid": "95e362c8-0112-4d3e-b671-cf8dd14f7f9d", "comment": "Malware payload (NetWire)", "value": "cbaa4d9ea4ecb2daeb67d06f2a7a168394ee602a9af19ac88b5e4fe44018f999", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709958, "uuid": "2de9b8af-ffbd-488d-80cf-f0aa161b4558", "comment": "Malware payload (NetWire)", "value": "e5362e2f0a0cc94f29ee48ae583a34a3530767de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709958, "uuid": "6c1058ca-9f37-461e-91f1-b5ab679d0f26", "comment": "Malware payload (NetWire)", "value": "70fed174a393357b477a730a455afea17ed5c7d0b43f34722ba5384fe77b1f3ab0dad175c0c19ff3cf4ecfb5fb4ca513", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709958, "uuid": "cf1c87cb-699f-4812-a5ab-c38cf29133ba", "value": "T15825AE22E1E11933D5662F399D0F7A15A9AABE913D34B8861BF83C4CDF343827539193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709958, "uuid": "a91c4d32-875f-47e1-8ac4-84142e54c3e0", "value": "c2e2698247bc76cf8ea24c335c2f1e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709958, "uuid": "4e51e513-d715-41d9-8e06-03c3468a4e40", "value": "12288:mUdrBgUSaYsGytw7zQKKV0FlnOcf/GkMTgIGuURWCXCEUaW+6LHckdQ:mceazGytwXmWPn/fekMsTW+udQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654709958, "uuid": "e758044e-a759-4466-b33f-6c14b3826bf2", "value": 990720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654709958, "uuid": "2511fb15-4dcc-4538-a80c-36acd6dbc3e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709958, "uuid": "edaef1d6-fc3e-4b09-92b7-cfa61477b042", "value": "SecuriteInfo.com.Trojan.Win32.Injector.4a808221.25904.26381", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2a89460-e750-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654709405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709405, "uuid": "505d4c8f-8df4-4f3f-836f-1790483a0070", "comment": "Malware payload (Mirai)", "value": "9d2885af1897dda956c70d409336b9de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709405, "uuid": "dd54dd2d-239b-4202-8348-a3ccb0e1c20a", "comment": "Malware payload (Mirai)", "value": "cbbc5ebc1cb4dce2859c9420126f80ad16252b26d856358306104e1391db94de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709405, "uuid": "5aea499c-9f97-41a0-99e6-3ff7d1053b45", "comment": "Malware payload (Mirai)", "value": "1276505975f3793140b8ce02ad80d89b9a95fc71", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709405, "uuid": "266ea1c2-f703-4312-841b-f03efb8c4833", "comment": "Malware payload (Mirai)", "value": "0311bbf05df172e7ecab0cf3ea52a08500c89f1a990d403b3a2d148432a8e97db98286c4112a1ed51077c6b07506a7ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709405, "uuid": "76fc0ef0-b054-4ba5-a6c3-3744f6fd8002", "value": "T1F0D34B4AFA408B13C1D627B6FA9F41453322DB94D3DB3306991C9BF43F86A9E4E53A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709405, "uuid": "19621759-b55a-47c4-950b-0d89741231a3", "value": "3072:LYJ6lx6DvKq9VNBk4jZBIYiwHtH+bMYqxV8a9F5JUMa:LYJ0wGq/k4jZBVHHEbMYqxV3CMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654709405, "uuid": "4193f95b-be57-4e24-9924-4c369f947585", "value": 137742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654709405, "uuid": "4987304c-cc91-4a6b-9a4d-2713f3dc2bd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709405, "uuid": "41b95d0c-709d-4cc2-a6a6-39d670e57a77", "value": "9d2885af1897dda956c70d409336b9de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a137f36-e6d3-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654655489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654655489, "uuid": "77379068-b000-47de-9e60-28205ffc3a0f", "comment": "Malware payload (Formbook)", "value": "6bffccc463faefa01c1b2df41b424dfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654655489, "uuid": "4cfb927b-77e4-4bd5-ad45-80ab01a6b909", "comment": "Malware payload (Formbook)", "value": "cbf5d0bff8f20df08fe13d8aa9c48b33f29bb420596062746a54d4cf46b57b10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654655489, "uuid": "8e23bcf1-5ae7-4173-820c-e0ec8d36cff5", "comment": "Malware payload (Formbook)", "value": "b2ac827ab0523afb71b03678d68882ef460dc9c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654655489, "uuid": "ad0ffbc9-4686-43b7-a407-5a2c33f8c84b", "comment": "Malware payload (Formbook)", "value": "b95448b6b8789fee6b2afc29fbb4930deb6839ee96669ec9b406fdd09920905aa208dbcc96eade992bfb4dd9f3274588", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654655489, "uuid": "5de5bd7f-9bce-45f8-97d4-9868b6c97f18", "value": "T1D494F0143AAC7820DBAFCF7A4190C15045B996CFBC73F51F6BA74CCEA885B449361A72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654655489, "uuid": "3cf57829-e685-4ba7-a946-9071072dde91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654655489, "uuid": "16dec4c1-1627-4b94-9f21-b5a17de8b1e9", "value": "6144:BdZ0LY++2W3gfb2eZ/ievhc0UzJtPAIJ8xmyJ50u4Yy5gTIYRPatx:B70LYWbrZ/ie5xUzJtPAIJ8xLDGget", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654655489, "uuid": "5c3c3267-63c0-4709-aeaf-e3e90274d483", "value": 443904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654655489, "uuid": "49e94025-529e-47a7-bbd6-149d426067c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654655489, "uuid": "ba64fda1-22fd-4326-aafa-950da3ca502b", "value": "SecuriteInfo.com.Trojan.Siggen18.2489.13624.5346", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce8dcba-e712-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1654682659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654682659, "uuid": "a20fc4d6-10b6-4ce2-9d9a-1ad459a3fd91", "comment": "Malware payload (GuLoader)", "value": "77639840ebd09c1226c066ff7e7a7ddd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654682659, "uuid": "46d4f51f-656d-41f9-b884-bbd28ede4169", "comment": "Malware payload (GuLoader)", "value": "cd3949c350668abbecd84487f6a7d6ddc6e0517d841cfb9e337fb9c681653158", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654682659, "uuid": "ce15570c-6ed7-4e29-a217-6e76718bcfdd", "comment": "Malware payload (GuLoader)", "value": "7bd2a296b9789ad5fad73952f7a51ee547a5d83b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654682659, "uuid": "dfe09ce8-161f-49dc-be01-5951199fc8f6", "comment": "Malware payload (GuLoader)", "value": "d83fa8ca87dc3a81899252b35d1f74ef8a092dbfd71697eeebc97330a2857b58df6bff126e06239cea38ac661f627742", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654682659, "uuid": "a9d505e2-8ccc-44b9-9930-70547cc04658", "value": "T16E3413902790DE57D4B04336243BABBB9FB9582552A04E0B1794AF5E3C73193DE2FB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654682659, "uuid": "a2e16fc0-e4ec-41c7-b0cb-6ea9a2a1cba1", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654682659, "uuid": "836afda6-cf4d-4917-af60-efa1e53ce1b5", "value": "6144:BbE/HUPX+uOU9By6GHwK3BKSpuG7YibR9G+ZZ64v0oM:Bbr+0yxHweFRFhZH0oM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654682659, "uuid": "be0a05af-3a16-462b-ac18-8f529da1263e", "value": 237704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654682659, "uuid": "5ab700af-f5e8-4672-878d-2dec1869e882", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654682659, "uuid": "f84190d7-afef-4a74-ac16-69225675ff2c", "value": "SecuriteInfo.com.Trojan.Siggen18.2939.24687.26396", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0369b5b3-e6d7-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654657169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657169, "uuid": "0fea5480-b300-437c-9b00-b18936bddc33", "comment": "Malware payload (Heodo)", "value": "2f7aa92c9eb0beee076bfcd6e37bfcc3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657169, "uuid": "d36e9dbf-722a-41f0-a412-737b789cc8b9", "comment": "Malware payload (Heodo)", "value": "cd57d513d54f5629102d7772ea5005131c70d155c9c0a8bf9806f2e48383c130", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657169, "uuid": "fad3eb12-2c00-4640-87ec-5312ec6086cc", "comment": "Malware payload (Heodo)", "value": "d1200f0826195a1a0f38843ca0042e3efb59e130", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657169, "uuid": "76256e8c-cb72-4cb9-8dda-88465bcfccdf", "comment": "Malware payload (Heodo)", "value": "a002df811bfc1e799767c4417623b563dcfd393d2770d1da4434719cf85958d585e473fb2db830821ed5c543474c4186", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657169, "uuid": "95bcbba9-8124-40e1-bab2-9299134b88ec", "value": "T17C04026DD14C06DDD611137CACE90F3392FCF980A0262B5BBB70A6774BA4B96DB5B900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657169, "uuid": "d09235ac-0188-49c2-8ae6-ec284c040fe1", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657169, "uuid": "6079039e-bd7a-4a1c-9430-23953241f048", "value": "3072:rpjf+FcO4J8FYMh1PAzu8GmeR8dk5pL/rRn/02QBgjVcoe5Uy5i6zNL4ZNgzPKcQ:rRmWW6u8QKkXzN/09gjV/eey5/NsAziz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654657169, "uuid": "b23bad70-5b90-4f5d-81e8-da9a1918a9ef", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654657169, "uuid": "be53770a-1a64-4cbf-8c12-a1c23f2de888", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657169, "uuid": "097b743e-bb8d-4281-bafe-541ccac28eb7", "value": "2f7aa92c9eb0beee076bfcd6e37bfcc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7999a242-e750-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654709336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709336, "uuid": "59361584-3a41-4755-97a7-ff05001a0eba", "comment": "Malware payload (Mirai)", "value": "d06c3a61312822bd79420a76a1c33a78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709336, "uuid": "4520e12f-d76d-470f-abec-43e45981844f", "comment": "Malware payload (Mirai)", "value": "cd5a2c1ded66c4559927b4ef3289c3f94ea068a25cbce3754bd92885a9f7998c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709336, "uuid": "5d96d5e4-76fc-4890-bb49-6bf45b95cbd2", "comment": "Malware payload (Mirai)", "value": "0c2e4250f98eb4cc5b277c6538024ab7259b5230", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709336, "uuid": "65bf054c-fcf6-4e36-983d-600938bb337a", "comment": "Malware payload (Mirai)", "value": "cf84cfb18d87abb69400c233cc1b730902df360fa64c2666b12108de2f2b97d5259c92daf597049f5e3a0a1cee3ac496", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709336, "uuid": "4437d599-a5bb-48de-8b1a-72823ac72de7", "value": "T18D439EA2D07DAD98C20446F837384A3C9323E906929B3DFAD759C765A0479DCF58A7F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709336, "uuid": "6c626d2e-d8f9-4b6b-8d38-7901ce9d3538", "value": "1536:0aU/IM4NMc5DlTPO/8Qp6dyfvfVE8SzhYF1n6XC6p:05gTJR2Qdyfvf8WF1n6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654709336, "uuid": "10584d37-7590-4c74-b2cc-ec5c79c819fd", "value": 58360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654709336, "uuid": "b1594b7a-0c41-4b75-acc3-649b6c49854d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709336, "uuid": "84575806-54fb-4f7f-99d9-04d3c4ab55ef", "value": "d06c3a61312822bd79420a76a1c33a78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce2436c5-e6f9-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1654672112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672112, "uuid": "2d0d247e-2bd9-4ee2-ba1f-a45cdd323256", "comment": "Malware payload (GuLoader)", "value": "9fc898acf65e491f9756c2f23d8c9e14", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672112, "uuid": "725a916b-c706-4802-8f8e-7e18cf3e74d9", "comment": "Malware payload (GuLoader)", "value": "cec8c163a506bfe1eda606d6b9f24a57ef5fe566d7e7fc387010a6eeb8a355fe", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672112, "uuid": "cb20ab6b-c56b-4baf-87d2-a9d14d7ecd7c", "comment": "Malware payload (GuLoader)", "value": "167dd21798c1cc412b0256cc16d02b5ee4703437", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672112, "uuid": "01161b7e-7be9-4107-85c9-b726feef40ce", "comment": "Malware payload (GuLoader)", "value": "bff5fdf4008b3107bda622665d3f3cb8a79d0a64875096334cd094f4c2d464de6c30c68b229dec326cddecd08ddd7938", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672112, "uuid": "eca465f5-7b45-4513-b9ba-746108c81121", "value": "T14C4423940AD4583DDA60EE9AA8738F485DD81C7CD521D2AE06EF7708D4012CF3EBD356", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672112, "uuid": "0542f87d-1a3d-4300-a4da-c6a6a4202c02", "value": "6144:+pDtXNtDZ8hOe9hfCLe7+mpuGjpPLxjGIS7H:MDKOMh66pdNZS7H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654672112, "uuid": "10b70a01-afc8-4cf1-ae09-44150a5fe41c", "value": 260585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654672112, "uuid": "481617cf-2f26-493e-b5c1-b2feba2a5ad2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672112, "uuid": "8509405e-eedd-4914-80a8-e636588d69c5", "value": "9009876545678990098765.Z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e9a217-e776-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654725657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725657, "uuid": "18eb63c7-41b7-4df8-bc3e-782306e2a395", "comment": "Malware payload", "value": "25f4cf6536e712bec9eee5e3a6491e7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725657, "uuid": "b7ff8d04-4ffe-4943-9137-549f525d5b58", "comment": "Malware payload", "value": "cf512dc703370e7131d6a4e1de010590ed9eaa360a58a790112848d9592e84c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725657, "uuid": "edad4b4f-da91-4efe-ad71-4df2f19f756e", "comment": "Malware payload", "value": "708ae3aa007307b49bb7c1385f8c250be7cbfb58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725657, "uuid": "540f8ba0-df05-476c-bfbe-a13e0fff07d5", "comment": "Malware payload", "value": "8c8984388e6e27cd4e8ede565ae4877e3e9a90b279a620eaf1526288068e85cd180b14b17369f1754f1b335aa07828ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654725657, "uuid": "addd4353-3448-4cb5-a43b-f3162920c79a", "value": "T1D5051947E77345FCC96BC97482A6A732B930785841397E2E4F80DB226F65F20953EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654725657, "uuid": "c9e268f7-ce62-4974-86d5-6f9c4fc64780", "value": "733e4ccf9ef47c6e471d93270b5eb898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654725657, "uuid": "d48225e7-f098-499f-b997-80899de6a9c6", "value": "6144:v7rc6Wk6SYnaKOai5uWLwrd0jSjc0vNPqBVzLFW8WUPV2m7hzS7583Tg7A+++ncE:vXcFk6SYna2Frd0jSjcc9SgmBZX0TMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654725657, "uuid": "7ff27d17-4141-4e3c-889f-62c88fabf448", "value": 841728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654725657, "uuid": "c724af2e-6b3b-4847-930b-db9e95246930", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654725657, "uuid": "c3ae3bc0-3e51-45d6-9114-10c99f496ed7", "value": "25f4cf6536e712bec9eee5e3a6491e7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2b4b74b-e765-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654718478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654718478, "uuid": "3625de94-6a30-4903-8b95-aff165a108b0", "comment": "Malware payload (Heodo)", "value": "222bc6e2b91ed5c3024121199429887b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654718478, "uuid": "162d5a4d-a186-4eba-a4bc-2e42af5ae11e", "comment": "Malware payload (Heodo)", "value": "cf7db99a6a10e4578abf96d0ec1a4d4d5d68cd0e198990b247e2e89afb8d21c1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654718478, "uuid": "aee9cd44-1454-41bb-8f36-75a94142cd20", "comment": "Malware payload (Heodo)", "value": "c96c28049adbfa446cceb5c4e484636caf91550f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654718478, "uuid": "29cc1373-863f-4f2d-a87a-9356040c9383", "comment": "Malware payload (Heodo)", "value": "1ea5ba6ac1b5dd7afdacd46c38e3a2fd9adaf3fa31d690f93b503fc8159bbb7b1b6ffe12c1a404775ab5600e0b97759e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654718478, "uuid": "1240b8c9-df32-40f8-8e41-1ce1812d18b4", "value": "T19A051947E77345FCC96BC97482A6A732B930785841397E2E4F80DB226F65F20953EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654718478, "uuid": "f595270d-b5f7-47c6-8ed6-4f5c2d5cb7f1", "value": "733e4ccf9ef47c6e471d93270b5eb898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654718478, "uuid": "78f41f10-9147-429a-a9ab-9225cfad7847", "value": "6144:v7rc6Wk6SYnaKOai5uWLwrd0jSjc0vNPqBVzLFW1WUPV2m7hzS7583Tg7A+++ncE:vXcFk6SYna2Frd0jSjcc9SHmBZX0TMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654718478, "uuid": "17cc3c35-e0ed-416f-91ca-a9bc43c65c86", "value": 841728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654718478, "uuid": "a2a4291b-aef8-46e0-8f32-ec01a604f427", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654718478, "uuid": "b6e507c2-9918-4eca-810b-257f3bb07c90", "value": "222bc6e2b91ed5c3024121199429887b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ddb6709-e73c-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654700619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700619, "uuid": "32f06441-bf86-43e6-add0-4799218ba824", "comment": "Malware payload (AgentTesla)", "value": "5c83fc7ac695c53c24b705dbe84f68f7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700619, "uuid": "e456219d-ecf7-4570-9016-3fe99402f6ec", "comment": "Malware payload (AgentTesla)", "value": "cf941607f039e1a92a3155f483460ea1ce49fddb6e88a0c4559ac1d20da647b5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700619, "uuid": "de2adc32-b0e4-4fd4-bf6a-fd0dde708a51", "comment": "Malware payload (AgentTesla)", "value": "fb048ae413eb9fe3d773053888294b7200553130", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700619, "uuid": "14f543f6-5155-475e-bff9-870db241d5a1", "comment": "Malware payload (AgentTesla)", "value": "7de2e2f844a1a55e293fe2038e511ce1a07fc2d5065b712201b8d657c5545a7941a845761259a94649ab60ac41b50b78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700619, "uuid": "ebb61fdd-53da-4020-b9b7-ae68244b1e34", "value": "T110F4E070B2AA5254ED6A0B71187155C1177B3EBBBF04C72C2859325DED336834B32ABB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700619, "uuid": "f31fb1c2-f648-4ac8-95fa-ea3374ea7eae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700619, "uuid": "2973daab-9b86-41ee-aca0-eaf91511693d", "value": "12288:mQWgS3FDdpbSD6vCtxLFMUJQxdSdXPQBDkxtme7ias7wYDPIGs8WZKPzFc:m7gS1HbRatnFJQ3vDCol7UePBc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654700619, "uuid": "24ca6eca-479b-4fb6-a802-07b1433ba4c2", "value": 780800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654700619, "uuid": "de9cbc9f-a6b8-44bf-aaff-f9b4c545b91a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700619, "uuid": "2fbfa6e3-dc6f-4149-ac4a-1065dfafb2ea", "value": "doc202006609900103850020.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e73f7f37-e728-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654692340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692340, "uuid": "0df718bb-a2f1-4e81-b9df-469f4d082cd6", "comment": "Malware payload (Heodo)", "value": "322ab0a131bf23957522cee0081ce7d6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692340, "uuid": "a6ab7103-35e0-45f2-8d3b-974c1fe5a37f", "comment": "Malware payload (Heodo)", "value": "cf97f520288b9f20c12beed327fd302a9501fef8125558ca624979f9ed853bc0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692340, "uuid": "9662d474-cd3a-483b-8836-fb9a2e3ccde4", "comment": "Malware payload (Heodo)", "value": "13a294f2e55effcc19d94a2f656254ec346d304a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692340, "uuid": "40000c03-5809-4ad4-8088-20de5fcc621f", "comment": "Malware payload (Heodo)", "value": "0aac28a3a7034767e6ebc3d2353fb768d4e55a3d6098d27bb9d49bee8df41269c8c9b9a425b5b110333a6ade1a9f4323", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692340, "uuid": "4ff2db07-aa00-431f-9756-f72cbd308ff4", "value": "T19844C089ABE1ADDBD51407798DD6D324333EF2814B8387076B2598390F23BA4BFC5A45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692340, "uuid": "43d3e27e-fef2-424b-8d5c-abce278c322b", "value": "963f2e88a5b03877d0583808b2526c1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692340, "uuid": "3ddcf943-2df4-4b82-964d-57942b96d1d2", "value": "3072:7R7Ce82w+Oh+UjuFJrfr7CS/FmikytkqroMdjaWtHCqPZ4PEx2ES2vZg3f4L5ZJi:7lFJuk4uFxOmFwytLVxDtfPZ4PE2sPs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654692340, "uuid": "0a4c7dcf-26cb-4c7a-a565-50dea7bc1dfa", "value": 270403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654692340, "uuid": "c5375abb-6ad6-41f5-a918-20e777ea22e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692340, "uuid": "1574fac1-ef39-46c3-8341-fe50637d8036", "value": "b91c8fea163423257c932a273555468f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf8501f-e74b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654707005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654707005, "uuid": "2cd14353-5583-4a4a-9895-b9aaf4dbdb07", "comment": "Malware payload (Mirai)", "value": "4a481ead8892300135155cc647dcce01", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654707005, "uuid": "310b59bf-6a13-4ede-b3d0-3f10001e11d4", "comment": "Malware payload (Mirai)", "value": "d0b1d298472f2b5c3d2d95841dc3a8ddfceca42038ad93f495dfabe261d0d1c1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654707005, "uuid": "fffa12af-d496-4965-a606-e16ebe65ef8e", "comment": "Malware payload (Mirai)", "value": "711118ba4e32118d081ee5a1bc973b7bac465f35", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654707005, "uuid": "ad23e3dc-bd8b-4849-b7c2-b5f6738f01b7", "comment": "Malware payload (Mirai)", "value": "29f06d8c95a3e9e89175418707ca12f6950be8325df10201e44d086d6729450fe4e6861de67a998607732142e9d29ea5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654707005, "uuid": "23ae5850-02f4-4fc2-810d-3936fb0a6604", "value": "T195532889B8A1DA66CBC05277FF2F018D371553D9D1EE3203DC281BB4B68B81E0E5675A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654707005, "uuid": "66473b7f-8661-43b9-aca0-2e93854f53aa", "value": "768:8QgPv4icHIOoJLvJ9XIm55h1FYSRdMgoD+M3lk4nB2oUlUISI41++ZnxFGq2XKdZ:QPv4icoOwVRd5SSHM2M+7wcpBBuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654707005, "uuid": "39c0ea5a-9cdc-4e5d-b169-18daf58ba0b4", "value": 62460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654707005, "uuid": "dd609fd0-a114-4208-b677-c76c69287f23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654707005, "uuid": "99b393b5-c90b-45db-8cf9-78e033b33c4f", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4061e8a-e71b-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1654686644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654686644, "uuid": "42f2eae7-2032-4e9d-9a50-5c197a23b371", "comment": "Malware payload (GuLoader)", "value": "38e1435e19d4e8f5a1548a2388f6e62e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654686644, "uuid": "494728a7-a8a7-4467-9763-96dd47c98074", "comment": "Malware payload (GuLoader)", "value": "d109c876ee3aff6fe8bde6cef94025d7ff4e9b7cacc3cbe54fd4f4a1dcdd3cab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654686644, "uuid": "cfde0e47-2edb-4811-8cd8-39f3d6d95a48", "comment": "Malware payload (GuLoader)", "value": "e6f73e1b04b05081dcab7a4a2415bcb2ba67587c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654686644, "uuid": "7c000727-dc41-4283-ae45-c577ac237507", "comment": "Malware payload (GuLoader)", "value": "b93387f5e862f9bedcfe97d0e851e4ec0591d9bb4559db28afb4b920c4a673b3da750715b2123f2a8cd4122b5cf1cd4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654686644, "uuid": "b50dd43a-2e5f-42bd-884b-483a05199075", "value": "T13764E116B900A127C43E4B3184B7EEA147F27D51AE591F1F27947B283DB31E2D60F62A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654686644, "uuid": "26c36c67-3f56-48c1-a899-1780946a58f3", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654686644, "uuid": "74066ca4-acba-4f4c-b8ec-c503a1536915", "value": "6144:rbE/HUyscQZVfFt4jPvLvv+FYX1x0EyoFiQy:rbe1QJmjHrv35yyZy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654686644, "uuid": "4938cd98-6de6-4047-899b-0d060233c1c0", "value": 313582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654686644, "uuid": "f2912dbb-6a6d-47dc-b075-3558074f5ffd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654686644, "uuid": "996d0362-fe92-4f0e-95b2-865867552211", "value": "RICHIESTA DI BILANCIO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57ea116b-e721-11ec-93bb-42010a9c0043", "comment": "Malware payload (DCRat)", "timestamp": 1654689093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689093, "uuid": "e5001187-4083-45d9-90d9-60b4752b2452", "comment": "Malware payload (DCRat)", "value": "a2e5fd5cece2fba436cab899a6bb90e1", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689093, "uuid": "77e77058-6479-4010-8365-404fd85205c9", "comment": "Malware payload (DCRat)", "value": "d14488f004a9f6594ebf9b8013aa78a01828dfe63755875cc9e66b1d8793cbef", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689093, "uuid": "efdf66e7-e9fc-4a44-b577-7aa7f227214e", "comment": "Malware payload (DCRat)", "value": "5bfe81f829b10f79fc03eec94f1ce41ad3e60b23", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689093, "uuid": "81287331-d9ca-4c49-b12a-436d3d974c42", "comment": "Malware payload (DCRat)", "value": "4d2115db2c7f0aff33c3f171951080cc37aa2f3947bf154b8de393918ac8a3a5aaeedd62dbbae659f0fe64d113212db0", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689093, "uuid": "b67d8f22-872e-44e1-aad9-0a001c62dac4", "value": "T17F56236312A411C4F4D28D7A4D37BE90B5F78EAA8E41983CE0EAB8D115337D1E2165FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689093, "uuid": "63422b5a-018b-4a99-8c50-759dfee9d985", "value": "bb2e9e2bb2989c645bb17e20b34e011e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689093, "uuid": "30351eb2-51a9-45e0-9acd-6ae81c6100f7", "value": "98304:Mu92n9Opl/fv5YIzwY6ZqdccU6Jjly/LxpSPk1ETktme7kLc4va4j+jJ80WULW:Mq/pdiY6ZqdccU2jlOpnfMecFvZj6Je", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654689093, "uuid": "7fa1611b-0ebf-4253-938d-272d5db4bf12", "value": 6184424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654689093, "uuid": "4e0b0302-3cbb-4777-98e6-9593d95b892c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689093, "uuid": "67b7e790-88f7-4bde-bf29-7c1d2f47abf4", "value": "\u00ea\u00af\u00a1\u00fd.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "743b26a2-e706-11ec-93bb-42010a9c0043", "comment": "Malware payload (Hydra)", "timestamp": 1654677544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677544, "uuid": "cdb5e6c7-a8f0-4bcf-b3b2-19ac893fd084", "comment": "Malware payload (Hydra)", "value": "fa081ed138a34e5b8ca7e2677230eada", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677544, "uuid": "490c730e-e5a2-457d-b768-6855a75d3cad", "comment": "Malware payload (Hydra)", "value": "d1a0e02d4ae782c65dadba7016fba59fd9692daff9b6a10a5c11a866fa24a474", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677544, "uuid": "6a8313e3-e829-4a86-b039-41a6574e5fe0", "comment": "Malware payload (Hydra)", "value": "b5f8d1ece1b7a1b80bb3590fe745a657ebdeaca9", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677544, "uuid": "a7fa4afb-0937-4c83-a251-9b834e13c6c0", "comment": "Malware payload (Hydra)", "value": "584bc99a462f63baffedd72d44ec4b504ae5e669a57f92b293e632491ed3b491c2778c5fd7cc9429276ef109ad69a426", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677544, "uuid": "4ae9590f-230d-49cb-bd42-8484219f104a", "value": "T1BEF52355F6E1989ACE1BF638F04BC0464A4E5E4409879F5A791D70B82F3BEF01F428E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677544, "uuid": "3350ff81-4ecf-479a-9b14-aced538f7262", "value": "98304:swYaU8ZsVBoKA/N7LU2mZJ0cdq7nOg46jInW8AZI:UabWopeZacdo4TnVAy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677544, "uuid": "b9b719c9-fbf0-491a-bd56-c2fabc8d0bcf", "value": 3342199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677544, "uuid": "52cde303-8ac7-4f0e-8b83-1f290f0de94f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677544, "uuid": "98eeb0f8-6bc6-4bdc-b574-d31e55635b2e", "value": "FlashPlayerV1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f33a0541-e75c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654714694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714694, "uuid": "bacdd8a6-dbb0-4ece-95da-4ef46e78767f", "comment": "Malware payload (Formbook)", "value": "e9d6ec42742fa74c3a48596539e201c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714694, "uuid": "21297322-0444-4a66-b2c2-2b3b55b78525", "comment": "Malware payload (Formbook)", "value": "d2d4fa8e5269186698ecf34401a56bd30201c4f2e0be41ad4acfa714342c2b83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714694, "uuid": "d4decd8d-db61-4b78-ab6c-9eb64b6fff24", "comment": "Malware payload (Formbook)", "value": "4615ab33af6f6b94dc97c7cff82ee52354fce4a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714694, "uuid": "200af5ad-0ab1-4f1d-b508-cf27f61d5f57", "comment": "Malware payload (Formbook)", "value": "ebfb4ee4194eb88b1a64606dee54144668934bd33411ad48afbcabcef159f7ee576ebc6ecbe93f56901cbacb903b31d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654714694, "uuid": "05405ea6-cd41-4e87-b668-63c89530b96a", "value": "T13EF4D002B5B7CE72EA960777D0D7400093BB914591E7E71B268803E6AD43BDEC993B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654714694, "uuid": "2ca5411f-c52f-47f1-8432-a07245175cff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654714694, "uuid": "0d01b1fb-8327-4a11-8f27-d1ede8789b78", "value": "24576:ApltGAhcc26xrz6NphTRSKx4Xi7xzV/atx7p:al5cORz4NCy7xR47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654714694, "uuid": "a845dbfb-2add-4e99-a619-b2c195f9161f", "value": 793088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654714694, "uuid": "6f61a8ad-428c-4f5b-bfe9-c62c640f125e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654714694, "uuid": "e32384ef-86f2-4fc4-821e-9a52b3853114", "value": "QUOTATION PDF_SCAN_COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dcc3adc-e703-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654676164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654676164, "uuid": "c20d75b0-936d-494d-99e6-91abab5112cc", "comment": "Malware payload", "value": "db6ddb7a89bebd588fe91d06e9aa9e43", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654676164, "uuid": "36aca0d9-c1e0-4654-8c4e-b230f157f488", "comment": "Malware payload", "value": "d32803bad382b1d0a1b16bfe7c7865b6a0cdb4daefbf36b78bc9884e6eb32400", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654676164, "uuid": "ab87ccaf-e383-4829-a64a-1511d2c56a27", "comment": "Malware payload", "value": "0f870a210b4574aba015f3988451265c5e3f794a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654676164, "uuid": "e55bc782-a8f7-4e06-beb6-38129f076363", "comment": "Malware payload", "value": "c7813a9579e3ef302a03e9cac34ccec0bf3c2376dccbfd7963d6105435859cce40882adf5adc87fa56b32720e3a80685", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654676164, "uuid": "f8336d90-8219-42cf-b393-937699c8fc67", "value": "T1EC72C0848131445AEF1F15F8E5F4660DC35AC2EB0429B46B0A6537624BCC529DB3B32B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654676164, "uuid": "5fefe730-7408-4f3c-b2c2-be5c46f6216d", "value": "384:04dJfiQZKM1WGK0OBsEaMf87A1XdlZcuKt7gyQ2hXgjL:nqFMe0OBRUqnZItejL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654676164, "uuid": "cc690153-63a2-41f2-8728-bc53066fa26b", "value": 15985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654676164, "uuid": "58135ad5-354a-4fcc-b13a-aa4130b74333", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654676164, "uuid": "938952d2-e198-4f3e-81f9-bc7739511175", "value": "9880-0806.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c54b1ec-e717-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654684752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654684752, "uuid": "680272ee-dcbf-48d6-b881-3af1890ded66", "comment": "Malware payload (Formbook)", "value": "f80f480524ba798f6c4b13bedfed6013", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654684752, "uuid": "9415b5d3-eec2-43ad-979b-d6fc50336142", "comment": "Malware payload (Formbook)", "value": "d4313f4566063910e9caaf3af07218c38830a9bf73394e2110d9de2e8ef7a884", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654684752, "uuid": "9b8f54ea-40b7-4d15-a24b-e81b902eb7db", "comment": "Malware payload (Formbook)", "value": "696097906bde3df198614556b3b18d448f74338c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654684752, "uuid": "3a5735fe-10b5-4441-842f-eee0fd582941", "comment": "Malware payload (Formbook)", "value": "f71cdef8165e35dacb213f288be9bf3d4ebc7bbf7b665682b1c23beea5d27508e11fc2c24d095eb17915b2fbd73704d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654684752, "uuid": "db85614d-ac7a-47ca-b452-601826062543", "value": "T1FF943D3F3A0D1A62FC1DF0788E150B09BB67BF036290A99553CB35C697AF06A5C75C89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654684752, "uuid": "02647634-6c47-4eeb-8cae-5d3ed2143ca4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654684752, "uuid": "7d15b8b8-5e67-4388-bade-67b08d6a6193", "value": "12288:ao6Yf//////////////////////////////////////////////////////////d:r6Yf///////////////////////////o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654684752, "uuid": "eb79eed2-aa8b-4521-ad21-3160cba96bd7", "value": 445952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654684752, "uuid": "13559ec8-bd7e-43c0-8e66-7db652ed1b05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654684752, "uuid": "cd62c6ef-b39e-4984-9bcf-657b715e1a6f", "value": "SecuriteInfo.com.W32.AIDetectNet.01.7551.2613", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00095f10-e737-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1654698395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654698395, "uuid": "f032a426-b619-4878-b8cf-a29b46ccbf2f", "comment": "Malware payload (GuLoader)", "value": "fd7702478cacad7869e37a7368086a9e", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654698395, "uuid": "25662755-aca3-4e52-b616-9b1a8a55c421", "comment": "Malware payload (GuLoader)", "value": "d665c6ded07ad225b1010d260331322cf1b0ebaf4e180f2947a776bcfef7de92", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654698395, "uuid": "516a5a11-4937-48fb-88eb-4f430fc826fd", "comment": "Malware payload (GuLoader)", "value": "8d38b5eb68599fe57d3d7bfa49014fe7a531eb03", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654698395, "uuid": "def79c9d-96d4-4774-a9f5-416237192966", "comment": "Malware payload (GuLoader)", "value": "35060e05d0de2c8f2f78bb1934d35d6e9bcf3f7951bd0561916c00b43ca32c641e87055041dfa1499a9951bd1cf69c9e", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654698395, "uuid": "e35b2a8d-b51b-492a-bd6c-3df673cd4c42", "value": "T16FC3B3D2350D2AE0FE0572617C2DF6874FB132378DDF802567716C054B6A429ABA9A3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654698395, "uuid": "d841e46a-0fba-46b2-a90e-21ed1792437a", "value": "1536:P0lq9yGFJ5VRuJUFx2X6kRk1J/yvCXMTXurenMiC2KeJkZJQEbum+RbRYtK47SOc:P0R2TRWy/WCXcYviCwJkoI42tKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654698395, "uuid": "5456f511-a95c-43af-844b-2ceba2e7104f", "value": 126331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654698395, "uuid": "b01db97d-7a00-4512-adf7-e1b0de453050", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654698395, "uuid": "467d4144-08ae-48cf-91dc-736079f1ac29", "value": "draft_doc873838272823738.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b330785-e6d1-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654654846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654846, "uuid": "c9551867-5b5b-4d8c-b7bb-724b40b05432", "comment": "Malware payload (Heodo)", "value": "bb3a0f9b588a09ce5aa38947ebaafcac", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654846, "uuid": "9d71d0e4-b86f-40fd-baa9-adabaeea4031", "comment": "Malware payload (Heodo)", "value": "d6c936903d9f90098b1c771844db94a140dec8e937796fdd4e820803c5c4c3bc", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654846, "uuid": "75718ff1-f802-473e-8740-87fd2ce6b424", "comment": "Malware payload (Heodo)", "value": "44b99128a30fa8f25be508cbd5ced5d895c20eb2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654654846, "uuid": "8d89cb3e-89fe-4a26-a158-386cea328836", "comment": "Malware payload (Heodo)", "value": "606a73984743ee09981138da5c4d0f7984543843715bf2c3e41a8491648009b27f9e219feedcc98917bbff4f46479747", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654846, "uuid": "3d4eb59f-1829-432a-8103-deb9c5c3e50e", "value": "T1C204023EE5031A98C22ED8FC58EE6DF9D5F634006268063A1BA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654846, "uuid": "3e78cc77-a5f4-46d3-a94b-ee82ee51d3c9", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654846, "uuid": "74401690-ead9-4bf3-82c9-7ad0351c1c51", "value": "3072:VpjftQFs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VRmi1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654654846, "uuid": "f42cea85-042b-4a96-a49c-351724934606", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654654846, "uuid": "da2b9695-a014-420d-9017-fc1b007bb83d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654654846, "uuid": "61f22df0-cfb6-4d40-9528-0304d35d0c07", "value": "bb3a0f9b588a09ce5aa38947ebaafcac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f169c5-e70c-11ec-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1654680156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680156, "uuid": "05c4c349-96be-47c9-a83f-a093cb3110fa", "comment": "Malware payload (AsyncRAT)", "value": "b57cb6e7ef951d5ca76d666e08389d43", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680156, "uuid": "c1914c1a-e08b-4b11-bfbd-94222160a512", "comment": "Malware payload (AsyncRAT)", "value": "d6caa476472a10f6bc34ebf48720007630402c018be46aed90489ee0dd375d05", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680156, "uuid": "3eac84b8-ae0f-4365-8795-bf5a32f3b839", "comment": "Malware payload (AsyncRAT)", "value": "6ec61ce7803142fdb462a9c4868c252f23f47e3a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680156, "uuid": "4b990298-ee92-47b9-a31f-65a8ee75b044", "comment": "Malware payload (AsyncRAT)", "value": "6e1c1515e119fd79406532cad73956a2d9c9d30151e3a73fde7243ee5cd07d8656916750005412401fa4e954bc02cd9b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680156, "uuid": "f4efb353-a4c1-4a92-b70c-a3246ee486ca", "value": "T15AA23F4FA636D02EC8E00F7B452ED2B1F1767D0CC1A1535C3BC7BB2B1AB97942905966", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680156, "uuid": "1aa881f9-1446-40a2-92c4-462a120e497b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680156, "uuid": "1fc17989-5698-4532-bc3f-f995f55e1446", "value": "384:k0FAtAHiudjHY+0tdeZlqHSiAHjHaH4HPHyHeDzGHHHHeTT:IY7Y+0t4LRHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654680156, "uuid": "2604a179-b865-4aca-8515-3f4c072a7d29", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654680156, "uuid": "315e8641-8cd3-4055-887a-204011435d7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680156, "uuid": "ae76afa1-c5d0-4303-96c7-b9062c833579", "value": "Halkbank_Ekstre_20220607_082357_541079.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e41c2259-e728-11ec-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1654692335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692335, "uuid": "278120a8-1416-4479-9a0f-e71a5f1ad6d5", "comment": "Malware payload (SilentBuilder)", "value": "7a5ff52f9f46fe0636ba671c45efe587", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692335, "uuid": "29871b8f-5f29-49cd-9eb3-025773f35583", "comment": "Malware payload (SilentBuilder)", "value": "d8fe67d8dd8e4f6127aac98bf51ddf26840584e438cac3ff05cb698d9e5bb7ef", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692335, "uuid": "cf716722-ab16-44a9-8758-0495c51a581e", "comment": "Malware payload (SilentBuilder)", "value": "d81e094e58cc3a49784dfe5667ee4abe679edf44", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692335, "uuid": "eeceb44a-059d-4b9b-8480-c3bfbf5da827", "comment": "Malware payload (SilentBuilder)", "value": "865932fd65529f314ecc1394acd22fd05303c7a3c50e17e4f38839fe789add0c9e7b7b93bb3e0c357921630778e585f4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692335, "uuid": "355f67b6-65f6-4bf3-b4de-5e6504bae006", "value": "T1B323A446BB5AC85DF914873448E747AA7323EC314F6B0B433669B3256FF89A05B0315B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692335, "uuid": "e178e7c3-7ea8-4e3f-b727-b1c5ff00e117", "value": "768:pDMPKpb8rGYrMPe3q7Q0XV5xtezE8vpI8UM+VQTUs77quK7KtGu6Q:pYKpb8rGYrMPe3q7Q0XV5xtezE8vG8U2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654692335, "uuid": "6dd83bc8-80c0-4b82-8481-50a858c13047", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654692335, "uuid": "366c23c7-0f28-4fa6-ab33-aea562583f01", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692335, "uuid": "a6c7c7aa-d672-4d31-bbd0-1a48ba5a57c3", "value": "Invio documento rif.88794627 del 08.06.2022.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbf01989-e6d6-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654657102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657102, "uuid": "d8a12afe-3f8a-45b2-869c-a56fa9d1d966", "comment": "Malware payload (Heodo)", "value": "2e7530b4926f5c54aadbb7542267afbe", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657102, "uuid": "a29fb5c7-8ef0-4aa4-9fa8-0edc4d45319d", "comment": "Malware payload (Heodo)", "value": "d9761d9a58ccfbbd22710eadaba84bc925ee2e92cdea09ad49dc549e50cbd07a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657102, "uuid": "f67a0bf4-0318-4693-8ed1-6fe6d09ba23f", "comment": "Malware payload (Heodo)", "value": "433da20885254c6a16dfbda42a9f8f60bc9cd035", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657102, "uuid": "7d9f0833-5922-449a-b253-a6fc8d0bbaad", "comment": "Malware payload (Heodo)", "value": "5bb180c81d3aec12db0203c4a1035c2bd5b35b1d84b7e28de2ea8e3b958bf94791e5093a0fe134d355a8c9e9354d0cd6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657102, "uuid": "12dd3cf7-c07d-4be8-86b1-08ac21da6f10", "value": "T1F204023EE5031A98C22ED8FC58EE6DF9D5F634006258063A1BA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657102, "uuid": "033a3bec-5ffb-4076-a335-e2b2cbd81b03", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657102, "uuid": "96738eb6-fcad-43ff-aef6-613e85c05188", "value": "3072:VpjftiFs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VRMi1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654657102, "uuid": "a4c0dbe2-4583-4de7-bf87-4ac27eff53cd", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654657102, "uuid": "0aeb427f-a739-45e2-ba11-9ab1b2eda9ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657102, "uuid": "5872ce2d-29dc-4422-92bc-69d6cf720d19", "value": "2e7530b4926f5c54aadbb7542267afbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48f3396c-e73a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654699805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699805, "uuid": "91252bb0-061f-4880-a510-af3d745778e3", "comment": "Malware payload (Mirai)", "value": "8ee37cad0916a4dc811aa5449807ab54", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699805, "uuid": "b973dab3-c9ce-4a7d-9090-e088e0eff401", "comment": "Malware payload (Mirai)", "value": "da85fdbb5c94c2ac669074f1db9e5302f4573f0fce4c7c05db24c66d4c07f75e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699805, "uuid": "80da8309-3b25-4ad9-9d5e-feaf542b8dc4", "comment": "Malware payload (Mirai)", "value": "00fdb44f9f645abb5c84b8001e3a4b95089eb704", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699805, "uuid": "1b2c2e12-82bd-4680-836a-193a8e019f0e", "comment": "Malware payload (Mirai)", "value": "3c83bcd6b6f0d396ff0af0f2311f25df10cfde61a37bc4e428945cb105a99f10e3e3fb530ad98e9b9b7d91a12e860883", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699805, "uuid": "d3cc99b0-c2fe-4f35-8137-f19434bdcf4b", "value": "T11DB2E1B161CD7A70CAB0C435D1ECCE476359A7B9F0FE32E22630459015AF6697A78387", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699805, "uuid": "6d7ec368-fa2f-4801-9b9e-58b4249e7eaa", "value": "384:obZciv+WjgXQf2GWu75YZfRttIBDu/jy9IDGLkFx5/kj3K14y/KhymdGUop5hZ:obZcjWjgXQf2108fRL2We9I2wtkjK14g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654699805, "uuid": "e7a04768-a825-4231-b663-a4935369431d", "value": 24072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654699805, "uuid": "23206f37-3166-4c97-910c-2f093c31c112", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699805, "uuid": "aa0a3203-5f80-4ff0-9b3d-14e903780dff", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd409630-e6fd-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654673855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673855, "uuid": "27a6f522-eb07-41e8-8675-5f4049490ce5", "comment": "Malware payload (Heodo)", "value": "637891a401d75110883e1bd0909fbff1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673855, "uuid": "387170d1-ad62-4b9c-a1b7-b5aad1fd9b95", "comment": "Malware payload (Heodo)", "value": "daef50b35308e4e3641667c306284d53455eb24de7d1247c6f02be62db8edc1f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673855, "uuid": "48e4a164-d7d8-4fc8-84ea-fa8bdfaaea9b", "comment": "Malware payload (Heodo)", "value": "f1ce6c33ad44304f6f4697c395b6b8b99ec95790", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673855, "uuid": "411e16ac-b44e-4a31-b6f6-ec09bb537140", "comment": "Malware payload (Heodo)", "value": "b9cc035f8b4544139dc3ee14113d6c4b93c651d0a9f2ce9b0a99f532e63d9d766ab0edd7874f8a11fd09de410f5722ef", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673855, "uuid": "491015f2-15a7-4a48-a702-85a598a05329", "value": "T1F644C089A7E1ADDBD51407798DD6D324333EF2814B8387076B2598390F23BA4BFC5645", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673855, "uuid": "6b3672fe-9cd1-4a72-8694-e6e0e7433d13", "value": "963f2e88a5b03877d0583808b2526c1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673855, "uuid": "6407d720-04d7-4514-8aa9-84154114d36f", "value": "3072:7R7Ne82w+Oh+UjuFJrfr7CS/FmikytkqroMdjaWtHCqPZ4PEx2ES2vZg3f4L5ZJi:7lIJuk4uFxOmFwytLVxDtfPZ4PE2sPs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654673855, "uuid": "195d1af2-b00c-4309-a764-ad59cab65603", "value": 270403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654673855, "uuid": "8cd1eb8b-1191-4124-b35f-8b181b8f9d84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673855, "uuid": "6884837a-c9be-4aff-8cc8-3110d0870885", "value": "637891a401d75110883e1bd0909fbff1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76f3163f-e742-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654703319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703319, "uuid": "fb691c21-a5d9-45db-bb87-6c369464c01e", "comment": "Malware payload (RedLineStealer)", "value": "5bd5baf859e753445ee153baeb522e98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703319, "uuid": "a1f646eb-8aad-463b-86d8-f12c1670b6a6", "comment": "Malware payload (RedLineStealer)", "value": "db395645679561cecdf86cb489afa180908d3a88a64c64fd0b5421b71329a13e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703319, "uuid": "6cf86a14-919b-4506-8b77-0ce9205ebd48", "comment": "Malware payload (RedLineStealer)", "value": "2176b33a195d20508a7d2d6ae1e92a9ee20acf10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703319, "uuid": "0a1ba87d-cef7-47ef-86bd-81bc1cacb93e", "comment": "Malware payload (RedLineStealer)", "value": "8d0b18f5e04fdaa77d916f453d67a2c843e1f71bba57120256853d05af7dd40412144b32a4244ba732a174b464193287", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703319, "uuid": "34e8eac9-92e9-4e2e-84a8-d71e04740169", "value": "T1A263F147AE8DB973C65D033D40AB93445B688222B246D79BBE0090CD5D0BBD35637B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703319, "uuid": "48c75fd5-65e3-4393-a729-98c917d10490", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703319, "uuid": "cf71eebc-7192-4a92-95b4-d476e5f9cdbc", "value": "1536:52BTTHIeNcIzdsU4S/NiZdgiQ1DpYENt7UoDdOrzv8Uq4UbstBr:56TTHIemIpsONodgiUHNa0Orz0R4dt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654703319, "uuid": "af3a574c-076f-4e8f-ad2c-c55ad80152d5", "value": 69120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654703319, "uuid": "eba833aa-e179-4fc3-88d8-acfb858d472f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703319, "uuid": "601210be-5518-4081-8e22-fa228e5df513", "value": "n.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34e72e3e-e75d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654714804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714804, "uuid": "5fab49a8-5353-407b-aa3a-6a36fbf70bee", "comment": "Malware payload (Mirai)", "value": "c1aa994ebea217f651980a89fce712e8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714804, "uuid": "5804baf1-2796-4b50-b8e6-244f51d61138", "comment": "Malware payload (Mirai)", "value": "dbaeeb0cd493bf73afab78674f92812c9132d72b3f1f51ad2343a154c4763150", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714804, "uuid": "cdcb018e-bea8-4c6a-b93c-a1e8f8981da9", "comment": "Malware payload (Mirai)", "value": "4567473fbcbca8cf5b442a72595ef935a4cff4ad", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714804, "uuid": "2d15460f-7514-4cdd-9036-1b919432a5b9", "comment": "Malware payload (Mirai)", "value": "6af6f53f9a85bd6cf42c3e584f009b1768bb0a241af8372f071aa7035b46715d19b3232663fc2104167f723f385bfc69", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654714804, "uuid": "17bbc686-73b2-40aa-829f-25cc452857cd", "value": "T1F433E74AF9819F00D4E525BAFF4E518A33535BACE3FE7112AD251B2127CB96B0F36502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654714804, "uuid": "4e6721bd-7fee-4196-8094-38eae9601b3b", "value": "1536:5hneZRpkpZ7BocGTC9sQllUwixwOd1gHzh:GCT7BocGTvDwOjOzh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654714804, "uuid": "1ac6e0bb-e72d-4b28-8145-b8dba737d954", "value": 50628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654714804, "uuid": "55ee18ec-a18c-4d39-804e-672d0f830c3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654714804, "uuid": "78a25c7a-8f17-4506-b076-48584c383c3e", "value": "Boota.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63d48387-e763-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654717460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717460, "uuid": "b1bfa9ce-db8e-4a31-94eb-7e5cc3c85d59", "comment": "Malware payload", "value": "c710b409d37c011790816cc283da049b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717460, "uuid": "da94201b-278e-4711-8160-ee2a7690e2ac", "comment": "Malware payload", "value": "dbca0f3a0c96f72939ec4490aeba237cb6ade5e1f0916cacb217363bddc529ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717460, "uuid": "14eed259-4322-4e87-9d60-1dff07dc1d1f", "comment": "Malware payload", "value": "0bea88ce5b819094e9dd29ab0727719ecf895078", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717460, "uuid": "d556f413-b187-48a7-bb4f-22e365021661", "comment": "Malware payload", "value": "2c1e991ceb1e94601515c6484ce433d37b18df5c25179362d13737868199305672a5a0ef6f7d0fc75c7f62f26e632c3b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717460, "uuid": "e975c7f7-ceba-4cec-ace4-1401fc378c70", "value": "T150F2E1739188B072DA541835A0E906C7337D1EBCF4D3621507CC97ACB66A0A7AAFF50B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717460, "uuid": "432f8607-0c5a-4918-9fa4-a2c0250a328b", "value": "768:inhWYMpSp93FZKG0E0hdyS2SNXcp9+5fh/JXWU6CQ5K3UZ:inhWYMopoG0E0h92S6p9+dh/JXWUo55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654717460, "uuid": "c0ce0ac4-9577-41fd-a673-8c8074f34e9b", "value": 36940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654717460, "uuid": "3a545a61-a043-4435-92ee-05f89a5700c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717460, "uuid": "0b71fb78-5160-43a0-9f64-5d3a809b0d72", "value": "c710b409d37c011790816cc283da049b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81b738a4-e6f8-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654671554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654671554, "uuid": "7e93c6f2-101c-4320-9242-7e62c6503731", "comment": "Malware payload", "value": "04de96319b54d784ab6eaeb8e04432ad", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654671554, "uuid": "3c4389b4-942f-4df0-998f-7301aae7255c", "comment": "Malware payload", "value": "dc9926a30776d5c36c52b7120ee40e03d0f3781e868920fa199032437cdb4280", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654671554, "uuid": "f4403583-7b7e-4839-91b3-e3401c65e891", "comment": "Malware payload", "value": "a8c584bb4f5b897ab098cbb0eb0e26c07af2b196", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654671554, "uuid": "c17b1449-3914-4b2b-8741-88a768d6ee9c", "comment": "Malware payload", "value": "1a129c28e7db0362a5fa7ed8f6a2364902b98f5329fd67426d2043e93efb4e18a7aa8cd7ea7c14e9f58837d1b1681f5d", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654671554, "uuid": "d6ebe0ce-3dbd-4515-944d-616d299e4b9e", "value": "T17384237526847D908F557947F9B627D0D001EC136AE57CF382A9081FEAB89CE2F029F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654671554, "uuid": "0f804659-c72f-4a54-9337-384081c1cfe9", "value": "6144:kcD8gDPuJ37WXZ2lP4igTv2VMv0GIAqIPjeGzUEICFQv2LUPQAQSBu2+bO3dAylP:N8mZ2lQisuVJlAYGzDuvz4AQNrO3dm+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654671554, "uuid": "4294836f-09bf-4147-b524-e7adfd988fa3", "value": 396663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654671554, "uuid": "18330502-1522-4cbe-9763-db68537f6322", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654671554, "uuid": "40581b25-a86a-4d8c-9ccf-b3ee45e5bb97", "value": "Shipment Documents Copies (ETD May 22----ETA JUNE 29)]]].r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43903510-e731-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654695931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654695931, "uuid": "4c8b5da1-2665-4048-a6cc-57597cf1a94c", "comment": "Malware payload (RedLineStealer)", "value": "de5671e8ab3b98ec3a6a4d3ae4db78b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654695931, "uuid": "98d75046-8a94-4d0c-a332-e41393a2b60d", "comment": "Malware payload (RedLineStealer)", "value": "dd93a1e06921baeb755bfc0397d4c9896b8a152a0ef12c51980ba5503f9c8dd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654695931, "uuid": "414b597d-8292-4ea4-a5bd-a2c7fb9ed509", "comment": "Malware payload (RedLineStealer)", "value": "6378cf2911b63859c86f1f1d688118aaad15d703", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654695931, "uuid": "cb680a59-551b-4248-93ed-6e9b62133dde", "comment": "Malware payload (RedLineStealer)", "value": "f97413e6743d89915a5bdc0403fe43bd7fb9d7356bce2e0b68c4e2dfa523d1e22303779fad93dcb32a6794f5dd78e390", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654695931, "uuid": "7952db47-d24c-463e-ad4c-9a0a5238a37d", "value": "T19354AE1B70A1C432C4B2203539F896B46D3DBC70179D5AFB67D81AEE4F246D2EB319A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654695931, "uuid": "a8e8e5c0-95cf-466c-b4df-775212f8d4fb", "value": "30bd52970a0ab2c057b7c31f539e387f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654695931, "uuid": "e52f4664-4073-426e-a9c9-686f609ea738", "value": "6144:wyfsVivI2H5zSFNxQfgAO1lyfmbZ7mjOff7EG8P+JrXocWI6dg/kH4CXuP2EmiLn:wusVivIkNg3ofr1RSJ357u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654695931, "uuid": "2116ed29-2805-42d5-ba85-15e4274c9fb2", "value": 295936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654695931, "uuid": "a6966cdd-dcf6-411a-9292-e32f7f8feddb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654695931, "uuid": "f1efc805-68a7-43af-81d7-b7505648c2a4", "value": "Bit Miner v3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f55169b-e750-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654709238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709238, "uuid": "f046c086-c7fc-4d15-a12a-e028aa3461f0", "comment": "Malware payload (Mirai)", "value": "825bf094fc4d7d6938e88d7a9199d8f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709238, "uuid": "49a97ea4-f2db-44d7-8d99-afa06e53d5c2", "comment": "Malware payload (Mirai)", "value": "ddb8eddd1a47c603196389bbfb6044ecf5568df876828ef4cd09b37802278553", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709238, "uuid": "16d70cb6-34f0-44f9-83e7-125f452aba1b", "comment": "Malware payload (Mirai)", "value": "2494a88af4e315621536c809e65f36150ef8c74f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709238, "uuid": "70ca3e63-d316-47ec-bad3-58245abd6e4c", "comment": "Malware payload (Mirai)", "value": "b8adc8dc542e654b94bdde5e1eaeaeca365288aa09d7ad4a35d66cef6ac092a56adaab738df417ffb3b03a269918ae76", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709238, "uuid": "341b0303-1cec-41f9-a99e-23b0eda9faae", "value": "T1F253BF32D41CAD90D1690138BD248E785763F50965A72EF64F968BA68007EFCF62C3F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709238, "uuid": "2635e8fe-ec2c-4f38-9981-5c11ec7d2a9d", "value": "1536:M/ov+7AZOuaBwtFie0Q5qP4naFbaTop1V7CVu:MgvGYJi7eP5qFbaTop1V7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654709238, "uuid": "aa4f5f57-a098-40cf-887f-e7d48b61fb90", "value": 62500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654709238, "uuid": "c5b939fe-80c9-40cd-8f53-895e78807bc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709238, "uuid": "369a32b9-4704-4d73-95a6-12a429d1e2cf", "value": "825bf094fc4d7d6938e88d7a9199d8f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca7bfe61-e70b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Tofsee)", "timestamp": 1654679836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679836, "uuid": "a5e259ab-b12a-4ba2-9d14-4a8b4e4cd3ce", "comment": "Malware payload (Tofsee)", "value": "9d1fe9a2662b8197482fd35c451577ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679836, "uuid": "aa1c468a-4777-4de9-8611-3bb1608b44fd", "comment": "Malware payload (Tofsee)", "value": "de2146a97f1318d0957c808c23fa813c64955ced2187cdd2cef9d4971f5fc3a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679836, "uuid": "b52d37b6-ff43-4264-9e01-1805627fe2b0", "comment": "Malware payload (Tofsee)", "value": "da070a55592640ca42b9e4f38a3f7c3eee2522c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679836, "uuid": "57457f93-fea5-4b51-837a-cf74f2311df4", "comment": "Malware payload (Tofsee)", "value": "fdf7c362bd6898c26b709a7d5cb3f4a90bbeb1a944469c6d3daa8a791fac5e1645800dc02be777931ef041e62ee28a7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679836, "uuid": "cc6f772b-89b5-4da7-807f-10d4ec90b901", "value": "T153648D10BB90C435F5B352F889BA93BCB92E7EA15B2454CF52D566EE4634AD0EC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679836, "uuid": "c21c93d8-0981-4682-a2ec-35f8ee68b256", "value": "3bfd7473e430500ed1d2bf7635bb6b63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679836, "uuid": "deefc7c3-968b-46a2-805d-923a876c16ad", "value": "6144:kzY+0IhBysCn+ztMw/Mo4qXDBOa8TdUBcgedJi7Pn:kzYQByF+pMw/Mo4qXDBO1wcg6i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654679836, "uuid": "7d77640d-28b8-446d-bf1a-ba6124f7924c", "value": 316928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654679836, "uuid": "c289d9db-09ec-4e2c-b709-fcec4b75023e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679836, "uuid": "ec27d553-62ee-4c71-b5c9-f3f7a55d4e92", "value": "9d1fe9a2662b8197482fd35c451577ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d728e994-e6f1-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654668691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654668691, "uuid": "2c59ea1d-d863-420d-b1ac-5d513735f6e1", "comment": "Malware payload", "value": "2165d465b42aef3c94fd385408ecc1d1", "object_relation": "md5", "Tag": [ { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654668691, "uuid": "d1cd4b54-d67a-44bf-b1fb-7d52ca79ec88", "comment": "Malware payload", "value": "de25b5093187d3590dda5c6969b595df1824747de636f00b1ddac66ce6e98e61", "object_relation": "sha256", "Tag": [ { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654668691, "uuid": "67f2c86c-19ff-453a-9953-bbf1edf9b6bd", "comment": "Malware payload", "value": "7df874850c01cd187b0dcc14bb7200fd424e5e0f", "object_relation": "sha1", "Tag": [ { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654668691, "uuid": "9edb6f9c-b876-4494-a52d-9ac738764e40", "comment": "Malware payload", "value": "0ce0fc7a28d29a4a60d182bb27987aaddee5d0ca85bc727e63fd07dbc6c4a0ca7f82b0bfe9d75142302c3b671a0464b9", "object_relation": "sha3-384", "Tag": [ { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654668691, "uuid": "10185f01-9e19-4099-bfda-0cc80953e048", "value": "T1FD1523344EA0986D56CDC214971BAF4E4FB41367E02978C8EA92B4CB37CD7838CAD635", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654668691, "uuid": "967a66d9-6f09-4f1e-94b5-ed49fb062b00", "value": "24576:NYFR2gLS5uuUj4gEUARhm+vbXf2iFUcBRfSG:wS6pgiZcLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654668691, "uuid": "e4b5754d-b7f1-47e5-b2d0-ce45a936d0e6", "value": 933235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654668691, "uuid": "28b539d9-a706-442c-94b2-da5403693c4d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654668691, "uuid": "83cb4bab-ab78-492b-b504-c91e4e731b41", "value": "folliqbot.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc06a4de-e70a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654679490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679490, "uuid": "fac660b7-28e0-45ae-939b-eaae38de034d", "comment": "Malware payload (Heodo)", "value": "a8663d2ea8a7f72d1b30ea52bc3f926f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679490, "uuid": "afd10a58-f297-412f-9501-34f4e5ddccf0", "comment": "Malware payload (Heodo)", "value": "de2d20491a27af4767a002817b9df1be5f41dbe19ca57cf1422f20f0f0209d2e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679490, "uuid": "1bbb55ff-7e9b-421e-af94-217f3a085ac0", "comment": "Malware payload (Heodo)", "value": "3cfb4b86800952e4e1954544039d2bf580daceff", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679490, "uuid": "ebd7ebce-8922-4752-a60d-2fa0f5b67cf3", "comment": "Malware payload (Heodo)", "value": "9897bc8f83900903576d01eee09cbab6847d8b948452083fde312ff6465844b155ed157ee90b9fbf5f0561cd1ba964eb", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679490, "uuid": "2fe9a423-c42c-4cb7-9471-1a52358aeebb", "value": "T1BC44C0C5A791ECDBD92503790DE68364233DF2806BC74B033AB59A360E73B646FD5688", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679490, "uuid": "6f38c18d-0e2a-4d37-b7a4-126249003205", "value": "963f2e88a5b03877d0583808b2526c1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679490, "uuid": "1a008f26-325a-4d97-9a11-a308ec1ea0be", "value": "6144:M1UyqUcchr3fdAdmG9rjcOLDNffPwz3GzMc5:MJccxfzGBcOxfHQ3GzP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654679490, "uuid": "5acb98bb-398f-4b9c-b60d-1a319f942cc5", "value": 274499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654679490, "uuid": "209e9db6-c3ba-4547-8ef5-33c76d9538f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679490, "uuid": "d53e1b61-10cf-4d79-a555-1e25dee1b403", "value": "a8663d2ea8a7f72d1b30ea52bc3f926f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78db4238-e738-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1654699027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699027, "uuid": "9802a2bd-5d8d-4f64-82be-aaf82179667a", "comment": "Malware payload (Loki)", "value": "9a1021a8710e70067aaf02eb85f38d2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699027, "uuid": "678c718b-cab3-4832-95f9-0b2a2a37946f", "comment": "Malware payload (Loki)", "value": "de50750ee78194b412f3089ae953e5851bf3017f23246663d22f05ce3a29d9e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699027, "uuid": "a4cf2453-0f8e-4d91-bef8-584d9c1a5564", "comment": "Malware payload (Loki)", "value": "f303fc5a827682417e7748e22c0aa934a34b571c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699027, "uuid": "321e4275-ea87-4a4e-97a5-548b043e29e0", "comment": "Malware payload (Loki)", "value": "1f0f7dfebae1ece55971fccbccca1d9f947cbf1d14502a0e5ebac8db0f9c2eb5bfb47f24ec0599a17a0c8a24660fddc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699027, "uuid": "f42d45b2-6d59-4f36-aae1-2de6014850be", "value": "T107C4F0F09FF83965E12921737464613C37E29D1ECC659A3AD68BF19B3067AC210E1E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699027, "uuid": "7fbd7217-3a5d-494c-b3f2-3bbc4a10faab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699027, "uuid": "4ec70f4c-c42b-4d3e-b7a1-4635112a6f32", "value": "12288:PNkm2iN/I9qoAK9mG28njvER5qmFULie2M3Telz+JtGXpyZq:F1pIvmanTER5cLie/e4aYZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654699027, "uuid": "aa842708-ae8e-4160-8c92-a9956edf4498", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654699027, "uuid": "5b472570-d892-4eed-911f-11b05c97c60b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699027, "uuid": "65a44be3-67bf-4a5c-af25-a45d02098031", "value": "ehAVJaSocCMlMOg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a853493-e731-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654695943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654695943, "uuid": "9dfe9038-c7f6-4700-96e8-0a30c8f7ab22", "comment": "Malware payload (Formbook)", "value": "eb0207a19c2f35c65c42c780d6cb2626", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654695943, "uuid": "1d146741-c0a5-4b01-9346-ca1f3032e9a4", "comment": "Malware payload (Formbook)", "value": "ded5b8b5d57f0e7d66f85cfd7067af3a22e6ce2877cb4d1fc5eb88963559316b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654695943, "uuid": "1c1eebe0-db2b-4a83-95ec-27979fa3a2a3", "comment": "Malware payload (Formbook)", "value": "23a617e8ede77cdcad02dfc33092eaf3ed685138", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654695943, "uuid": "6370dfd3-36b5-4452-a4f8-75b5261cc361", "comment": "Malware payload (Formbook)", "value": "e40a5ad0f36dcc5493a3b8b84504d277247956b2c0023276b336ea6892fe4cb80209879daba49ca96937eda70a5b86e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654695943, "uuid": "f0f23875-3e4b-426f-8cdd-d723fa1db555", "value": "T1207333E2B616DDD8DC164BF20C76962000675E5C88A9D50D30EA3F3FB7B335328A6D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654695943, "uuid": "1855ddcf-4840-4c96-8e72-c6040fa71110", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654695943, "uuid": "e603da6e-b4cf-415d-ba54-4e686e0d3b72", "value": "768:dKvCWiiP64bYjSU2Ip4jBqltCF0AxEjenoB69+Fxk:M+iP64bYjSFHBWAxEjc+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654695943, "uuid": "820cc69f-0e69-434d-91a0-ebb5747e6906", "value": 78336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654695943, "uuid": "176fca11-fbeb-4c84-8fc0-680e5cc8b14c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654695943, "uuid": "9cb3d293-f91c-422a-9aea-c2a6a257ecc8", "value": "MT103_Ref0012773838 Confirmation transfer Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70da2147-e729-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654692571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692571, "uuid": "5892963f-e64a-40f5-9bed-5f9ae2fb36bb", "comment": "Malware payload", "value": "0a3c237663239fa5c6ab92fcbc7f2b7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692571, "uuid": "71198523-22b9-446d-8146-a8021fde9708", "comment": "Malware payload", "value": "deeea987fa0b3c68e0c45e4ee3536fa4f415f0e44709d67dce68d3543d8ecc6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692571, "uuid": "079ca136-3342-40e0-9549-60e754145408", "comment": "Malware payload", "value": "3323fac8d1cc39d37fcdeba0a917e6066e310a03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692571, "uuid": "0c846b3c-ed47-428f-9cd3-fbced99f7f15", "comment": "Malware payload", "value": "ee8faaeb4480a4385663749bf9edaabaef81fdd71edde245098e0787bc74058ee8f4666b3db638a262033165816a5fdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692571, "uuid": "b4475951-58f3-4f5a-8e89-2fc76e4ad51b", "value": "T119817503D9A848E3D80ECFF9169F0A8D5EB814021176E8725A6BDCC9C2B874570163DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692571, "uuid": "bef85c0c-8fc5-4549-b7ae-6b495a735c8b", "value": "5f8a1f2347e2d70603d8e0bbe442cf34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692571, "uuid": "f7f5a572-5e93-4291-ab49-7333745e2010", "value": "48:SoWovkiF1b0a5olYAehypweotY5ol7TzHpc8lzLelgt3YfKV67jIWM:kof0a5oKtY5o5vGSvelWoSQvr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654692571, "uuid": "7f8eec73-6a26-4f84-bc7e-2665812c3fcb", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654692571, "uuid": "35fa66cc-aa10-42c0-8455-ca11d32b35e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692571, "uuid": "7f39e731-4125-46db-ac3c-6cd8b0a4bd1f", "value": "SecuriteInfo.com.W32.AIDetect.malware2.3268.1060", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b8b96a6-e6fb-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654672832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672832, "uuid": "81b45bfa-a283-46a8-ba41-6c958b5039db", "comment": "Malware payload (RedLineStealer)", "value": "493095dd7d6f9571de627e339d22edee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672832, "uuid": "ecd03e84-0279-4ead-bb09-ae73146d01a8", "comment": "Malware payload (RedLineStealer)", "value": "def4337ca193c1f12040948f1d5df46215d163c6d4a04080e3b29b30d0c2f05d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672832, "uuid": "3ab78378-2596-4c86-851c-438c8591400e", "comment": "Malware payload (RedLineStealer)", "value": "802e0d27c59bdec0fb18cb4beb1628db01e059d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672832, "uuid": "faac1c56-4deb-4b0d-86ca-b8c874e514e0", "comment": "Malware payload (RedLineStealer)", "value": "b61817da7e7f20f470a7b1c10154057e4c08e65af6b6c53c31f7e4fb70d6271f5e9610d39971b4ec672a04e59700d948", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672832, "uuid": "2daafb95-b19f-4833-98a1-6b5704514669", "value": "T18EE4E080636AAD76F23C5377647091042339361EA5FCCA2A57AD70CE24E27835AF2F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672832, "uuid": "32a77686-85ba-4744-a769-c8e0ff7cd286", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672832, "uuid": "63286fe6-6726-4025-94b7-48f32dec0202", "value": "12288:INl/hI72iNJ9qhzVC6l/29B9oL1jqLb5pCh5ckd2xgWQ9q:whI71zkXcBC1mfY2xvQ9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654672832, "uuid": "92e5e2bf-cc2b-4be1-b748-6ebae9fe3395", "value": 680448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654672832, "uuid": "78eae993-abd6-47a7-9b7f-144ff3746dc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672832, "uuid": "e4193688-bb82-4437-afeb-0d45755a7127", "value": "Invoice080622.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c3b62ab-e6ec-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1654666364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654666364, "uuid": "8354a56c-a812-4a6a-9357-181ada8eb6a2", "comment": "Malware payload (GuLoader)", "value": "f35f7b965d212971299c149729ae78a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654666364, "uuid": "922b7062-44f8-4075-8a8b-da23b6b164ae", "comment": "Malware payload (GuLoader)", "value": "defee86548df8ddf112e753907244edaab538b7f1a337293422079e73e2c961d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654666364, "uuid": "a4e8c1fb-d214-4e7a-b64c-445ff288b686", "comment": "Malware payload (GuLoader)", "value": "fc029ab89a290899c86569d5261bc20adf423fef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654666364, "uuid": "29fa0c0d-3521-4aa9-8feb-a6eade5520e4", "comment": "Malware payload (GuLoader)", "value": "12e70a876d3e8a79328c0626aee566ef6e93935ba3f6fa7e0dff15314c3ad66ba2e20f7eb09f30632208bdeb6aeb0ef2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654666364, "uuid": "dbed3f19-1f58-44d7-8009-73e8eb15cfeb", "value": "T10794BFC1F21046EDEC76173668271DA609932CBDD6B5D10C61FA36263FF72A3402EA5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654666364, "uuid": "ea4a0efd-8bb9-4172-9b80-8dd477df7b9e", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654666364, "uuid": "8b381f10-c835-437c-b0ed-0308531f057e", "value": "6144:2bE/HUAWVqB0XCmtzPZ2NtIPdk+FAFOSpuGD2SG+ZZ64v0e:2bBW0XVtDQNtGdkgAbTZH0e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654666364, "uuid": "e8481dff-b083-462c-a560-03dfb288b221", "value": 438720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654666364, "uuid": "55cadcd4-8119-4ef3-a119-64cff1bd300a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654666364, "uuid": "a997909d-3d6b-4c51-882c-c21ed0220e6d", "value": "SecuriteInfo.com.Trojan-Downloader.Win32.GuLoader.gen.2933.20579", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2999eaa-e6fe-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1654674293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674293, "uuid": "bea1c00b-7c52-47d1-9134-b9e097e65942", "comment": "Malware payload (GuLoader)", "value": "6e67220b06e2747e197a40cae63927cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674293, "uuid": "231b6b28-4b2d-440f-bc3d-240ee5721cda", "comment": "Malware payload (GuLoader)", "value": "df4d4afe64a0430b07aea5dd1e760aae2c46e0114bc084aa1795e9d05a78dee3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674293, "uuid": "d44c32dd-3479-4399-839a-3327c8267abe", "comment": "Malware payload (GuLoader)", "value": "f73905afdb9b9b66fab2c544ec556be195293e56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674293, "uuid": "41664fd3-d5fd-4c11-8538-6cf287b42fc2", "comment": "Malware payload (GuLoader)", "value": "fb034889a20705f86cdc2367d3f985b594bc4ec3c9e8cd5e331d10aae8738e6e43685648311f992cf0a5a1df97aecbdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674293, "uuid": "2937c6fc-a837-445a-89bd-980f01f95e50", "value": "T16F052399F9B0CD93D6660972EB10E5FE2B11AC06C89067AF1308BE7C7E752B30909795", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674293, "uuid": "3a05d60d-8cee-4f90-a8e4-a60af771c30b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674293, "uuid": "1523a741-2d7f-4698-bb1a-048fe0d2e2d8", "value": "24576:XY2h+cuuXVlyRQsh7Ssb1k44gAYAu/D+VG6w:o2h+1Yly+sh7SsZZAu/DCNw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654674293, "uuid": "524981fa-5e5f-4bb1-86ce-d00c7dc3aabb", "value": 798888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654674293, "uuid": "92158656-151d-41b4-96ab-3d22ee17a3ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674293, "uuid": "91fe3ef4-dfc4-43a9-a488-7fc5a9145b31", "value": "factura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10a42b99-e738-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1654698852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654698852, "uuid": "e43d5544-0a0f-4369-bf5b-22cbe2519328", "comment": "Malware payload (RemcosRAT)", "value": "ea10ffb56ac31029eb0dc95dbc594bc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654698852, "uuid": "e5498f02-25b7-40a7-bf60-d718f4b11dec", "comment": "Malware payload (RemcosRAT)", "value": "e04e4c474ded78364c1f802de5a653e2d495bc1a0ddb78325962778a221970e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654698852, "uuid": "f298c99f-15f2-48d1-8337-e0c8ef23b2c3", "comment": "Malware payload (RemcosRAT)", "value": "998b311677f02cc88b9f751be7104bdd79d8343b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654698852, "uuid": "f0fd3c6f-e2be-494a-8554-d3381d3853f9", "comment": "Malware payload (RemcosRAT)", "value": "f6469bd348855950704045111b4344b72c4aa39b45860f00602ed1ead46356daa742dec94c65c631dda27d9699f5feec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654698852, "uuid": "78e93f24-cc34-4fbb-81ca-c5315a91b417", "value": "T194A4230DE9C698F7E5239BB014F3A6BBB673F31484816E53479D5F2B61819DACE000B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654698852, "uuid": "21c8e950-7672-4996-9812-f96f7433b967", "value": "dd1742eadfc6df18ded3c26ae64ad610", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654698852, "uuid": "7329d8c4-05bd-4869-8c74-192701e641fd", "value": "12288:uVlg/dgI5/V11cvnzb8JTGwS0xfMAiTpX+BUYCi0q:Yl7I5t1CX8xGw1xf+X+BUK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654698852, "uuid": "103bf10c-d9bf-4e8c-a3f9-6e2826e0b835", "value": 480979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654698852, "uuid": "0134dd3a-9c2a-48b8-b597-2d9d9743cd8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654698852, "uuid": "77480df8-81d6-4c63-970b-24d1f79cafe4", "value": "08-06-2022_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f22f5d-e705-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1654677306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677306, "uuid": "50658e80-ae35-4b4b-b7bb-a3c6fa3c500a", "comment": "Malware payload (SnakeKeylogger)", "value": "c94593d8afd61f25496996470d348f65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677306, "uuid": "7c40d661-f8ed-4d10-9a2c-d19c51eca196", "comment": "Malware payload (SnakeKeylogger)", "value": "e04fde2a3e7b69b2732921503501e2d057582a55ff9b6060b6dd49564de561b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677306, "uuid": "1dcf2789-3a64-4311-aa91-5b11abf33b5f", "comment": "Malware payload (SnakeKeylogger)", "value": "e9a70d553b018ac051d66cae0e794971e4e2ced6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677306, "uuid": "42f16b11-3495-4f1e-8c0b-596b32035897", "comment": "Malware payload (SnakeKeylogger)", "value": "fcb13d135904cb06a429d84826210f5789602e9bc4882482605231576305e429337bf70cf2512fac761dbacb468afc7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677306, "uuid": "29674bd9-86bb-406a-bf4a-8c43931d5820", "value": "T1EFC412366BFD3325E47D1BFAD638D31513B4DB75AC12E2682E8134FE4E52B029A11217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677306, "uuid": "8a9523ba-a0ec-48df-8ba2-810dec93257a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677306, "uuid": "31661876-cf6a-4646-b67b-0f42a1e17d72", "value": "12288:4JO61AEUEiFWhNGZ/UtKGFJyxPkcmTBMY3aahzlf4jKJIue2Ox9:I+PnFWhkZIBBBTBN3jl5JThO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677306, "uuid": "4ed35466-1e7e-498f-9757-7f73d6ce4b24", "value": 561664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677306, "uuid": "8cab0ddd-2333-4bd6-b241-d248ef0b8633", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677306, "uuid": "8ceba7eb-e9dc-42d5-8e23-03c760bc4029", "value": "c94593d8afd61f25496996470d348f65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95e1bd13-e70c-11ec-93bb-42010a9c0043", "comment": "Malware payload (AsyncRAT)", "timestamp": 1654680178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680178, "uuid": "78df54a9-91fc-456d-abee-984f58791697", "comment": "Malware payload (AsyncRAT)", "value": "4da40e8f41f1b89d7c601ae6a68ecae1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680178, "uuid": "4053523b-d224-4f4e-afe2-69fc84d76b15", "comment": "Malware payload (AsyncRAT)", "value": "e119fef64bc615ce5f658d5f7b7b7cf2b7c0a40b80c5a270b3bc6509bc7b02b2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680178, "uuid": "1b7ed40b-0fab-4def-af1c-7c8de06991aa", "comment": "Malware payload (AsyncRAT)", "value": "3b13939d6186d1dcc1146caac0792d6826fdfd17", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680178, "uuid": "6b022d6d-628b-46a5-bf7d-a6472db9f73c", "comment": "Malware payload (AsyncRAT)", "value": "4790f0ccb8c86e814cd56f4b4676ca9782874a793a9188e9e95d9365920c5b52ec13296f18dc5ec010ab2fc7f0204efd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680178, "uuid": "49223c3c-4de4-4624-a50c-d7a5287b0756", "value": "T158B45A9A325C318EC43BC9F185954D20A7667EAFAB27D1275893348D99FC782AF101F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680178, "uuid": "a6536ea3-caab-42fc-a63f-7c86a3964834", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680178, "uuid": "2529b025-6fb6-44e6-bc7b-a373d8aad2c5", "value": "12288:0iXICt3YmwZnwM+doB9/QuLQD8wAe5JHOTQ74qDRNXp:TIC6msMdo/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654680178, "uuid": "7310dbe0-38c1-46c4-8e5a-d5632eab9dec", "value": 509440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654680178, "uuid": "9563afe9-f515-4269-94a6-d3b0b5be6ac7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680178, "uuid": "ac2f419e-4a2c-4743-aa4e-29d55822a92c", "value": "SHIPMENT ARRIVAL NOTIFICATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc4eb3f8-e750-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654709475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709475, "uuid": "274d198b-721f-4571-9ab8-7d40872e480c", "comment": "Malware payload (Mirai)", "value": "01b12a5b2e2348c17125ccc468c761c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709475, "uuid": "17437755-85ba-4dbf-8c51-2a340634ec03", "comment": "Malware payload (Mirai)", "value": "e191a7367d9bdbc7442afd380b7842215775ab67884bda7d82ee9bf28096cc19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709475, "uuid": "7e147ec0-48a8-4a8b-90c6-d03bdb0176ab", "comment": "Malware payload (Mirai)", "value": "09b43afcc350c3082ed4c94ed173bee10e5aa513", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709475, "uuid": "f8687ecd-2bdc-47ca-97ff-d1b7206650b2", "comment": "Malware payload (Mirai)", "value": "d5b5b973331ee054048b67df021570c1e1a977c1895d4a516f57ca92236b006a07024cd21b22a62e17a94e28c40e0713", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709475, "uuid": "d9a9ab88-6fc5-40ec-afc4-e188356e2adc", "value": "T1C6A35B0173268957E59B0DF029FF1BF183AEEC9256B2A106A50EFF940333BE15489F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709475, "uuid": "d475d2c9-19ed-4a2a-9fc6-922ce8f53337", "value": "1536:t3Jpsk5hJBLp3b+/JEtWn9I8QVFxj3aOLHrgfUZKwFy7ZWdMlI:t5pXV7y/JE4e8QVFxWasyyPI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654709475, "uuid": "3bf6eaa8-4b99-4a28-8a97-51a05ea60f81", "value": 99134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654709475, "uuid": "26636a27-d0ce-41f1-a754-e8a240d0bed2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709475, "uuid": "3be6ceb8-ee84-4031-97e4-9426df58b217", "value": "01b12a5b2e2348c17125ccc468c761c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48793175-e731-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654695939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654695939, "uuid": "c4bfed96-01b6-4bb6-9f8b-9a4bb1d39b82", "comment": "Malware payload (RedLineStealer)", "value": "3a7f251c29e7ef274a5f8950ad308aff", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654695939, "uuid": "e894095c-5003-4b0e-94a6-a1a327f9fbdf", "comment": "Malware payload (RedLineStealer)", "value": "e1fd47744a1a9f279a35566852f8efb0712f8325af02d92a34ca90add036900e", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654695939, "uuid": "69230b02-69ad-4ad1-a1ef-0093fdf7a1c8", "comment": "Malware payload (RedLineStealer)", "value": "97c008788bb01fefb79bc0b515b402cb3de2827c", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654695939, "uuid": "ccb029dc-36c7-4202-a37a-0fb43ba02fd9", "comment": "Malware payload (RedLineStealer)", "value": "09415fae175793db80820e1b40415b956b6c0c882b5406b22d5611626982898657ba2e3d64b5ac6160c99de31d10d318", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654695939, "uuid": "1bf7f30a-44fa-401a-a276-071152ed99bf", "value": "T122742344DE374BBDE0EBEAD75E3DA5046144D187C9A02412AAB9183ECF5A1CE772313E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654695939, "uuid": "bb9fcb48-9e3c-4f79-a303-d67ca5bdca7f", "value": "6144:h1NTt+V2YbMnBBU/c/gj3XfOOMkID0sqvogUr3pWnRSDBgGjfYLBU7+OutChxfh+:vpt+Vzg4F32OMkIA9vg1mVWfYLBm+OS/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654695939, "uuid": "6290758c-218e-4f65-8140-febf4887b6bb", "value": 343428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654695939, "uuid": "c5c1afe1-acb5-4231-ae83-e94c53c6f3ea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654695939, "uuid": "4a6b5c3a-3ed9-4b6e-aff3-ebbfb0fef9a1", "value": "Bit Miner v3.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ca2abd-e76c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654721406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654721406, "uuid": "d20a776e-75bf-44fa-9f96-c2948a0cb714", "comment": "Malware payload (Mirai)", "value": "7d961937c5e8efda98590d233b4bf0eb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654721406, "uuid": "f5c0a540-0dbb-421f-966b-8575b0776ca6", "comment": "Malware payload (Mirai)", "value": "e2d289be2d5377ae8b9ef197ac15dcab1c15771eff526a5f16a077ee6634cad9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654721406, "uuid": "34e8e230-42d4-4477-b1fe-64e20bce1c69", "comment": "Malware payload (Mirai)", "value": "fe127d1854f751c6cbc2a65a5a409be0c2f555c1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654721406, "uuid": "dbd7c006-c1eb-4d3e-8164-edf0a8bc192b", "comment": "Malware payload (Mirai)", "value": "95b32749bd4fab6178fccf6be9e4cca658219af514c0cd1e4393b89971f3f64c5d0362354730965eade5cd3564687359", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654721406, "uuid": "9a704eb6-513f-4246-bfe3-832fd73c8988", "value": "T10F634BC5BD81A622C7C25677FE1F028D371957D8D2DA33139C282F60778B85E0E67A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654721406, "uuid": "1b0c3682-43a6-44b6-bea2-451026c664f7", "value": "1536:Y/6nXVh75AsfeZtN95oUqVO+vBAC+vMvWLBI:06BbfwPqVOK7LMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654721406, "uuid": "ab006a63-f7a2-4843-b637-467b6395bdf3", "value": 71420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654721406, "uuid": "a9ba7fb0-fe5e-4daa-b5f9-8296a7815347", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654721406, "uuid": "c097d5f4-62e9-42c1-a785-1855a1cab678", "value": "gatoarm-20220608-2050", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef571699-e6cb-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654652410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652410, "uuid": "03e41d02-15df-48aa-bab9-2306a2c3c334", "comment": "Malware payload (Heodo)", "value": "506a96c299c0ff142a7db5b4c2c55cd0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652410, "uuid": "dca89433-2cd9-4e2d-9670-1b5deb219947", "comment": "Malware payload (Heodo)", "value": "e2ec845e58cdea6e413ed6d7f746ef9abb2ba33acd14279c9e570cba47e4b4c5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652410, "uuid": "e018b1af-2e8b-4179-a24c-13b81d28ebb0", "comment": "Malware payload (Heodo)", "value": "d2acc60ab2ac7c41afdd5c69661ca4450dc0e36a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652410, "uuid": "98fb30e7-4872-4802-9cbc-a264d1716d31", "comment": "Malware payload (Heodo)", "value": "635691599dbc1222a417ce23f574c1076044bd2eb1d6f2247520160aeed0106959c2fad5aea96300139a2709e69b3a85", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652410, "uuid": "8d04c498-dd81-4dee-b4d0-92854d272a8b", "value": "T18704023EE5031A98C22ED8FC58EE6DF9D5F634006258063A1BA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652410, "uuid": "b929f8f7-32db-4a40-8e10-27ba800848fe", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652410, "uuid": "7e8de06f-0cc4-4bd8-8d10-1959d5ce4c72", "value": "3072:VpjftqFs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VRYi1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654652410, "uuid": "1c649954-8bee-41cb-8cc2-6366c0835728", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654652410, "uuid": "05fe39f3-8559-4ff6-adfd-039b296da5f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652410, "uuid": "5123c7ab-0682-43a5-9c95-e428d57a0fec", "value": "506a96c299c0ff142a7db5b4c2c55cd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a78587e-e740-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654702358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702358, "uuid": "a1bf445e-7fc4-419a-9ec2-80a99038078b", "comment": "Malware payload (AgentTesla)", "value": "3966183104fe0cc520b5c78bed570cb3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702358, "uuid": "ff44ca74-0d1b-4a7c-8cf5-2f2863fa8402", "comment": "Malware payload (AgentTesla)", "value": "e3045132b8d1178c2786daf6c03481c86f3228e3e45cb313e62b35f4b504cbf2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702358, "uuid": "e7ed319d-e0d4-4961-9747-5d0b64cdb1bd", "comment": "Malware payload (AgentTesla)", "value": "66262ad6919e4b734aee611eb2dfa55723390380", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702358, "uuid": "8b47abfe-1e4d-4e1c-bc48-af9061e122e6", "comment": "Malware payload (AgentTesla)", "value": "3c7e5438361158afcf5c23938f9a1d08de6bf4025db32be13a0e47fb20a1a82b9b31421fc850109bc085cc9182e64b61", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702358, "uuid": "fb409c09-2d52-4d7e-bf71-3a1d4ae159ba", "value": "T1EFB47C9C366C71DFC857C972CAA45C64EA6074AF7B1B9117A02309EDAE0CB97CF105B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702358, "uuid": "ea97501c-b8f9-4cd3-a2c7-800bc5b44d44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702358, "uuid": "156afa8e-b0df-4e48-b055-c9c768cbb31b", "value": "12288:vOsCqH/EQ+8chqcPDJFO9PQkOjGXUnrXfVbPI7YReDTzBOwd:vOs7fEQ+F7J09PXWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654702358, "uuid": "b03558ba-9b15-44ec-ae2c-466940ca9022", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654702358, "uuid": "e40bdcd3-36c3-41d4-afa4-7569a081ac13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702358, "uuid": "b1f36460-3537-45b8-91f9-79b2cfd44333", "value": "Sample Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5baf40a-e750-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654709464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709464, "uuid": "b2c694c8-6097-43da-b34d-7d09a3fe0038", "comment": "Malware payload (Mirai)", "value": "6e7a7722630b641e8ecf59e229b6faae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709464, "uuid": "42a6a0e8-8212-495e-a28c-3cf9a872211e", "comment": "Malware payload (Mirai)", "value": "e321bc8c992de7991f57afed2552a5b877f155d472bff20e6a1235819bca27f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709464, "uuid": "d83f9512-d9e7-4c7e-b153-8880e1f25c32", "comment": "Malware payload (Mirai)", "value": "558bbe356e773c235f43f0f358b113de9ad4327a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709464, "uuid": "1754337b-5966-4c12-b8d5-99e87e764c9f", "comment": "Malware payload (Mirai)", "value": "c65cac9cd96abef8d5fab68bdd6d2d6158d7bb914dc4ebbf643226f2da93d4649f0ed6af3238aee818b35bc053a4c6fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709464, "uuid": "686a086b-4194-4374-895d-c7438c270b24", "value": "T14C73A40AFF615FF7E89FDC3399E91B85249C101A22987B757970D428B25B24F49E38B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709464, "uuid": "eb2c3794-2206-4f0e-be15-33c3c16cc359", "value": "1536:rsOJX9oPzHP0+tZAajO7F5WOMeHKg1uXMPjyOGFZ8IoI+:rsOX9oP7P0+t+hBbKgVGF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654709464, "uuid": "f04d1ecc-d884-4c51-9823-7e72ae279813", "value": 80012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654709464, "uuid": "a890467b-f515-4f7d-9921-68008942951a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709464, "uuid": "697c811d-9e52-420d-bf02-8e7da68684a8", "value": "6e7a7722630b641e8ecf59e229b6faae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c856bf85-e733-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654697013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654697013, "uuid": "b0136f21-c098-4bc4-8ee1-4e0ab04f5f11", "comment": "Malware payload (Formbook)", "value": "96365fe520f7afb0e2e4fe858273ce7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654697013, "uuid": "a7ce5000-5152-4a83-85e4-87c6be9bca2f", "comment": "Malware payload (Formbook)", "value": "e322a26ae84aa34c37b31d14fca0e535fa594d570765d93d3542d428e31da0c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654697013, "uuid": "c102e722-1007-45fe-9551-421f80108f9a", "comment": "Malware payload (Formbook)", "value": "b36a358c65a61fe77d84f1771c7d61c3c30316f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654697013, "uuid": "2f4358d9-c371-443c-be9a-28c5d06f73b1", "comment": "Malware payload (Formbook)", "value": "cd6326221b8a0962a1ecd331e19def5610f8b31c4422b42e691ce40c949556ce5a65269cdaaed6265e280683db54638d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654697013, "uuid": "ed394c20-98d5-4283-9bee-316b267c3076", "value": "T19EF4E119A5A7CF72E2A60777C4D24520DB778042E2DBE70F338823D69E43BDEC946646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654697013, "uuid": "84fa9ce8-3f88-45bb-99cf-fc0afaaff5c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654697013, "uuid": "494c2fdf-a58b-4856-ad3e-508d9f695012", "value": "12288:sC0xZAI+hc9q7H2g5w9kw9YVtZorjYFl4s2Z0A698eOQgIxurF:w+hc+WmwCw+tZ4YFlMunOQpxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654697013, "uuid": "6247b464-504b-446e-93f0-b6c8576c5c73", "value": 776192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654697013, "uuid": "891936de-fe21-4222-b52a-0fd483709bc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654697013, "uuid": "14614132-fc97-4fa9-a7c9-3817d33db990", "value": "samizx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ceedc4e-e6ff-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654674526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674526, "uuid": "def1dc96-050f-4014-aaea-b8530a49e640", "comment": "Malware payload (AgentTesla)", "value": "866b754a73b657509cf050483546aec9", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674526, "uuid": "06e862c0-9bdf-45e2-a7f4-7e0d440744ef", "comment": "Malware payload (AgentTesla)", "value": "e3819b77932bae5eb15fb9f4a4a550db68f9b79fe52a3fee4d1705054e0eaa3a", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674526, "uuid": "115fb1b6-ba47-4a30-b897-57e2ee5ae87b", "comment": "Malware payload (AgentTesla)", "value": "22b7ce8f930a6490ccf6a632817b6ecdfde1e45a", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674526, "uuid": "1909f4bc-b841-490f-ba16-f6ca34b15d06", "comment": "Malware payload (AgentTesla)", "value": "782c51bc30ad7ed9936667ca2ca71292cf9b5c0a77aff1c4287e20b6a08b941ed64088a348317b397884795d8405b099", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674526, "uuid": "fa3f7cd1-547c-4121-b7c9-ebeeb01fdb74", "value": "T19E2412EF416FDF6C632691FDA0D7542BF0C9795D6162EECD400DAE6A032EA309C4B489", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674526, "uuid": "5cc90765-3df8-409d-a092-2d4fc226f826", "value": "3072:AyKhsGcWqhXKgBSWJxqh0yxILJwojVPYx5vC7uDCaafwOE55H56jFh5m8hu0pIGo:vKhfCBSGxYiJrix96uDCaaSP6lNNA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654674526, "uuid": "5ea6e5b9-2c1a-44ee-b738-81fca6b8535d", "value": 213848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654674526, "uuid": "26e3974b-a6c2-4906-ab59-83be95faecf7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674526, "uuid": "102a2fa4-9359-4638-8b6f-07c847e6851b", "value": "payment slip.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3dde011-e6ff-11ec-93bb-42010a9c0043", "comment": "Malware payload (Quakbot)", "timestamp": 1654674671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674671, "uuid": "0bd9093e-7afd-4ad2-b921-7d373ba318c9", "comment": "Malware payload (Quakbot)", "value": "a32050027aea96b3b70e1056490a98c9", "object_relation": "md5", "Tag": [ { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674671, "uuid": "fa41ecc5-245b-4208-bf44-49eaab9e9a40", "comment": "Malware payload (Quakbot)", "value": "e3ba1c45f9dd1f432138654b5f19cf89c55e07219b88aa7628334d38bb036433", "object_relation": "sha256", "Tag": [ { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674671, "uuid": "32d7b0a8-84df-4566-b569-8836c3365841", "comment": "Malware payload (Quakbot)", "value": "ef28c67583c8c8048c0baaead036680a60441213", "object_relation": "sha1", "Tag": [ { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654674671, "uuid": "c45d1787-dfce-4114-a8b5-0856c215649c", "comment": "Malware payload (Quakbot)", "value": "c4cf7f5894159c9c05ce6a3f5d6fc95a3c6556eb14caa5fd572df7d17820034f0574efdec4c863cb05c8d82d39729339", "object_relation": "sha3-384", "Tag": [ { "name": "follina", "colour": "#655A36", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674671, "uuid": "5136ce68-92a8-4b4e-864c-ccbb53a51b95", "value": "T18FD1B7716E2A17104BE113B99396CCEEE358E41037D3AB58ECF64A2EB459A0CC713294", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674671, "uuid": "9393f267-9365-4273-8dd3-1c6994e59fa4", "value": "192:tJ5mDtWIDu0GTl9EHbTcKeZEwC8EaKiSe+1hPw6utjdkGPgz47:wDwIwERY5V7VaGPgz47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654674671, "uuid": "701fab41-8021-4c5f-91ea-55ccb8fdbd3a", "value": 6241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654674671, "uuid": "7000d099-9b4e-4024-ac53-5188419e2fc3", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654674671, "uuid": "1ff23492-014f-43da-b626-5589b25ee947", "value": "Qbotfollina.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ec2fba8-e6ca-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654651631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654651631, "uuid": "be4e7af6-cdc0-4e5f-857e-a48c76e69061", "comment": "Malware payload (Heodo)", "value": "86ff133c8c2c2612333e2665bef9aaed", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654651631, "uuid": "48a19f8c-36de-4cc1-8744-664d0e46d695", "comment": "Malware payload (Heodo)", "value": "e45a5187a3b2979c5667a02ed071a0e2b8252a46b86a710c78c1fd1dd444f336", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654651631, "uuid": "f706687c-8cbf-45e5-bdd6-0950eb9887d0", "comment": "Malware payload (Heodo)", "value": "ede527bb8e1fe29a08bb629c424c0f73299c1211", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654651631, "uuid": "074df845-08ca-4434-9834-f6c8c00c8ab2", "comment": "Malware payload (Heodo)", "value": "17d8153fd6696d2ebdddbbf795894aec07d33f88f6ed516a4b8eedc4c636f6f4975cf596dc0ff9c7d5b9805409a5c981", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654651631, "uuid": "0fb8c7c7-5b42-4f5d-bf45-670ea52128ca", "value": "T1CB04023EE5031A98C22ED8FC58EE6DF9D5F638006258063A1BA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654651631, "uuid": "2bf1695d-85d0-4816-ac78-cb296c5d5fc3", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654651631, "uuid": "1575d771-be20-4267-81fa-8e531b8bf4e0", "value": "3072:VpjftUFs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VRSi1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654651631, "uuid": "64e951f8-3db0-4fba-875a-6a0bfcb09ce4", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654651631, "uuid": "cb75cd6b-425c-414e-bd91-914b1ec68e89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654651631, "uuid": "56cc21dc-cc7e-4b1d-a6cd-972c8f0ecb86", "value": "86ff133c8c2c2612333e2665bef9aaed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc0a9e49-e742-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654703435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703435, "uuid": "5dc6272a-846b-4490-963d-a01c25ecb2c4", "comment": "Malware payload (AgentTesla)", "value": "c13ec8ea2857da3fc5f28d6798f278d1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703435, "uuid": "a3ee3d25-f6c1-41b6-b42d-f0e04af56e7f", "comment": "Malware payload (AgentTesla)", "value": "e5bc010112dd7fddb25bcd34ca63a7b9784e1575c432a5faa1d37fb23c90d5db", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703435, "uuid": "a1475c84-5698-4966-994b-add451105417", "comment": "Malware payload (AgentTesla)", "value": "89e0f31fddc9903fb87ba6cb6f1f8c71bf8e183d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703435, "uuid": "e6f55d10-65aa-4e6d-b1a3-718c64dbeb17", "comment": "Malware payload (AgentTesla)", "value": "6f3c3ffdd181d7112e9e1af30890ba8ea8cdd1556c00f5ad97dbaf13d36a729c367d8ca6c6bc8b0f9b6de73f96801310", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703435, "uuid": "0350475e-05f4-4fe4-a032-40d43de7ece1", "value": "T17844BF6721838811C585697D8164E3EC837C9F615E2B72DA706E3235C9B2D8F3B4CDE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703435, "uuid": "527c860f-3807-469f-87fd-efb76c3f416d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703435, "uuid": "76c6ed42-e524-458b-b23a-3925d59fa1d7", "value": "6144:NgOPttQJNmb6SLB1iuKvIQJGbqzhNnFnvhydhcoKQQF:5tQ7mb6SLBcdwvbqdz/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654703435, "uuid": "fe716f78-b73e-4d1e-869e-215fe9282980", "value": 274696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654703435, "uuid": "5585966e-476d-47ed-b5f5-2f1824614943", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703435, "uuid": "00b3117b-135d-4486-bc74-34f641f5406d", "value": "SecuriteInfo.com.generic.ml.3332.27068", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de013d0d-e706-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1654677722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677722, "uuid": "6d86432a-212d-4337-9e76-19a776ee9af9", "comment": "Malware payload (SnakeKeylogger)", "value": "4435766c384243c56973a9a9893cc085", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677722, "uuid": "9244c8dc-3adb-40ae-937c-982137103248", "comment": "Malware payload (SnakeKeylogger)", "value": "e5bd2fb8a16026c0495433b9e21059d16dde83b7241fac42aa02e4cd5a754b20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677722, "uuid": "1e783556-1bae-43d6-a9c7-04a2dc022a33", "comment": "Malware payload (SnakeKeylogger)", "value": "d5dc02c144fa0843a64e825e922cee076dfe91c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677722, "uuid": "f4881401-25da-42ab-ab98-a47213a7dd08", "comment": "Malware payload (SnakeKeylogger)", "value": "fe3c08cfb52a64328d79e2e6bdddb31c492f56fbb84166258460ddf14dbe4e128514d71f3c62c5b5ccdcc66df38f61bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677722, "uuid": "d1358482-8f1c-4b85-a168-d46ebe721f03", "value": "T1DFE4C090B3B69F71F1B963F36420A00817F4691E85E1D22A8ECDB0CE72B5B4259F5E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677722, "uuid": "58f913f2-1551-4a0a-b9e1-87589ef2e235", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677722, "uuid": "fcbb4ccc-4d0b-4109-acec-75c37f89649c", "value": "12288:zJRXU09q5w4Txagb8iVD5oBuzbdEWCHjgnJVM64Mj3l/6amy:1RXU0Itxagb9VDqabdEWCHknJXJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677722, "uuid": "7f85ac27-ddba-477f-8d55-89d6910bb04c", "value": 659968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677722, "uuid": "49328f3d-f0e3-4558-96fa-555eb85250bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677722, "uuid": "a3727bb9-acef-4ace-b7ac-4dd10352942a", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50ae421b-e6fd-11ec-93bb-42010a9c0043", "comment": "Malware payload (RemcosRAT)", "timestamp": 1654673619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673619, "uuid": "dbc433c5-a9db-4244-8f06-c1c1e806606d", "comment": "Malware payload (RemcosRAT)", "value": "0f46063d8d92c178e3d1e1f458c6a3ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673619, "uuid": "22d7d1bb-fc8c-4e18-891b-d9b42864f81a", "comment": "Malware payload (RemcosRAT)", "value": "e66902c4b2487d673385d700f51b981a390a1428c9fd82645fd22ef0fc63a8b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673619, "uuid": "382b6b61-cf7c-4af3-922c-726581b719e5", "comment": "Malware payload (RemcosRAT)", "value": "a6cdaf764adc983bf10d4386a0437aca58b8a96f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673619, "uuid": "6ac9fe1a-32a4-4683-9eb4-3783befb6777", "comment": "Malware payload (RemcosRAT)", "value": "028a69d617ef8d4c5e51124a36a2034a828c27b441a43248a98199e4e940fad60ca6b3432e4cc0223882398a1370273d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673619, "uuid": "c4de219b-9bea-4cc5-a900-e643454c699d", "value": "T1BA35BF22B2824433C5B71A384C17BFA9AD6ABF102D24A9452BF93D4CDF397817D35297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673619, "uuid": "28e9cd37-93a2-42bf-9a00-48b4c991fc65", "value": "02a89028ae3fc76c6e22c422944c365e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673619, "uuid": "5a0e6032-b9a8-47da-b7ca-f91503837bc6", "value": "12288:MIfbQK/punQN2hK04lk5WiZt0/2CjDj3+3S8HL75M9JOGkMTgIGuURWCXCEUaWQR:M+UKInQ0KO5b4+CfuieZM9JJkMsTWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654673619, "uuid": "2bab8fc2-dd2e-4a99-af17-9ad62b132ca4", "value": 1064448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654673619, "uuid": "286ca2dc-99a4-4dc2-8448-5d3fa10f5bed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673619, "uuid": "9fc64fc3-6ea8-4cfe-9628-80b9553852fc", "value": "SecuriteInfo.com.Trojan7000000f1.14288.26776", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "093cb6d7-e6c2-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654648159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654648159, "uuid": "06404377-342b-49a9-8b26-320b3b3d5ae2", "comment": "Malware payload (Heodo)", "value": "9880b70c23f363683f0194fdcaedaa9a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654648159, "uuid": "8fb1a243-2cc8-46fe-93a4-cf7c83f8631c", "comment": "Malware payload (Heodo)", "value": "e66a0d185d9ce0330072e8a13d07f3d9bb56cb7b7ad1b0db2780e74b7e55c3d4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654648159, "uuid": "d210e0c6-dd0f-4cb9-853a-7caf64bcfaf7", "comment": "Malware payload (Heodo)", "value": "cc46a0d58b400d02863e055601a0529368e43aef", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654648159, "uuid": "4b4e7132-52c2-4a0b-902f-b2af2daa1467", "comment": "Malware payload (Heodo)", "value": "c7dffb0a486f81c4b407aedd43de87a26bbab1bb285d1c94433ddbfa3499c67162e7eb61f7fcf25be105742fc7c5b7d4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654648159, "uuid": "1e2d7adb-abd9-42dd-a2c7-4bf7e3e845c2", "value": "T1EE059D6BA6AC00BAE4BB9175C957460FDBF1B8061230DB1F56D44BDB2F13B22560F326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654648159, "uuid": "47027190-90b3-4917-8a9f-c146953d4098", "value": "d9733c5ecc65353f45cd0f93d7b884fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654648159, "uuid": "276f60b2-3cdc-4b09-bab6-0f06a3ecf55e", "value": "12288:a+wE4wJABdm/nZE5L44IffF0LKE1ez9d6hfdq42aOJPYoQidSqIw:a+wE4wJABdsZs44Xez9d6hfO/1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654648159, "uuid": "959b7e3c-71ea-4707-b6a3-af8f8b653580", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654648159, "uuid": "6d979ff5-d4e9-4509-b369-c9f7fd35fd5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654648159, "uuid": "53ffcac9-77fa-47bb-829e-c99543b066d4", "value": "e66a0d185d9ce0330072e8a13d07f3d9bb56cb7b7ad1b0db2780e74b7e55c3d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fab8ca5a-e6f9-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654672186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672186, "uuid": "87c54a80-b102-40e6-a263-1ce150c9f4c8", "comment": "Malware payload (AgentTesla)", "value": "49eaee9fcf01015b8dd55e01e904a05c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672186, "uuid": "3c1ba08d-acc4-4166-a56a-e074a32448fc", "comment": "Malware payload (AgentTesla)", "value": "e6798c9948efcd744e4ef05c4b12c5660db93728ae7f2fdec5e37a71edb1b80f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672186, "uuid": "7e998523-8fa4-4352-b2b6-d27dd15f20ca", "comment": "Malware payload (AgentTesla)", "value": "c7dea53c79947e34575eb0c40b5d2069e123621c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672186, "uuid": "d2ad6f34-8e32-4245-aad2-d08ba73b13ed", "comment": "Malware payload (AgentTesla)", "value": "781252c16e218e00ae764310682dce44980517b6a5fc608ba2dd2c7525056e248d0c1d5d01a351e3138370c92aaf0466", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672186, "uuid": "a878bc20-39b9-47a0-b847-96e2ab86b798", "value": "T15C5533CED0CA2A84DFB63819FAB52A14B2B44D7C0591AE7300EF9C4F91C05ACEF9155E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672186, "uuid": "1932fe51-fa9c-45b8-a72b-a68ed71e1320", "value": "24576:uRaDGFn7LlykgOzKKtpRNkmiCfVVECqGpsifo9zOcwMoyMFpg8e:UaY7LlXgEK0pRmmlVXqGuifo9OzMohp2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654672186, "uuid": "73ee92c1-2327-4f07-977d-e14a17f66e6b", "value": 1291635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654672186, "uuid": "ebd93f0a-fc02-44ed-b894-88bf66ec0b34", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672186, "uuid": "c8627677-0285-474f-9a39-09bf32409727", "value": "pre alert documents.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88303c0e-e73a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Gafgyt)", "timestamp": 1654699912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699912, "uuid": "e949cfbd-7ae2-4f53-bed7-8e6968390501", "comment": "Malware payload (Gafgyt)", "value": "9ffeeba92c7d9ef9bdb87d38c1a318ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699912, "uuid": "6d46a034-4948-4b9c-8ca1-6f902791b2a7", "comment": "Malware payload (Gafgyt)", "value": "e6862247c74d2374fb13558e7e243a5f622fa8772ca15d1a529ccbb58687ed1e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699912, "uuid": "3d5c0399-3e20-40d3-a054-b6ab2d2a61ba", "comment": "Malware payload (Gafgyt)", "value": "e7b870e7dce7df612c4277df6f7617bd986e2b4c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699912, "uuid": "d3dc3f2f-cda6-41ac-8cf7-445085c8dc42", "comment": "Malware payload (Gafgyt)", "value": "f4c9a08ed03f89e8f81f2ca265a2fa0450c926c7848207038ccee72d85cef5b3f2199a44acf66654e83c77b81a87e03b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699912, "uuid": "751f4afc-5f04-4f4c-8677-331fd00c64e2", "value": "T158C3083B7B170E63C0CA117115E30732AAB5DF8834B95397A9A07D6C6F37A843816BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699912, "uuid": "6c51a427-cd54-4b86-8520-696da9df39e4", "value": "1536:Em+aSP/eC+91l0lzN95oulta3tZsgx/mmi4l5bUCOCntyNO:EK9/MzNPou0sc/mm/l5bULCntyNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654699912, "uuid": "13c3daad-2f56-4201-8373-d523bb665907", "value": 123911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654699912, "uuid": "ed35a703-0163-46c1-a023-123daf77b162", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699912, "uuid": "1e7e2a6c-08e5-441d-b59e-3bc807d39e97", "value": "9ffeeba92c7d9ef9bdb87d38c1a318ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f2bfe35-e70b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Smoke Loader)", "timestamp": 1654679683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679683, "uuid": "f9253b57-1834-4dd4-a841-a048445fea1e", "comment": "Malware payload (Smoke Loader)", "value": "2c68016497d078bdb2d8ad2e2e68a728", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679683, "uuid": "62f5e08a-5fc3-4561-b570-8e097c0fb5cf", "comment": "Malware payload (Smoke Loader)", "value": "e6aa0376576092f499211d0e860cac7861a88b6f7f066fe619606a6ad3b2ca5a", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679683, "uuid": "7be6bb20-0795-458a-a77a-49e8f6b0bd1f", "comment": "Malware payload (Smoke Loader)", "value": "c91aa86f3d9638ac9ad631668f2a2fe35d263ea3", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654679683, "uuid": "e049ff3f-e457-4205-997e-88b256cac6dc", "comment": "Malware payload (Smoke Loader)", "value": "f39cbe95d9de86ad4d936002775ef38d71e813d80384a7f8181b1bbccc29ea9f7103805aac4f9ed2917edcaf4a79f35f", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679683, "uuid": "606bf18f-fe40-42bf-aa3d-28fe476c16c6", "value": "T1A5448D10BB90C035F1BB16F489B993ACB93EBAA15B3594CB62D41AEE57356E0DC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679683, "uuid": "8f08d38d-1fc2-407f-a5ea-a7a13649fe1d", "value": "8dbc8267d262116b0c5b4cdcfbe1ce61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679683, "uuid": "e30ed1ac-431b-419c-adfd-1147be5c5a93", "value": "6144:iv4kJvP0ZeAQ1rJavlfxAqmXP8krwF+sxz:ivxWZ2rElfxAJPJrwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654679683, "uuid": "5adbd42a-24aa-44aa-9353-7ab702bc4044", "value": 268800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654679683, "uuid": "9ae3dff7-ff7f-4280-879c-d9457c086219", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654679683, "uuid": "a81c480b-2626-453b-ab51-f535fc980d4a", "value": "2c68016497d078bdb2d8ad2e2e68a728.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b4d171d-e73b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Quakbot)", "timestamp": 1654700293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700293, "uuid": "757dcaf7-5e30-45ba-b171-54272e1f7b7a", "comment": "Malware payload (Quakbot)", "value": "cfafd1cdd752b352422548a84b907a79", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama187", "colour": "#0BCF63", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700293, "uuid": "2d3b8a22-9a93-45c0-af5e-b2dc0edd6cec", "comment": "Malware payload (Quakbot)", "value": "e722083fbfacdea81b4e86251c004a1b90f864928af1369aa021559cb55aba75", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama187", "colour": "#0BCF63", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700293, "uuid": "9b044632-1520-48ee-84b6-1ccc5bba2c1e", "comment": "Malware payload (Quakbot)", "value": "e548b8b1fce20f722a5669e7b4fd2128cc56201f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama187", "colour": "#0BCF63", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654700293, "uuid": "d166ba46-30d2-4b0a-8995-d7ba525f5f73", "comment": "Malware payload (Quakbot)", "value": "50199bfffd6ef2bda6b7b086930e3d904509659ddbace1087cf6418ad1d01e14448cc7cf7795140c9b4b1bf45c1a543b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama187", "colour": "#0BCF63", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700293, "uuid": "bbc0b472-9800-4ec7-8b10-992a929fecf9", "value": "T1F405B022E7D14836C2631A7C9D6B776C983B7D102E3998C76BE81E4C5F392803B66357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700293, "uuid": "c093b43c-ebc5-44eb-8ab6-af7efe5c1549", "value": "92046417fe46b0698ba7913a6f0e3563", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700293, "uuid": "a271158e-80f8-4d77-acbc-db8c3ab38bd0", "value": "12288:bHA5sfLt6JfZPR2r7E43UDSXoMyvgulzMyvgul:02fMJfNwEhOny5Wy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654700293, "uuid": "bac2979a-0efc-4cc3-a5bf-4ee6665cbe05", "value": 863232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654700293, "uuid": "d8cfcf74-bfa5-4063-94b2-8d2e965b9a0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654700293, "uuid": "d3c4e5f8-ebbe-4a80-b9f9-85d2f9ad2556", "value": "local.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3746b6d-e6ee-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654667450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654667450, "uuid": "d0c461b9-6d41-42d4-8ea0-5e24bdc72362", "comment": "Malware payload (AgentTesla)", "value": "c3e5d22d6dc95089c4b5189a58717b8b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654667450, "uuid": "22afc3a5-24f9-40b4-8ec4-4de04ab53025", "comment": "Malware payload (AgentTesla)", "value": "e7fb20cd21cb292897298e1a9e931d2dda5839a6cf131ffacbea7055983e1169", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654667450, "uuid": "f730dd1f-9793-4762-86cb-f4f7bd78c46c", "comment": "Malware payload (AgentTesla)", "value": "00c6a5a6d25b60e1485b7e21c1ad2f96fc5af17e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654667450, "uuid": "c1b0e7eb-6169-4e19-a3fc-934e68dcf7e9", "comment": "Malware payload (AgentTesla)", "value": "334b41b51438c9be5aa1cdb03477163022b0cb067a185caeffb477718a6c25c76c174a918d7ad12aae62d771b4aad3d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654667450, "uuid": "176d0df6-0e7d-4679-bc57-0c80c959da29", "value": "T1ED84E0143BAC3811CAABDF7591A1C6408674908FBE73F61F5FA30CCEA905B44A761B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654667450, "uuid": "4c1a3af2-d9f1-4a95-931f-1850f64edf35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654667450, "uuid": "76075b87-eb41-4c85-81e7-7f97b7e3a199", "value": "12288:6U04LCt4RqrB0GMBfV8MpcDkwSnMwgz2b:qkfCPQfjekwSIz2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654667450, "uuid": "873abb4d-9e67-4ffd-803a-ffba30595870", "value": 400384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654667450, "uuid": "acaf0bd0-df93-4bda-a879-89e29e955ab3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654667450, "uuid": "e1898a55-7978-4ac0-bb1d-855f21283b13", "value": "Sample Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dee35d59-e706-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1654677723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677723, "uuid": "df017c13-885a-4f9d-9214-31641fcbff9f", "comment": "Malware payload (SnakeKeylogger)", "value": "994bddcdba2098f9d77cea496130efea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677723, "uuid": "ab9f473c-ac8c-4f4d-9110-99e380ef7ee4", "comment": "Malware payload (SnakeKeylogger)", "value": "e80c7b13d628b8269181e5ff4ab5b319b228281f519c74e741da00927be13420", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677723, "uuid": "2df8d93d-1dbb-4f8d-a290-4a06a34bc71c", "comment": "Malware payload (SnakeKeylogger)", "value": "a46a44b08f5ecba4e67034658584f9a1a2409e74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677723, "uuid": "1f5c3c74-2ac7-4b13-92b0-63e246db7024", "comment": "Malware payload (SnakeKeylogger)", "value": "d4384e0e591d01b1fdcf6dac7719d253a6bb9e941a2c63abbfef333ba75176602da454f9734d93406de07212679e10b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677723, "uuid": "9a2c4ac1-7ed5-44fa-8d7b-2a0e56095c3f", "value": "T166155DD1F19088DAED6F0AF1BC2B953015E3BE9D54A4810C5699BB5B66F3342209FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677723, "uuid": "70be22ec-b7d0-41cb-9afa-1abc49c66b29", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677723, "uuid": "40da64d0-9fb8-48fd-a18b-bd4a4a1c6dee", "value": "12288:QkneAKZvnbHwxsczYSa1b23oZNVxkpJSsRJiRc3sVgKw7rMybo9q:cAgvL7eYSa1mobV8gssTeR4ybo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677723, "uuid": "95e4272b-432c-4675-a444-4c740d517513", "value": 887808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677723, "uuid": "28a69f86-46dc-419d-9c15-c018de273f0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677723, "uuid": "3fdf4f7c-8bed-495b-962c-1c3fe93fd3b5", "value": "SATIN ALMA EMR\u0130.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b520167-e74b-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654707004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654707004, "uuid": "f10a234f-57d6-4f1c-bb95-ca0d295233b1", "comment": "Malware payload (Mirai)", "value": "101231112238a2b1779e3cb7aaf732e1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654707004, "uuid": "c4aab6e8-7f4e-47ce-b069-8f2c25bfa7d6", "comment": "Malware payload (Mirai)", "value": "e8445592db8bb6563154854ec1fa3054e61fb238383d24f493677c2303e7572c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654707004, "uuid": "8b729d94-95ae-479f-a108-880d682ff480", "comment": "Malware payload (Mirai)", "value": "48f12c837f2ccc85885c5a481eb319455382b8d8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654707004, "uuid": "3c09c66d-1d74-4a82-a3aa-909af39c685c", "comment": "Malware payload (Mirai)", "value": "ed6a3a18f81741141058cc9b3114e348b7e2c455e9a2da0f0d0034ba72bf6a5c7e66fcc6cc63eb0fe2aa5dbfa2ce055f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654707004, "uuid": "c4595a23-1eb7-4234-8403-2f0911c4adcf", "value": "T125D33A4AFA408B13C1D617B6FA9F41463322DB95D3DB3306891C9BF43F86A9E4E53609", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654707004, "uuid": "d7e2c23f-3451-4574-a095-76a3daa241e3", "value": "3072:LYJ6lx6DvKq9VNBk4jZBIYiwHtH+bK0NM/98a9F5JUMa:LYJ0wGq/k4jZBVHHEbKGM/93CMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654707004, "uuid": "b2c7111e-1b97-4b2f-94a1-f925b3fb3b39", "value": 137742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654707004, "uuid": "33ce64e7-768f-4502-a389-2d8be8cda311", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654707004, "uuid": "4713eb5b-c93f-489e-8268-46d4e70558d7", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc07742a-e745-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654704777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654704777, "uuid": "64de6c2a-54fc-43cd-bb6d-f1798150c685", "comment": "Malware payload", "value": "73ec1bb416a9d8fb0c1bb6db87d5f3b7", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "obama187", "colour": "#0BCF63", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654704777, "uuid": "e06297a8-d1e5-446a-9a70-b099ccfdf9c4", "comment": "Malware payload", "value": "e86e3ddc359f3d8f85d668cd5a48fa152e842ee3f777114106997914e579f45e", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "obama187", "colour": "#0BCF63", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654704777, "uuid": "b237091c-caaa-465b-82e4-eeaa49662404", "comment": "Malware payload", "value": "d5cc08225f0f082b1648f096a90283a18d520783", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "obama187", "colour": "#0BCF63", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654704777, "uuid": "260ad3eb-0644-40ab-8ee3-c15ebeb62b8c", "comment": "Malware payload", "value": "9c0b94ed3fea84e4b2d8491d5fbad49de6e007f2fbce77a7b13841173c374addcfe9176f45271e2d829ee71c8f4ff5c1", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "obama187", "colour": "#0BCF63", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654704777, "uuid": "d21694fe-23bd-4866-b881-22007d7cd7fb", "value": "T19DA5AE22A7914836C2631B788D2B776899377D103E3A98C76BF50E4C5F393813B6A357", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654704777, "uuid": "897da876-7489-4037-9acc-aa543d64dd7c", "value": "12288:8MAUUXXyHA5sfLt6JfZPR2r7E43UDeXoMyvgulzMyvgul:82fMJfNwEhqny5Wy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654704777, "uuid": "b8004e20-31b2-4881-acbe-dcaefce5fc0e", "value": 2097152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654704777, "uuid": "c38f6e36-1523-4ffa-9442-b11ec9b05cb4", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654704777, "uuid": "627996bb-d6f4-4d57-9261-a8966c0c9e36", "value": "ScannedDocuments_0672094.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0909d96-e6c4-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1654649406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654649406, "uuid": "5a8b1c09-aad5-4c75-b39b-2b8b9d838d13", "comment": "Malware payload (Loki)", "value": "aea251380ab984a0e5cec357b529bed3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654649406, "uuid": "71fa42a9-8734-49b5-a111-3424d17f416e", "comment": "Malware payload (Loki)", "value": "e8a726d660ddee36aeab019b3f8ddfb48f338f8bf70cc3bc8ce165de2961f61d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654649406, "uuid": "c8e9686c-1723-46c2-8984-aaac0a94ce2d", "comment": "Malware payload (Loki)", "value": "8a44037b19f5a55603cfa9369bec3d65c67b953f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654649406, "uuid": "7fdde115-49da-4897-8b40-8740ce954abe", "comment": "Malware payload (Loki)", "value": "b68705b6d9d95aa2ff4d44706232caace788665657410c8eb4e423d126ac0bb05f64544bbbe1b4680b42e6ebb7ddc0f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654649406, "uuid": "0e065be1-a1ba-4fd9-9149-830999063082", "value": "T118D4C080B3BAAF71F67963F36520900807F4691E55D1D62A8EDDB0CE62A1F8359F0E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654649406, "uuid": "da512184-8e0b-4dea-af56-28d89eb48ae5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654649406, "uuid": "c63d2fe9-416a-4398-974f-7999bdf7e23a", "value": "12288:BJwrx609qEU9KwkWtTuhdQ+FHmBQv9iJwkWW:3Gx60Q9KwxTuoemOgJwK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654649406, "uuid": "405fcf51-029f-4c93-8eb8-a1e570f58d3b", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654649406, "uuid": "120b39ee-6140-4837-b6cb-939937178c9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654649406, "uuid": "e154ea1f-6d25-4b25-a68d-f4bf257e9d7c", "value": "transferencia de pago pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ad26c9-e76c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654721402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654721402, "uuid": "e387a626-eeb8-4fd0-ae65-a9d5543b165c", "comment": "Malware payload (Mirai)", "value": "9e8c0fb63584034e76303985426fdc5b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654721402, "uuid": "5047a271-2a3b-437b-8ec1-dd521017e639", "comment": "Malware payload (Mirai)", "value": "e8a911dfa9dee4008dbb0c7577df30e4f2c6b61c021659e526342ef1daf1b105", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654721402, "uuid": "fee85fa2-c6d6-49c0-81b9-0bdd137e7a3b", "comment": "Malware payload (Mirai)", "value": "335015ea6307c751e09645184cd47bd3ad9e8dd2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654721402, "uuid": "32e2af55-a703-4a58-9138-a7faaa2139d4", "comment": "Malware payload (Mirai)", "value": "c6deecb528de7110ec7c8e92e190526992cd72cec2e0093078ddd18fd0b35728428b5b06057b4818eb5e201f83b2588d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654721402, "uuid": "da8489ab-bfa0-4773-818f-de51e8a80d8b", "value": "T1A0532AC8A0E3E8F5EC14097D307A7F629EB3F13BB136ED9BC7E95463A941602910625D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654721402, "uuid": "2e989d81-0acf-4b11-a5ca-15ba93cb06e1", "value": "1536:7Yhi+GXggf/bICZtbXYlaR6SWD/aQfoT5aq3C3WRk:7tXggf/bICZtbXYlasSWD/XfoT4qSmRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654721402, "uuid": "d5057571-dfc2-440c-9c80-da9f96216248", "value": 63484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654721402, "uuid": "06c5ea28-f46a-4322-91ae-6251e978a7ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654721402, "uuid": "6bbfc7d9-7f71-41e6-ab7a-622d29528ce5", "value": "lessie.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adbe24c6-e705-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1654677211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677211, "uuid": "49521d3c-ea22-4c21-b076-6e45db15fa10", "comment": "Malware payload (SnakeKeylogger)", "value": "6ed43fe50c90ec0790a7dcf917b7cca2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677211, "uuid": "48a44e1d-682a-4f14-b6f6-c624bf5d8120", "comment": "Malware payload (SnakeKeylogger)", "value": "e8b240fbade5c47e2e7853329bd8a885f74400a225ef41aeef6fe61532e3647f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677211, "uuid": "ce9a842a-9386-4b22-bc62-c2e92fb24511", "comment": "Malware payload (SnakeKeylogger)", "value": "65dfe4ff914f81d1c6b20242a2bb910acab1b743", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677211, "uuid": "d7d87152-3634-46b1-8596-551222d445f4", "comment": "Malware payload (SnakeKeylogger)", "value": "82776fc7e24c17ee588a67c19ac805dcff75b43864feb159bba7fc152e5793c8788a3914f1311105605bfd82efdc50a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677211, "uuid": "4a02d3f7-2af4-440e-a675-8eaab8fafa03", "value": "T1B4F49D59320C71CEC57BC9F18B965E3096613D7E9B93C22B5493308E9AFD392BA041F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677211, "uuid": "bc9fe57e-73f4-498a-863d-5ae6d412800b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677211, "uuid": "0851c985-4a03-4ae2-8e02-5ed62ca883f7", "value": "12288:RQPCXICWrtpKHfwXYP2NdHAOtmWJYZ2o2moTJ7F28/TJ0lGdQVYJUEKl75jQWmc:RjICWpMfwXo2HAqJY5G2VYJUEKlCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677211, "uuid": "0d84990b-f3ba-4021-920c-7e09b82f594c", "value": 765952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677211, "uuid": "8b89fbbe-52c6-4d4d-a2a4-1d9a95482ec5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677211, "uuid": "f9ad2a24-b408-461f-83ce-8046a747d599", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7508292-e750-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654709493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709493, "uuid": "2984c47c-ae95-4d58-9687-ab786d2f9d31", "comment": "Malware payload (Formbook)", "value": "f7bec32209f54242f97c9be6838b30d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709493, "uuid": "7a440742-bf5c-44ac-91bd-5af5f1926b4d", "comment": "Malware payload (Formbook)", "value": "e8be37f142bec9e9bf1a6038d7e7c246ad75b9b8ab966d1a92d807b7d9220de5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709493, "uuid": "013fe307-f328-4b6a-a463-4da9dc53474f", "comment": "Malware payload (Formbook)", "value": "f7791868ba921fa3a8ee75f28d991e70abb0a056", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654709493, "uuid": "54eb96f8-fa7d-449c-bb71-1caa649af815", "comment": "Malware payload (Formbook)", "value": "c726b3614468b6048bf14063bb914685ce8d256f12b459a99405406c560e55c90e24939db1e9c55501e05b6ec8b72b6b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709493, "uuid": "ae4cc682-a14f-4a16-8c2d-85864c331ff0", "value": "T17CD4021837ED0752CABE07FD9869140187F1AA27546BF71E1E8472DF0AB7B81CA22717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709493, "uuid": "9705d13b-f795-435d-b0df-182658115960", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709493, "uuid": "02e9d0f8-e051-48e5-b809-3c1b08df69ac", "value": "12288:m17WuANPoNTRC/XohHBFOqddy7rDBix5xOuNkb7kk3bo9q:yWjNPuRYXoZOqddyPNY5xOuNK7Bbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654709493, "uuid": "98952454-a79b-403b-8487-183e272294f3", "value": 650752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654709493, "uuid": "54cde207-52e5-493b-be68-d1e75339d938", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654709493, "uuid": "c8852c4e-007d-42cd-8110-1f51eb86f4ac", "value": "f7bec32209f54242f97c9be6838b30d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75739634-e70e-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654680982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680982, "uuid": "f451d958-ca48-4c8d-93eb-78b01b8d16f9", "comment": "Malware payload", "value": "be50881c1348d9cbca002b3db12ac1d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680982, "uuid": "1cb70f34-ab8c-4423-b510-8e51c96fdc4c", "comment": "Malware payload", "value": "e97cfa85c74bcce2b47583dda703d1533577728ae62bf48b4d4c54001af2dc04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680982, "uuid": "4b1c5ca2-f413-4602-9c43-3119d60c7e71", "comment": "Malware payload", "value": "64aa6ae0fefcfda4afc915cfee48a096de10e44d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680982, "uuid": "415dea1b-dfad-445a-8ad7-f2d4e3a4db6b", "comment": "Malware payload", "value": "18aae3350c9a35a536adef6891dd3ca4f7d362c6119ab193f60ecd7aa8cb0113ab7d75e28384e71d72146413af997566", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680982, "uuid": "e43e3d24-3815-4426-a79d-2b0d55801842", "value": "T1B6851294B3BAEFB2F17953F26820A00817F4655E55E4D1294EDDB0CE62F0B435AE0E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680982, "uuid": "282ddc9d-58ad-4cce-a8ef-ea3040a864e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680982, "uuid": "a017574f-ec39-49cd-b662-8928813937ca", "value": "24576:tzTr0SVG9ZbTCHUf0iXUtfz11zGIDmdEV/Xavpd79WjHBXx5aMh6F7EWJPISeN:aDHaUfPYRRGIDYEVizMtRsQ6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654680982, "uuid": "b165f9e3-d75c-4815-bcf7-f0a1ad5e18a2", "value": 1867264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654680982, "uuid": "cd28949b-11bf-4a77-b409-78ce48c06521", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680982, "uuid": "96e969fc-2429-48a7-a46e-08255a2aedf0", "value": "PURCHASE LIST.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea584688-e76c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Amadey)", "timestamp": 1654721551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654721551, "uuid": "23ff22ce-8f32-47d5-8466-dfdf253b3e87", "comment": "Malware payload (Amadey)", "value": "f31c9dd46af18bc6c19d0ca95a8d7393", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654721551, "uuid": "14753c54-1c69-45d4-bae7-be6650d031d4", "comment": "Malware payload (Amadey)", "value": "e9bfe7c95ae81afa99d431b098eac130c052986e2aa2a7f10db6e8ae6f3c04ef", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654721551, "uuid": "7d10dca4-a2a5-47bc-b475-dd93d20d3a36", "comment": "Malware payload (Amadey)", "value": "ed535a4f1143c0bfb7cb0f660f602850b0a32ee6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654721551, "uuid": "62cd9828-f16e-4eef-a0ed-a01477d3ce03", "comment": "Malware payload (Amadey)", "value": "cb1210e124c3a6abcfb6e07a48c9a4949d75b80cf437b75b6dedf81e1b28866479f0f0297d710b7dfd5aaecf2cdbea98", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654721551, "uuid": "62036729-0ae8-4fb2-8724-de27a7541dd9", "value": "T13D64AE10BB90C034F6B716F449B9D3A8B63ABAB15B3490CB62D516ED9B356E4EC30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654721551, "uuid": "9575cdb1-28f4-4cab-bdea-8055aa9a60df", "value": "6c3ec6ef64d2f3ae88c6a4c2d436253e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654721551, "uuid": "6a55b7f4-a01f-48e6-9761-7c8a50eecc05", "value": "6144:CMKFFLq7S8UBU8vqb720bmCepNLMNWqm4Wzfn9/nA8wtpr3zMBogfP:CMUKov260b0LLW7WzfJnAxrIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654721551, "uuid": "a2da2720-cbca-4b05-a4c6-533c1fcd9893", "value": 326144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654721551, "uuid": "19d63da4-324d-4c2c-bdfa-88aa97c98f4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654721551, "uuid": "c4dbaee7-5c41-4b9c-9419-402d391dcd3b", "value": "e9bfe7c95ae81afa99d431b098eac130c052986e2aa2a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e83af8-e706-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1654677763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677763, "uuid": "f5d80f81-e982-4559-ab09-96af302cc8a0", "comment": "Malware payload (SnakeKeylogger)", "value": "76bc27a85580928851df2c41493b22c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677763, "uuid": "43d3db9a-2170-4376-bea6-fdf2a3c1aee5", "comment": "Malware payload (SnakeKeylogger)", "value": "ea492cece1de906ba3a130efa7c7e5790f28db826066bbd7a87fdab0bac52189", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677763, "uuid": "2a2cdf52-a4d5-465f-a246-4d73de56fab7", "comment": "Malware payload (SnakeKeylogger)", "value": "31cb17af64c3a390fb31d3f53b338b9fa58a2c7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677763, "uuid": "731491e3-03ae-44c6-bca4-dad262b354e5", "comment": "Malware payload (SnakeKeylogger)", "value": "47551fed9289667f3996768f43c106b01d29e41c277a29d2b1dedb04b0e8841d58b8af7f78f99cba2758a9b3af23eb0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677763, "uuid": "3bac0f1f-3857-41b7-9869-f105093bb90a", "value": "T1C705D004B703EC7EE2298E7768A054006770561B82ABEB6766CD72CD744F7CB0EF2656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677763, "uuid": "23d58e75-d9e4-46f6-a0e0-19b7074a5f69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677763, "uuid": "37373c8a-3168-4554-af00-da25a85b6af8", "value": "24576:5YvB4sBTdSS1n4sJNVRyytWGMujHmt7r6GSEXqM:SvB40hpx40EytWGzjHLG7X9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677763, "uuid": "dc35573e-4a69-4eac-81d2-041d473602b2", "value": 822784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677763, "uuid": "2dc3211d-481c-4a69-a850-117a92334e6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677763, "uuid": "0493ef7e-d80f-4ff0-98a8-8c8cb6bfa718", "value": "CV.k11x.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bea0d3f-e721-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1654689100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689100, "uuid": "264e533a-11bc-42dd-bb4c-6b7e21409dc3", "comment": "Malware payload (Loki)", "value": "df43b3395d77b376003783a54538253e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689100, "uuid": "9a6124f1-6d0e-41e3-833f-c005097354ef", "comment": "Malware payload (Loki)", "value": "eabbad79c97a85fa79b7578a24b3806365d04efadccbf50b0bf4214e857935eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689100, "uuid": "7eda8eee-8966-4b9d-b6cd-ca9c8073ec24", "comment": "Malware payload (Loki)", "value": "fd904b56d0d4e06c25c3b2f2e66d69e7c10121ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689100, "uuid": "86b43846-05b5-447f-b3cb-666fe4885e12", "comment": "Malware payload (Loki)", "value": "8ea4bf2bd33d80082dff88f93981f0571950def9d1605c51ab89605aa9c6ba38ba7700cacc0e6402fe5d35f160d3943a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689100, "uuid": "659d4970-a585-494d-be83-39cf0ecb474e", "value": "T1CBC4122477FC07A2C5BD0BFE9864054143B2A72A643FFB1D9EC064DB1A36B91C62176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689100, "uuid": "a6ff8d71-1745-4163-9c2f-13df4e4778e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689100, "uuid": "f0ca0080-1be7-42cd-b6f0-2e612dd8a9c2", "value": "12288:IojvTXT4cZ0wpGkDK0Twmad45j+ZLRbo9q:XlZhUeK0TVcZlbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654689100, "uuid": "6ccdd159-622d-4334-8793-4d96abb3acd0", "value": 578560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654689100, "uuid": "567e9075-7f1b-4dce-bc2d-4c4983193b88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689100, "uuid": "b4143523-89a7-48f0-8175-2d766788f8fc", "value": "DHL Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c4df1d-e753-11ec-93bb-42010a9c0043", "comment": "Malware payload (LimeRAT)", "timestamp": 1654710437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654710437, "uuid": "bf670712-4b6e-4cde-9746-17fb6e3395b0", "comment": "Malware payload (LimeRAT)", "value": "6ef26da1b60b7ded9865e30a03062796", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654710437, "uuid": "8c527fc0-6fc6-43b0-9d57-fb34e83707df", "comment": "Malware payload (LimeRAT)", "value": "eb2ecf4e69565b73a8d8e0e482720d4cd53da84a12a4bbc3614ae8a140e9cec4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654710437, "uuid": "dc672ca5-4642-482d-a4bc-90893aefc392", "comment": "Malware payload (LimeRAT)", "value": "69022e9ac2104e3d0d61d916e485b39e0fdf9868", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654710437, "uuid": "e162f3e4-6152-44a5-a70f-4c09fb97e23b", "comment": "Malware payload (LimeRAT)", "value": "89ad20074290c407c0042ac9ee753364563feee6ca1e3fd2b01f5cf067a47b2b5a8070113e4c5c056f7c1af101a80ccd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654710437, "uuid": "fb165d5c-155b-4e8e-8cb7-6ce229ae9089", "value": "T1B3444F2D7B421AF2FC1E9174CD420E0CBB671B036280A996F7DB05CA8B4F7666D5DC98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654710437, "uuid": "34b02f0d-16a7-49c3-a958-b3d6a7278e76", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654710437, "uuid": "30464fa4-b861-4c58-958d-008c8ba56607", "value": "3072:3YHkbu0f5eTgCi16XVxDBwUL9oFwp+cisoAQJN8+IuCJ27MmKqy/5/1UgRGl+JV+:P7hUj9uwdENjUoMm9y/5/2gkle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654710437, "uuid": "5d52fdaf-cbed-451b-8f1f-03718ecaf72d", "value": 274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654710437, "uuid": "17abad81-2cb2-4ef1-805a-8828d806fe0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654710437, "uuid": "516f5fe8-6174-4495-a788-05e18a8c6636", "value": "6ef26da1b60b7ded9865e30a03062796.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e9de47-e6cb-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654652359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652359, "uuid": "66389484-6dfd-4a9c-8de5-cbfe71dfaa6b", "comment": "Malware payload (Heodo)", "value": "cd2b35e579bdff1429b903d39f79c344", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652359, "uuid": "52d2a6d8-995f-4032-b05c-50e18c831ebf", "comment": "Malware payload (Heodo)", "value": "eb354cfcac7cdcbb1ec0f1f982852a9db93b2ccacf41ec71c7df87a087427274", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652359, "uuid": "b242603a-cd7f-4122-b863-d6794e911df1", "comment": "Malware payload (Heodo)", "value": "3db3911293271ebec363eb04fa8e8e2171affc9d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654652359, "uuid": "1afc078c-e19c-40f6-bcba-4618214546a2", "comment": "Malware payload (Heodo)", "value": "86bbb4f16461ab03c67d62d6a13f835b7a7c6a0c853e878edb01f2f204d308004d9c75e32cd94de291e391f95342018e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652359, "uuid": "09fcd31a-c38d-4afb-aed5-6d1e4e13f6fc", "value": "T1E304023EE5031A98C22ED8FC58EE6DF9D5F634006268063A1BA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652359, "uuid": "d1bad9b0-5fc1-4943-997c-d28ddea3b64e", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652359, "uuid": "65318d6d-37d4-4781-b08f-36177ee7d7ae", "value": "3072:VpjftcFs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VR6i1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654652359, "uuid": "833c9daa-a87d-43be-b3ca-5457c944d754", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654652359, "uuid": "eea49f9f-8bc0-4f82-8801-a2ec95ef65b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654652359, "uuid": "ecce6abe-9f3f-4ef1-a740-5693051b98c0", "value": "cd2b35e579bdff1429b903d39f79c344", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adfa2f59-e748-11ec-93bb-42010a9c0043", "comment": "Malware payload (Loki)", "timestamp": 1654705988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654705988, "uuid": "9bd31ffb-7c9c-4bb3-b219-1bd936d49852", "comment": "Malware payload (Loki)", "value": "d4e1bd0c6877321711d2635a24267c95", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654705988, "uuid": "caa18601-2375-4262-8017-aa84c60783a9", "comment": "Malware payload (Loki)", "value": "eb74be110e9cf91f058bc96c002f7864948d64d41ec6ace1b908699428c2c7b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654705988, "uuid": "089d766f-5bab-46f1-99e0-5bf6aa4cebd1", "comment": "Malware payload (Loki)", "value": "0612658bd24b374b983ea0bd9c4af573e580064f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654705988, "uuid": "78ee6c5b-5ac9-4aaf-9ed5-4d5b6238fa8d", "comment": "Malware payload (Loki)", "value": "2e68f415f3cf85c1e20c9ef411030babc40739ffad0d05083b672b72e63dd0029dae65f5ca830071a04d64b3e8d5b7ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654705988, "uuid": "4d2ad58f-c565-4653-8012-d3d1d407d27f", "value": "T158D3024726D18C6BFB534674097AB33AF7E6560065470E074B642F7F2A216A2CF2E3C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654705988, "uuid": "364b973d-fe57-4e88-8d99-67fc57f2fdff", "value": "dd1742eadfc6df18ded3c26ae64ad610", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654705988, "uuid": "86facf18-c82a-49cb-a24e-694c6d2521cc", "value": "3072:F14/IIhEDnmJ+c6dMpgrn9oncmWpTzTc528BHLWU4jNd:Fb7dbz9Z5oXN4Bd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654705988, "uuid": "21fea4f4-eb95-476a-b0ef-9023f86a62fb", "value": 131961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654705988, "uuid": "b0985a1b-48b1-44ff-8f1f-6fcdbbbb5bb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654705988, "uuid": "014bd0d0-13b3-4143-b7c5-34c451866d6a", "value": "d4e1bd0c6877321711d2635a24267c95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67665b49-e72f-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654695132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654695132, "uuid": "9537c783-31b1-4021-80dc-8e7da88b1e16", "comment": "Malware payload (AgentTesla)", "value": "739a4ec91a13d59790efd7976ff9ab45", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654695132, "uuid": "1b5ba226-b395-4d5a-a914-d342edbd5120", "comment": "Malware payload (AgentTesla)", "value": "ebd86847179c66fec9d4245f7735cbf2afdc8e0698e1fd835a1d0742d0ee1a01", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654695132, "uuid": "8c203506-c5df-4ef8-bb6c-279dcf3ebe1b", "comment": "Malware payload (AgentTesla)", "value": "e9219b1097cb5a48f319c6e08e754ab55348daa9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654695132, "uuid": "0df11987-58e9-4e4d-9e4b-55350cfaf574", "comment": "Malware payload (AgentTesla)", "value": "6714af9d6f5d79136a2937c6baca2691abc036f66dbf4965cdf6f8db777ed22bda1cebdc6c4adcabdda7861daaeb9329", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654695132, "uuid": "da0e76a6-383d-434f-b604-2fb93578f217", "value": "T19AB47C5C362C71DEC857C572DAA45C64EA6074AFB71B9107A06309EEAE4CB87CF105B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654695132, "uuid": "cd60efa0-6410-4946-a674-2e2c5daad90c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654695132, "uuid": "3b5ebd34-b9bb-4915-929c-e4a3fab87782", "value": "12288:GlgPXU7g9reT/9R3WitAWjKWqGMy7NMFUbohkluq36Z8Fkgvzr:Sqkz9RBTKW+GMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654695132, "uuid": "01cf8f85-d1b0-47a5-8c01-accb7c95ae5c", "value": 510976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654695132, "uuid": "1c438b83-e92d-4f03-962d-115a75b9581f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654695132, "uuid": "6c671707-609a-4801-bc99-374876d342ab", "value": "Quotation 774 MS Digitech-R1_24-11-2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "510b14dd-e776-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654725589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725589, "uuid": "7a8de168-a60f-4e60-a081-dabf271e291d", "comment": "Malware payload (Mirai)", "value": "7a1aa9a450a64742656b849a27bd3caa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725589, "uuid": "00a3f73d-72af-4cd1-a978-e110569c3951", "comment": "Malware payload (Mirai)", "value": "ec0377583ae6f9746432653b84cd7cf2519b315a309fe7046821c77230fbd545", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725589, "uuid": "207d4b0d-e964-4690-a55e-9a95501b6b75", "comment": "Malware payload (Mirai)", "value": "6ffb444d2e708f1e7a4ebc6c1bf5b96d603ab5e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725589, "uuid": "1e5c0375-05aa-4df7-8577-4c2266abc437", "comment": "Malware payload (Mirai)", "value": "2adee9aa69af4321cf9dd20c5a3700c627f8d4ae698ed832f7dda04b41ae3ad07a6db70db95971ab4503296a3751542a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654725589, "uuid": "ac45763c-a9fa-4da4-aee8-9ac20d0c5114", "value": "T159633A63BE62482BC4D4A67A61F74334F2B2874930BC5B2B3D630D4EAF65B443267794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654725589, "uuid": "691da43d-9937-4e35-88cf-a4f1b63f6a42", "value": "768:cmjfVLJkeFVEKGJ99/W4NZLuXCFU32brO+NM5VrEd+Ogw1tMkAyAFktGvuSAFglQ:cmjBJrF+KGU4fKyD7NM5OtHAktGBoglQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654725589, "uuid": "2044e15f-7b19-44ba-b3f5-274b997dc1f2", "value": 71660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654725589, "uuid": "25a37d8f-c32c-40fe-9d61-c618fbb2d5b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654725589, "uuid": "40df7d27-103f-430b-994e-2c42c46297b8", "value": "7a1aa9a450a64742656b849a27bd3caa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11618ed7-e6f2-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654668788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654668788, "uuid": "3459a997-2c1d-4547-a208-06a39abfeb01", "comment": "Malware payload (AgentTesla)", "value": "b9e1ede3ca6a61ebcb35a6751477d26b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654668788, "uuid": "4bdb96f9-a217-4223-a76c-b447519821d1", "comment": "Malware payload (AgentTesla)", "value": "ec206072bb01bd03989d512084a9035ddbf136179215b4d6892382115c115fdd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654668788, "uuid": "44840eae-16be-4120-855e-48215ad8b8ec", "comment": "Malware payload (AgentTesla)", "value": "535fa286fbe4e77c598bb33f68a1c0c782d3b545", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654668788, "uuid": "38511ca1-47ad-4242-b3a8-42ad23cba597", "comment": "Malware payload (AgentTesla)", "value": "1a522a2771b058cc950dc5f3e1271c396e60652bf1148a22db1fae497b6e7a5d00c7dddeb2b53eea034ddf96aa66ee93", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654668788, "uuid": "0467fad5-a670-40c2-8c12-1df222090361", "value": "T149E47C9C362C70CEC867CD718E58BC60A720347FA71B960B686316ADE99D747CE143B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654668788, "uuid": "db9a5905-3ef6-43fd-9241-db0db2b6b5d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654668788, "uuid": "d0ff1433-d32d-4c1c-884f-8a94fea0aaca", "value": "12288:ayUDLCmNCujPevTEpN8/LWCSn0QQzMZdnh4shQI6FhSOWS3O1r5:aHCmNjPewEQQzMO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654668788, "uuid": "dfe6b20e-1d2e-4258-9942-d65daa81a3ed", "value": 719360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654668788, "uuid": "c736bece-6473-48e0-83e3-79c108be9f9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654668788, "uuid": "293d32ea-93c7-49e7-abce-78b6bfdb3c43", "value": "swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0dfd4a7-e706-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1654677727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677727, "uuid": "42630dfe-09e2-4a26-a5f5-9cf71361d2fb", "comment": "Malware payload (SnakeKeylogger)", "value": "fcc091d6b34783e9200b1654d35bff63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677727, "uuid": "aa7a3732-79c1-4788-809a-b9f1b0cbafd4", "comment": "Malware payload (SnakeKeylogger)", "value": "ec4336e98aa5fdef0c27d0c407c33b3bac4195eb1a2b8439cd964f5c3397d8ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677727, "uuid": "fcc8ecbc-6f02-4805-950c-8eba9e3d01e8", "comment": "Malware payload (SnakeKeylogger)", "value": "74eed1968a8bf30d2d258ce2a2f096245adaa6ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654677727, "uuid": "63d1a416-9621-41e2-a1e3-d0699c082792", "comment": "Malware payload (SnakeKeylogger)", "value": "12599e790193ba8a1473318ac0620c2214d6b7bd0bbf1ec78b78e777a7bbf63c58fc2a89e845b09472d1eb30a4f2f10f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677727, "uuid": "c31b3f7a-0765-4cc2-9251-310d223b97ad", "value": "T126E4CF9073AA9F71F2BD63F26420900817F4391E55E1E23A9ECD70CE72A1B8259F5E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677727, "uuid": "19954216-ee5f-4f8d-ad21-968e0da65ae8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677727, "uuid": "c73f7eb5-c421-4f9d-a2c8-91b14d5a6736", "value": "12288:iJbJX09qQP+CYX118+K1j1kuUeqbFuMp1xqVgoXV1/:kbJX07GDFnWhPkk9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654677727, "uuid": "9c22f9b5-bcd5-466f-bc13-cbb898c2d579", "value": 674304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654677727, "uuid": "c97fabd5-1279-459c-9b25-8587943b4044", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654677727, "uuid": "b5e9085a-3a1a-42e1-8cb7-d190dca58eae", "value": "CmHtKSh5eWEnaxD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38260ae0-e6f0-11ec-93bb-42010a9c0043", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1654667995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654667995, "uuid": "daf6143e-b83e-4d9a-a0c7-c517ce8b07ce", "comment": "Malware payload (AveMariaRAT)", "value": "d0cffe2fce55cdee9cc00917513a601e", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654667995, "uuid": "6c79af54-5084-43ec-afea-3312c28d70e5", "comment": "Malware payload (AveMariaRAT)", "value": "ecc62758ef557c2ed6796ad203c9df3a19f2b10edbfa1c3291f7a64f04286233", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654667995, "uuid": "2896c5aa-d6e9-44b4-b538-8efaa6e285c3", "comment": "Malware payload (AveMariaRAT)", "value": "3391388ade8cf16ffe0d053b2a77d482df443055", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654667995, "uuid": "721e773c-1468-4434-afea-10d9225b5729", "comment": "Malware payload (AveMariaRAT)", "value": "15d401e7ea86c2bed2e060947cdfea822ff0b364dc25d11e8cf906babb49b39549452f52d3f7af49fd7e0f70e81fd7ff", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654667995, "uuid": "e44d0968-c8e9-4a60-b6fb-73c894718c01", "value": "T15654BE57B78D9B8CC3589A76B5F986340361DF2335225E24B8C8FF3C4AB139E26106D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654667995, "uuid": "acd53e20-7ce4-46c8-b866-78622e3fa790", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654667995, "uuid": "88d3fc32-f3ca-42f4-9d7c-c474d043d047", "value": "3072:VakZYd+dTF/RryLGvvrUSrVFF4QwrrNDMJMG6j7PsZaUNzSM0H1YisB:Vak+4RsYTUD1DKMljY0+zSG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654667995, "uuid": "29423685-e34c-4787-8d70-4c5612518ee5", "value": 295448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654667995, "uuid": "473986ab-50e0-4b2e-ba32-a7b93a000eb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654667995, "uuid": "7a6969e1-52ea-4bbc-9abd-ec326aa891c1", "value": "Invoicce june.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f50e311-e74f-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654708943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654708943, "uuid": "c3120cbc-f93b-4bcb-b5be-ed454660d81b", "comment": "Malware payload (Formbook)", "value": "6c0c7c7b6bb4b7beb0fd2e834f34db5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654708943, "uuid": "8cde4c38-ed91-4829-b168-8d5a11f3ba37", "comment": "Malware payload (Formbook)", "value": "ed02c3de60701f97271c578756211131d9d5e7bc141e77f97abfbe9d64ccc92b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654708943, "uuid": "0256be01-2c4e-424b-8c18-f0e356a84b94", "comment": "Malware payload (Formbook)", "value": "4fbd9569327fd153021dba6bcac1ce4751a92405", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654708943, "uuid": "51f42c2e-6cc6-402a-bcfd-013569f7c020", "comment": "Malware payload (Formbook)", "value": "e7635cd0655da264ad432026b17e00e3bf079a6975cb896161444ad51513bbd28d2815e94b312a4cbaf92a42c0c18490", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654708943, "uuid": "f18efc10-76d0-43a0-9998-7fbfc1faac07", "value": "T1D57343E1B617DDD8D8064BF20C76966000675E4D88A9D50E30EA3F3F77B335328A6D6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654708943, "uuid": "5e0a54d8-9e9d-4318-9d61-907c1acecde5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654708943, "uuid": "8fa42d90-fb43-429e-9742-24f85a78329e", "value": "768:UP74bhlSU2Ip4jBqltCF0AxEjenoB69+Fxm:84bhlSFHBWAxEjc++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654708943, "uuid": "6b333976-e185-42f5-9f15-6e3f6390fd2a", "value": 78336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654708943, "uuid": "690b6026-d671-4a50-a244-1c60bd82462d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654708943, "uuid": "6ddb0f0e-4270-4abc-a49c-aa8e93ba054b", "value": "MT103_Ref001293838 Confirmation transfer Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4f31a48-e774-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654725005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725005, "uuid": "2809286b-8435-4939-9f85-f1c68c58b592", "comment": "Malware payload", "value": "c04539d9876d4b43efcd54999bca979e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725005, "uuid": "c670d9d4-72c1-4cf3-b61c-8ba6d40f9a78", "comment": "Malware payload", "value": "edd6bad503d5177dc641073d1d737abc869a7468e9a4346851e07cbb80b57ce1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725005, "uuid": "fb1618c7-de01-4f12-bc9f-c4a26edb5c2d", "comment": "Malware payload", "value": "199e2e7e531bcf63d89687fbcc07619b142ae815", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654725005, "uuid": "fc1f6da8-125b-4f90-afee-d6deae2a8d41", "comment": "Malware payload", "value": "28669358462e3760441c441bf98a37bc1d8056a34ea16a66977ee58f7f3e2fcc88ec9593016236a72df92a5edf44297f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654725005, "uuid": "c41d261a-531c-43da-b9b5-34e550c8eb15", "value": "T131330744EB87E1F4DD0B4C7104A3B1BF83369A569025DEAEE7887917F933A329025F19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654725005, "uuid": "5eaa5572-08e4-4152-879d-469944710138", "value": "1536:3ESIuYNrHXktK5duFaEfUy31A9nfB2qrk:3ESIuYNrHXk04FK9fkSk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654725005, "uuid": "2f176a09-4f74-4f95-bebb-c7045a7de957", "value": 54088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654725005, "uuid": "93083ad8-a96e-4484-aa96-b6f1b3dd42c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654725005, "uuid": "5d5d3255-cca6-44f9-8689-85ab6f965b3a", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e19627d-e718-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654685292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654685292, "uuid": "65f862a6-fbeb-4601-8fdd-dd9c03c16844", "comment": "Malware payload (Mirai)", "value": "934b11f3323bab99c02e12e3efcf2e2f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654685292, "uuid": "3d6d2ecd-94b1-4fc1-8e50-a44747fdb76c", "comment": "Malware payload (Mirai)", "value": "ee3b0109a5bc5d7f946f9c618d2e26e978d72e3eb911406859539c93e60e3c68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654685292, "uuid": "f6a53439-5a35-4cc2-9b0e-0d8a35cb2da8", "comment": "Malware payload (Mirai)", "value": "8dca41bd0119b6bdea91d94345382f08f1e64891", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654685292, "uuid": "34190544-8f2a-44c2-a3ed-b48a1896c628", "comment": "Malware payload (Mirai)", "value": "ff6eb5d1d659d442b6198c24471cbad8c97df625592c5c6337fe1dd103e3e82aad1b49839416dcf16df37b58f0976140", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654685292, "uuid": "f68b18fd-3ddc-48ba-9d4a-8bc4f2ed8baf", "value": "T199635CD5B4019E7EFC07E7BA80120B09F52172546F930F2FA65BFCA76C720A96E16E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654685292, "uuid": "11001d5f-0f76-4460-91ff-d7c52bb276b0", "value": "1536:HNL7/0Nion/t8TmEOuIIaO0zVt3scEPznuHq8hOZ:H1Ton/tma9zX8TnWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654685292, "uuid": "a5a8acc9-c37d-40a5-aeb8-e3cf77c11a03", "value": 71596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654685292, "uuid": "6e6f9455-39ab-4581-b0c5-1b95c948b123", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654685292, "uuid": "d8a4bca4-1313-4366-b8ee-a7b10a456007", "value": "934b11f3323bab99c02e12e3efcf2e2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e11b7fb5-e777-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654726260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654726260, "uuid": "d761cc76-7ce5-43c4-9490-ea80ee64098d", "comment": "Malware payload", "value": "d39f4e0a4636dfbe11b35575f4689951", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654726260, "uuid": "430bff18-3a09-4335-b481-1c4039783ef8", "comment": "Malware payload", "value": "ee7803505f364a78422098b5e5bf826bd80f551a76495e50077257ce8c3030b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654726260, "uuid": "1106dcaf-7012-4d64-9614-d1c173969953", "comment": "Malware payload", "value": "2a9d8a357686e2f849cb835ecf91f8f83c5e2a23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654726260, "uuid": "be6e7320-0c7a-40cf-854d-b78cdba831fc", "comment": "Malware payload", "value": "c0aaec436741a9d0575500e9a142ee1c6221d1fce0c02c893cbce0cd5797956f94f8995dcad8d3317e13413390e7eed7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654726260, "uuid": "0c4bcc2e-e18c-4fa4-b285-7518ef1f3bfa", "value": "T1E1051947E77345FCC96BC97482A6A732B930785841397E2E4F80DB226F65F20953EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654726260, "uuid": "dd489704-5cfc-4656-b129-9635a1982c37", "value": "733e4ccf9ef47c6e471d93270b5eb898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654726260, "uuid": "c18f1cef-6594-4170-867b-53982c623a80", "value": "6144:v7rc6Wk6SYnaKOai5uWLwrd0jSjc0vNPqBVzLFWyWUPV2m7hzS7583Tg7A+++ncE:vXcFk6SYna2Frd0jSjcc9SimBZX0TMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654726260, "uuid": "b53a016f-d984-4849-b4f0-1084d4c442c4", "value": 841728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654726260, "uuid": "239fa34a-b0ac-4e2c-8766-4e89dc50fe32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654726260, "uuid": "0a063d9f-34b9-429c-8020-f54074f710f8", "value": "d39f4e0a4636dfbe11b35575f4689951", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca862f1e-e72b-11ec-93bb-42010a9c0043", "comment": "Malware payload (NanoCore)", "timestamp": 1654693580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654693580, "uuid": "a2f5ca4c-8a17-4723-802c-d7fd81d23e20", "comment": "Malware payload (NanoCore)", "value": "e79cf9fb66aeb979f3cb1b6a00602508", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654693580, "uuid": "3b4cd342-80ea-4b6f-8f49-e4927ad7ae2a", "comment": "Malware payload (NanoCore)", "value": "eedfa2c1826d7e4238b68a11913daeab8c065678f3eb3a6885b9842d0b0fc938", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654693580, "uuid": "87226e2a-ff02-4e6d-9ee7-1501fae23933", "comment": "Malware payload (NanoCore)", "value": "8e12407120e39aa99e9c7cb2b155bc2883722422", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654693580, "uuid": "dfa83ed7-3b2c-4655-90c5-b3afd4b3361c", "comment": "Malware payload (NanoCore)", "value": "4d9c07bc60320040f8a7ce1c5f08edd90a02f85b8c482aafe21c606f00e78cf8d0d6868a4f4a440db1237340e0b0393e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654693580, "uuid": "835e4800-69c8-40dd-bb18-e115c9f76d46", "value": "T142C48D9C366C35DEC857C572CAA45C64EA6074BFB71B9207A06305EDAE0CB87DF205B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654693580, "uuid": "43a281ba-48ca-422c-856f-b2f0be973e2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654693580, "uuid": "2e0778be-a2b4-47c2-ba2d-e26a509442e1", "value": "12288:xrUovoMbGQGPdZJl92mxsofbqrjCEwE9FUeQ1cQ+ooRu/GP:TwqGQITj5bojC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654693580, "uuid": "522ec3fd-a9c7-41d0-ae2d-9d3eb5e114b5", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654693580, "uuid": "74fb186d-4303-4471-a43c-9b50a323beca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654693580, "uuid": "2f2127c3-0338-4c61-a44c-8f365f28d90f", "value": "xIDaRmtWsqsbz34.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8823b2eb-e729-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654692610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692610, "uuid": "00d01f5f-316d-4b8c-a1b9-6871c78b59cb", "comment": "Malware payload (Mirai)", "value": "822341b682bd43c32f5c0eeb9cef54f5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692610, "uuid": "61aadad4-49f8-4ce2-81cf-ff35f21b0653", "comment": "Malware payload (Mirai)", "value": "ef13a917d718e06ef1f333afa35481b841220d291bcc0dc366388e72f517d960", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692610, "uuid": "d9806df3-7cd8-4cea-a05d-eaabc3c57156", "comment": "Malware payload (Mirai)", "value": "a5099a3e95bfe67af6168ea759545f771f5ab81e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692610, "uuid": "ccd069a9-907b-46e8-8981-50a882084fb4", "comment": "Malware payload (Mirai)", "value": "48640ceb5baec1e0499a56b2525f9fbdddd0aca370e4fe6651ee1468910eda05059aed1aadac988e0d365e558fefa1c9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692610, "uuid": "c7e4a983-720e-4846-bfb1-7aa430660eef", "value": "T18F133AC19983D8F9DC1506B53077EB338B76F13AD12DEA97D39CD932A842642B50B26C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692610, "uuid": "2f65a318-9f50-47e2-b4f1-dcbfaeb5d30a", "value": "768:noGXlNCqdxDNNSE/qDWKbzfZ4O7xXI5DDGCftjdX/pXk/GJiQqirc0cun4eqFWWW:no8dxZNSESDWKZv7e8IHgQxrcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654692610, "uuid": "545514d9-ab6c-475b-bd11-a61231b51995", "value": 41744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654692610, "uuid": "72d1b3e7-fcb6-492d-ad21-8014692887bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692610, "uuid": "15f338f8-4cc0-4ab7-9a2b-a1932fe80da0", "value": "jew.x86-20220608-1250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73ddce2f-e76a-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654720493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654720493, "uuid": "4c916991-8ead-4d1d-a638-d0f30c2c24cd", "comment": "Malware payload", "value": "9d2a4356e37234af3061b49a8248891d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654720493, "uuid": "77c7c13a-9f19-4355-bf85-a903594a8e8b", "comment": "Malware payload", "value": "ef16a419a8cd534c80d057890106e1f7a79825f6e7fdcc70e3411781925f6996", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654720493, "uuid": "c4e48d8c-ddca-402c-9ccc-1c65e3ad6d9d", "comment": "Malware payload", "value": "1eda812bc2126e9f81695fc5b09d4b119f4d64f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654720493, "uuid": "1456ae2a-f4b2-475d-a99c-cd91e4b6290c", "comment": "Malware payload", "value": "3c9396dd06acabfc1336ea4826913fbdf21b14d339f58ff8764e13bf91c3ada35ede44c690390f7a7320fce6d94af77b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654720493, "uuid": "4c724f11-c987-4526-b35e-7bbda6b0c8b6", "value": "T18545F158EA958913C109843CD872F2F26A749F105B62C5771FE47A4B3F3B381C44AEAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654720493, "uuid": "7a91f80e-0865-4a89-a86d-9661636fab7c", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654720493, "uuid": "af852091-393d-4379-9e84-5e44e805bc2a", "value": "24576:nbvRiRnSIFWZkl/zkz2bxnYldHloIWaorVqjSHqiLVn2tilR0:bJiMI4cQ+nYldFoIJorVqfiLFIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654720493, "uuid": "95bdfe75-daa9-4830-b9df-7c2606c3e938", "value": 1239296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654720493, "uuid": "dacbce9e-94ca-458c-8626-2954447d22f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654720493, "uuid": "cf911aa4-7807-4e6d-a2a9-cc2b98e595d4", "value": "SecuriteInfo.com.W32.AIDetect.malware2.15379.5596", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3418df40-e75d-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654714803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714803, "uuid": "91efbec6-e0fd-4679-b7f6-39406a0f5077", "comment": "Malware payload (Mirai)", "value": "5a1d55249f7d59894517b688cebc32a9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714803, "uuid": "977ae408-1572-474d-a4cc-69c39f1c5938", "comment": "Malware payload (Mirai)", "value": "f013a265951300972ebd14f2902cbd75c7f97af4729d17221e28f906d260838b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714803, "uuid": "36d55111-1f68-464d-87b9-22c21ab5ef92", "comment": "Malware payload (Mirai)", "value": "f46e9044416b03e1b0cbc9c687755ad0f1902032", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714803, "uuid": "d22ab771-fac1-4318-9f74-bdb1e566751f", "comment": "Malware payload (Mirai)", "value": "b05a7f30e948f0c253fc1e5b88f0152c3ad0d50c698e1e90a73912cb1288fa2635654fdc76f34efe892f1f5726ae2c73", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654714803, "uuid": "cefabc29-cafc-4a10-9c74-46bb244d6af4", "value": "T131D22A377541D0FCD85CD1B4699BF932C533783D1212B65A77C0FA26A9AED322E1A20A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654714803, "uuid": "0c664ff1-da42-4112-a609-3aae45bb9efd", "value": "384:G8eWRxQ99oZPReyhdmSMsKBPPGm+CufQhYiL9rXOoGa2LFrWgkwbyJr4WOG+ut0:Gv+xUOZmSMs072sfoRrWgkcyV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654714803, "uuid": "c8c03cfe-ec20-490c-9e50-bb10f094ea3f", "value": 30496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654714803, "uuid": "d87ecc87-682d-4160-a487-962a63b750c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654714803, "uuid": "6fbb7715-b638-404a-b76c-e711dd160495", "value": "Boota.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2219f97-e70c-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654680225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680225, "uuid": "8a28b3cf-c248-445d-8bb7-b29a1bfa844b", "comment": "Malware payload", "value": "911d730ddb9f8afa7307d166bcec85b7", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680225, "uuid": "8d93c20e-5f88-4b75-83df-d6f7336f29ab", "comment": "Malware payload", "value": "f057580c0a6c016c347eb24ab5bf4fe8f45861e19d820594f1f696ebde06874c", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680225, "uuid": "b58f4ebf-cd94-49d0-8431-5643d4e43723", "comment": "Malware payload", "value": "5bae2cdccd61d0ad2cfbf24b4a11a836dfec6909", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680225, "uuid": "3206a390-92c2-429c-9edf-f0e5dacea5d3", "comment": "Malware payload", "value": "9207c24a581d253c42c75d44d80085f1c2a5be19d2110976a15ef7ba7f384f2eb061de55ecd508db009bf74ed223b52b", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680225, "uuid": "52b96dbe-4601-4d1d-8c92-47eb6e6b1de5", "value": "T120266D16B284A13ED0AB1A3A4937D668693BBA713A23CC5B1BF4494CCF355407F3B647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680225, "uuid": "1bd04b58-b0c2-45c0-ac08-fe95d8411be1", "value": "98304:Zxncilj+XtRkbS5xNJ27vFgsnW5vqOYFA:ZNJ+9RsS5xNJ27vFgssq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654680225, "uuid": "791bc37e-ad10-4afa-bad5-348a412a1bd8", "value": 4798976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654680225, "uuid": "973e6b28-3307-4164-89e5-55f12b1d4875", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680225, "uuid": "4d3f3761-828e-46b7-b05b-b34bb6b52b05", "value": "NTFS.Iplace.AppleFaturadacomsucesso05062022219.MSI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e57b29d-e721-11ec-93bb-42010a9c0043", "comment": "Malware payload (Quakbot)", "timestamp": 1654689211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689211, "uuid": "ba74feb1-aa4d-4606-a203-d64d919b15be", "comment": "Malware payload (Quakbot)", "value": "59c9d442335e4d5e626d694b2cf5098d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama186", "colour": "#D28FAA", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689211, "uuid": "fd6fedca-6a8c-434c-b982-a9e877363871", "comment": "Malware payload (Quakbot)", "value": "f0bc0c1e4c8b5b546a8beffd10e8b2899c7d522621d4cc0d1d232d85a74f58f5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama186", "colour": "#D28FAA", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689211, "uuid": "549f47f9-ea5c-4808-a62f-f6bea2089bdd", "comment": "Malware payload (Quakbot)", "value": "7751cf4bdd5f3fced05ca1b8cf71a239d9553066", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama186", "colour": "#D28FAA", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654689211, "uuid": "b111ccd5-6726-4dc5-9e80-e56ef847baa6", "comment": "Malware payload (Quakbot)", "value": "e48fd2666a823b417ec47ceb965beea180c8cf910c51ac9f1c3c9e51a96c021d16e5cb7c6f13b5d2460094615d6eb8bf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama186", "colour": "#D28FAA", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689211, "uuid": "12a29fda-6581-445a-b06e-4f114ca42508", "value": "T16C656C21B2CEC737D4F3267C8D6FB659942A7D111E38945A7AE40E4C0E3A6813E2D6D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689211, "uuid": "12bf20dc-a8a8-41cd-94ab-5b70798484ca", "value": "ba3f74b1c1ea8ef5b9ede9dc13ddf9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689211, "uuid": "3cef14c0-27a1-47fa-9c14-06412fae130f", "value": "24576:a80Ra7rJwVXWqZLSPZF5BQjaM+R4YENZrfrzfQTD6CJ0:at8kRKZ29+I4TDLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654689211, "uuid": "3d841259-5e7e-4d35-8de5-b41ab6b8eb77", "value": 1437696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654689211, "uuid": "a323b526-e770-4277-bed0-ec56234e47a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654689211, "uuid": "1528e53e-87af-4216-8abb-981098a73031", "value": "f0bc0c1e4c8b5b546a8beffd10e8b2899c7d522621d4cc0d1d232d85a74f58f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d899bb59-e6eb-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654666116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654666116, "uuid": "aba16b49-1d31-421e-b8de-0f12a2079974", "comment": "Malware payload (AgentTesla)", "value": "56b1fbcdb13216860aded84e18b0bda2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654666116, "uuid": "bf9d2ca8-7863-4c10-ae77-fabd90c405c5", "comment": "Malware payload (AgentTesla)", "value": "f17dc0c050d26bb58bf1e0b50fb4e910c2ceb4355695a6252e68ad92af42c99f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654666116, "uuid": "4d40d7f0-92f5-40c1-aa5e-bcfdb7861ad3", "comment": "Malware payload (AgentTesla)", "value": "9beaf605bfa46384b69211212a68b369a3eefc81", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654666116, "uuid": "2de693b6-ca3b-41da-a328-a175f519063f", "comment": "Malware payload (AgentTesla)", "value": "adc6745036423b140c120c7765a23f94d1e02f3952f21a9bde61e25ecbdd5da5bbff141bd8672b757b08d7a73335fa83", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654666116, "uuid": "53641dad-1e76-4a67-a6a1-c54bbda6949c", "value": "T1CAB48D9C366C71DFC857C972CAA45C64EA6074AFBB1BD2079053099DAE4CB97CF201B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654666116, "uuid": "a4187715-8fa2-44fd-9a39-886c49fb4886", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654666116, "uuid": "9a3506a2-6719-4f91-b1a4-1cac090c7f1f", "value": "12288:HqqHGwUsd/mPtJtdXjY8g/ZEHWsrw40zVTVz9XbbuE14f:K/wUFlU8ge2qw40z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654666116, "uuid": "b85a39c6-f856-4add-9651-38b069e8c6c6", "value": 531968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654666116, "uuid": "1a38a85f-2c7c-4a3f-a152-883d01590d39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654666116, "uuid": "be15d4d7-b781-48da-831f-30740809cc46", "value": "PAYMENT DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7759f7ea-e768-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654719640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719640, "uuid": "b3656434-0fc4-468d-9f9d-d81298717e84", "comment": "Malware payload", "value": "55de4eca6d5199e829aaa151cda42b59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719640, "uuid": "e2b5804e-db43-4f78-ab3a-00bcf3a6dae4", "comment": "Malware payload", "value": "f19628c79843fe5208875e2bc4972101f13738738179aca85d01aea953c85d70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719640, "uuid": "0cfc3e7a-eec1-4cad-9fe4-2108a94af3e3", "comment": "Malware payload", "value": "d149e057bf0d116b7d8a7b3b34c279bf3da5ff85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719640, "uuid": "ff43f2c0-2483-48e3-8874-b67bd2d9a33e", "comment": "Malware payload", "value": "71ace0d366b997c09b4b54810d4eafed561c93c8108901f321df0f8c99bf0fee823c744c0991d0dc8ae0beeacc7494ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654719640, "uuid": "dc6f738e-8fe4-43fc-a77e-e6c639c87409", "value": "T1CB051947E77345FCC96BC97482A6A732B930785841397E2E4F80DB226F65F20953EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654719640, "uuid": "1b8d89ad-421c-4131-b7ab-3b8f02ae39b8", "value": "733e4ccf9ef47c6e471d93270b5eb898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654719640, "uuid": "5d194e63-2c0c-4d97-8725-416c8d3f384b", "value": "6144:v7rc6Wk6SYnaKOai5uWLwrd0jSjc0vNPqBVzLFW0WUPV2m7hzS7583Tg7A+++ncE:vXcFk6SYna2Frd0jSjcc9SYmBZX0TMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654719640, "uuid": "6ab9e1b0-d9a0-4a2a-b629-75dbd717bcbc", "value": 841728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654719640, "uuid": "ba87065e-1932-4665-8b8a-eac1de5542f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654719640, "uuid": "9004de06-7fdd-4dc8-8c4a-c70e9f6d38ca", "value": "55de4eca6d5199e829aaa151cda42b59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d7ee72c-e712-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654682633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654682633, "uuid": "e0157cec-1863-4607-bd8b-e090d0b2d171", "comment": "Malware payload (AgentTesla)", "value": "d06d77fb4c3210f88c3b19dfc3d40f29", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654682633, "uuid": "ad1636f0-6720-48d8-b7c4-7c931d13098d", "comment": "Malware payload (AgentTesla)", "value": "f1c11fdaa554d55ae653cf3af3477d0a79eac18c0f6b5c6453586fbb70dc9036", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654682633, "uuid": "64ebfc6b-747b-455f-99b0-a5a54fc71e9a", "comment": "Malware payload (AgentTesla)", "value": "c6aca10f965e3548f040dd20028a3acf283a267d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654682633, "uuid": "703bf275-74e1-4947-9e6b-0dbaffd12ad0", "comment": "Malware payload (AgentTesla)", "value": "33c952204a9665b0a59c281416c0ae626515f04576fd7666cfaebd432d29ee1870dfa4cf451ba33d8f6622e9ef16ec20", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654682633, "uuid": "4b5c304f-4a91-4cbd-9188-698894de05a2", "value": "T14EE4121977EC16A1C6BD07F9A815100057B5B63A542BF70E4E9174EF0E2ABE1CB3272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654682633, "uuid": "2b06c407-f5a0-4c0e-93e6-8a197736bf8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654682633, "uuid": "ad13fe5d-8b54-4ec2-bf3d-4a0d8be55b9f", "value": "12288:TGeEsvDuCXDgzHVobd/AaxIjTtckxAySWFsm/AxI2p+ohEpbo9q:fvDuCTGHVes3xYW2ka3Ezpbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654682633, "uuid": "d65a3357-8589-47a8-888c-9401b6f3a05b", "value": 682496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654682633, "uuid": "74d69bb3-c6d2-40f9-b83c-450c869d0cc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654682633, "uuid": "090396e7-670b-4c81-8f89-1c48bd3d7d74", "value": "SecuriteInfo.com.W32.AIDetectNet.01.13627.32157", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "772fe9c7-e6fb-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654672825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672825, "uuid": "5278134e-2e6a-4a7e-a68b-d16d869bf32a", "comment": "Malware payload", "value": "f7d86fd46189eccb9baa35f45196373c", "object_relation": "md5", "Tag": [ { "name": "2022-29464", "colour": "#352DE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672825, "uuid": "b8eb4016-cb66-4593-a5a5-058bac98d543", "comment": "Malware payload", "value": "f2658cc685371d2a3661d1d2d39e8dd6923b012cc0402bdd6a747befd68ab197", "object_relation": "sha256", "Tag": [ { "name": "2022-29464", "colour": "#352DE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672825, "uuid": "19bfd044-2c41-4a0a-8e30-b6607b2b465b", "comment": "Malware payload", "value": "2acf84eb5f7124004784f61b0036b165e062ac57", "object_relation": "sha1", "Tag": [ { "name": "2022-29464", "colour": "#352DE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654672825, "uuid": "3413e343-2998-4ec5-a7e0-f518bba3c0cb", "comment": "Malware payload", "value": "0b758122baa537351db53583a6c8a0e6416c27d4f3c036b0d83216964f1ed939408c00945cd27a2a8c7c9160f5662ea4", "object_relation": "sha3-384", "Tag": [ { "name": "2022-29464", "colour": "#352DE3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672825, "uuid": "a19529f0-bec8-43e7-b0ce-b497ebc07217", "value": "T16851532FF118A1CFB254F07C168453B905E8F4319571F962AF17CEA68BE43E214963D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672825, "uuid": "3f71a782-8102-4452-a473-58832f7542e2", "value": "48:cqWKmlJ9TaSZyFlRSpPA9JrlbpEcp9+eYCx0XbbIrRKwgJlLmaAdhwRv57:fxQ2bFloQZCcWGawIlPAdGh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654672825, "uuid": "50a59270-08fa-432f-acaa-879bbedc72b0", "value": 2829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654672825, "uuid": "40920ce7-b71e-4f70-a9a1-26386a1f89b2", "value": "application/x-java-applet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654672825, "uuid": "014f8d80-3963-428f-8a6e-23abbede1eac", "value": "f2658cc685371d2a3661d1d2d39e8dd6923b012cc0402bdd6a747befd68ab197", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77517e57-e73f-11ec-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1654702031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702031, "uuid": "2689eabe-0999-4a82-88aa-fa6ee732734d", "comment": "Malware payload (SilentBuilder)", "value": "119a38a73f6e3149c1d3db532ab826ee", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702031, "uuid": "b5c1ab15-39f2-4351-b2fa-42e30a5a85ab", "comment": "Malware payload (SilentBuilder)", "value": "f2ce387dc7fca0e222d78155858865a04ef9ee1158027083155156c370558fad", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702031, "uuid": "db28b59c-9d25-4b14-b344-432ef2405208", "comment": "Malware payload (SilentBuilder)", "value": "94d8a89e3015e7a2764a254ac501e2f6ad197618", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702031, "uuid": "4dd23f61-755a-4712-878e-8a730abb6856", "comment": "Malware payload (SilentBuilder)", "value": "e7ec648d191c794a9b8d9b6ae79493b74bd4f0f8e4fc7628265d698664a744f9cb4d614530c8bc19fc5110d8ca55e8c7", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702031, "uuid": "1cd9a70e-1e1a-4254-8eb8-1a7f09eedb91", "value": "T14C23A546BB5AC85DF914873448E747EA7323EC314F6B0B433669B3256FF89A05A0325B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702031, "uuid": "144fb303-4213-4c83-a53e-9fd44223c096", "value": "768:hDMPKpb8rGYrMPe3q7Q0XV5xtezE8vpI8UM+VmQs7iqj/X20eu2j:hYKpb8rGYrMPe3q7Q0XV5xtezE8vG8U3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654702031, "uuid": "d3708a68-130f-4d27-99d1-8f927f98ddcc", "value": 47634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654702031, "uuid": "364c8b71-d618-4bc4-9267-f31b07052292", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702031, "uuid": "60f279f5-4d0f-4d0c-b625-5e836ec4f336", "value": "Fakturierung.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "388d1636-e755-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654711374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654711374, "uuid": "ef27ab9c-d61a-4ae1-902a-2b8d88a52c1e", "comment": "Malware payload", "value": "d2f46cdecc95656555f1ad963034bd47", "object_relation": "md5", "Tag": [ { "name": "6rr", "colour": "#118848", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654711374, "uuid": "f3b889d7-5af2-4b3b-976b-a2b15c4aad00", "comment": "Malware payload", "value": "f3525e18d5c7384ddb59903dab5c6518b15140ce20d8c04efe1db951b4fc39cb", "object_relation": "sha256", "Tag": [ { "name": "6rr", "colour": "#118848", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654711374, "uuid": "c62275e4-0949-4dbe-90aa-3aa29578c062", "comment": "Malware payload", "value": "d1650feaa33f0e896052646d56eab5cc11a554ba", "object_relation": "sha1", "Tag": [ { "name": "6rr", "colour": "#118848", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654711374, "uuid": "3cbd1fe6-e947-4067-8a03-216f74b5e2ee", "comment": "Malware payload", "value": "7aa6b9d02812deae6bac5e2266b42cd514aaa9e4bdbe1ee6662e26f69ad99b83ae43b0730f88f61e6107e34ce945e4b7", "object_relation": "sha3-384", "Tag": [ { "name": "6rr", "colour": "#118848", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654711374, "uuid": "48985839-2d2e-484c-8e0a-458c1ce02c64", "value": "T1F0D51251E5B804AAC2D396B18D339676DBB3B0102370BA1B1B595354EF273E0D67AB33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654711374, "uuid": "8e998a64-b657-48ec-9988-486b411d173c", "value": "24576:hJIda+OvL+CeZFt4MUGsfMfgxbRAm+Tm0837XbHPzuorOyzrBu:hS4+I+7zt4MUG2M4xb2m+ThuHkyPBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654711374, "uuid": "5f49eef3-99ed-405d-98f8-48bdeaa63336", "value": 2752512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654711374, "uuid": "c405e140-f822-4e64-8cc7-3b0b86a940ce", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654711374, "uuid": "d3187b6e-7d84-4ae0-9d3e-915725bc64fb", "value": "StolenImages_Evidence.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec2335f-e755-11ec-93bb-42010a9c0043", "comment": "Malware payload (BumbleBee)", "timestamp": 1654711385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654711385, "uuid": "b8ca84a6-b66d-4c1c-abe9-58b358aea281", "comment": "Malware payload (BumbleBee)", "value": "750d8c74c04035cdda0e2e4c8022f0f3", "object_relation": "md5", "Tag": [ { "name": "6rr", "colour": "#118848", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654711385, "uuid": "3d429096-80b0-41c2-ae44-45be2fdf73d5", "comment": "Malware payload (BumbleBee)", "value": "f3d6cc38e35b0738ac5968f8c15404bbe17a1cc00cd6af03b99942e3d9174c8e", "object_relation": "sha256", "Tag": [ { "name": "6rr", "colour": "#118848", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654711385, "uuid": "50579b8e-0816-41ea-bc3a-ee6a44193417", "comment": "Malware payload (BumbleBee)", "value": "eefea7491859a56200b9e5d7d676112039778e3c", "object_relation": "sha1", "Tag": [ { "name": "6rr", "colour": "#118848", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654711385, "uuid": "0caef86b-1074-4e41-972f-3835396020a0", "comment": "Malware payload (BumbleBee)", "value": "91eb41eea77e7d5a4c5e3267d34481a8f9125603198e0f42d2c44d11e1e4bcb528a65b1c7505cb4d6f99047569ba4918", "object_relation": "sha3-384", "Tag": [ { "name": "6rr", "colour": "#118848", "exportable": true, "hide_tag": false }, { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654711385, "uuid": "84ffff3e-1d24-4eb0-a9fc-66308a8be327", "value": "T1F2451256B5FC00BAC6E395B18973C57BDB37B1216320791B16089354EF0B3A0D67AB27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654711385, "uuid": "739810fb-ac18-4f73-9014-6e46bc8613b7", "value": "6503543def26934e055460e7a46a6ee9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654711385, "uuid": "7ba8c140-762b-4479-a71b-65dd826043b7", "value": "24576:0JIda+OvL+CeZFt4MUGsfMfgxbRAm+Tm0837XbHPzuorOyzrBu:0S4+I+7zt4MUG2M4xb2m+ThuHkyPBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654711385, "uuid": "dce2846c-85a9-4225-b8a6-f8b187613655", "value": 1261568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654711385, "uuid": "76c80d87-0d19-42fa-ad89-701b5c3a9314", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654711385, "uuid": "bbed1bb3-e3d3-4fec-831c-6e44b23a803e", "value": "parelmo2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b247a36-e73a-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654699729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699729, "uuid": "6ae0f40d-471f-4459-8d57-f9f7b3e279c2", "comment": "Malware payload (AgentTesla)", "value": "a4214528430d7df50c2c3deec01d6555", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699729, "uuid": "1cc9b8eb-f406-435e-92f5-341fd0c69224", "comment": "Malware payload (AgentTesla)", "value": "f41c3ccb52743d20c3a3fe0a412f5f295df16d275b3ce807fcacfcea381f55de", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699729, "uuid": "150b191c-c3a0-4c86-bd4a-10f60e56e7c5", "comment": "Malware payload (AgentTesla)", "value": "d0b8f8517e516c848bebd32334c27bf120c04b1f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699729, "uuid": "8a5675b0-7fb5-42d1-ba41-4c1c0b1f41d8", "comment": "Malware payload (AgentTesla)", "value": "8aa8133f344ae51f8738c4bd7dd67b457eb9e7d133162a4de58274d0426b6a2fc1b9459e965be533c531d0910cc8efc7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699729, "uuid": "7884ee00-b412-4a49-a408-c461d479ba5d", "value": "T193F4E03177EA5214D9BB0BB10C7191C417BA7E6ABF04C62D6859174C9D33B138B22BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699729, "uuid": "05dff8c1-dcc7-44e9-b6ea-92c517c8c647", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699729, "uuid": "7d4b1533-34a3-46c7-bca7-dff6555c0ff5", "value": "12288:d3i0ATaRVRJxozSRQqJ7YvkLqGI8MoOVltyypdXmdhIeQOnbusy/ZSDdpbS:d33PJQ6A7MsrhXmbIevbusy/UHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654699729, "uuid": "54ba584e-4e27-4466-b400-00a9a47ff696", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654699729, "uuid": "420b7e16-2a9d-4289-9cef-456d1cf464b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699729, "uuid": "b73ceed5-974b-478a-a161-058e08bf8848", "value": "Requested Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fead2722-e732-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654696674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696674, "uuid": "5c63e196-f6f4-4a95-8e15-e89e348561d7", "comment": "Malware payload", "value": "3d6af8a95268bd434c56a286ce8532a4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696674, "uuid": "5579c157-dfb0-493c-ad4c-e0c4288cdd3d", "comment": "Malware payload", "value": "f526be3d916e43f094ecf1d12b8dbb3c1b2af08f0aadfc778069aaba85c04d6c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696674, "uuid": "8ce6a433-9378-4bd3-aaaf-6be4ba0f59ca", "comment": "Malware payload", "value": "41db10cb269239baebf8d29e1a18c700b6f657fa", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696674, "uuid": "e7aff678-7012-4aa0-8e03-b0ed4458e384", "comment": "Malware payload", "value": "7af92dc090bef135467a0df74164305b4eff2f6072e1f2c28d0d48c58ec4dc9341e904b8197e430303caee653bbed179", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654696674, "uuid": "4423eabe-44ce-4390-a866-33e081e532be", "value": "T13B530230C91BDBF6C6042D73D9F0062A239B6C66F1B7F0479B994692C25124369BE169", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654696674, "uuid": "24d94bf4-7aa3-459c-80c5-06029da6f94d", "value": "768:4kdeSCWckEEOvwSbbyyrEd3/zjYT5eiGNl+IJTq5vAu9nHpDZ24q3U7SZQywqWZm:4kQR4uyYT/EJTqNpycsRqTlPB4nbMgx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654696674, "uuid": "6f2d1c75-e03d-4e23-892d-fe8687b7c4bb", "value": 63716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654696674, "uuid": "c2ed45db-afbb-43cf-a6f1-5a6361b0f00b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654696674, "uuid": "cfbe06e8-03cc-4761-94f7-05f9b0e14903", "value": "gummy.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e23003ee-e6d7-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654657542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657542, "uuid": "a5d23848-4bec-490b-8a24-44865e366d6b", "comment": "Malware payload (Heodo)", "value": "848571433db3cd3098b6298aff329213", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657542, "uuid": "9ed54fdc-deec-4d9b-b935-254b7d9ace97", "comment": "Malware payload (Heodo)", "value": "f54a6733083c23bceb034d22eb576e2f3dd25af3694a35df9efbec9a61171df4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657542, "uuid": "45abec94-19b8-4ba5-bf52-85dd5140e946", "comment": "Malware payload (Heodo)", "value": "b7f39601361518f92e3be840370dea26ac5e693c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654657542, "uuid": "543befa9-33b3-422c-9ac5-00d19b0355bd", "comment": "Malware payload (Heodo)", "value": "eab79ffda178a0b5f3c9c3984b7eb84afe38eba032f700ed5c9e9be7b84f3e08e3e99ad89ef8c868dfce3f969aeeea09", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657542, "uuid": "43c45a5a-85c5-404a-9ddc-bae73d90f4ea", "value": "T1F604023EE5031A98C22ED8FC58EE6DF9D5F634006258063A1BA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657542, "uuid": "7ba788c0-7e1b-4b7a-8eb9-a03da8f0de7f", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657542, "uuid": "2d7f6b71-ccd9-441c-aae6-f64d09c32739", "value": "3072:VpjftEFs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VRii1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654657542, "uuid": "f37cbffb-9adb-4c00-b5ad-f6cd106f9989", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654657542, "uuid": "d4e67bc7-ceeb-42c8-9fb4-08c1b41ee38a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654657542, "uuid": "5a080f39-d76b-44d9-9f6f-b68ec97d827c", "value": "848571433db3cd3098b6298aff329213", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0204d5f7-e6d5-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654656307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656307, "uuid": "8dbfbca8-b6e8-4094-a404-26bc7000d5d2", "comment": "Malware payload (Heodo)", "value": "30c8f13a2f68b453e4925f399aac3b01", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656307, "uuid": "0e73bb81-e730-4dd1-96ea-b640a00ea600", "comment": "Malware payload (Heodo)", "value": "f5685a4a3c25bea67d1316297f65c093f9ec64837ecec4ac5e14f3f9b5b1395a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656307, "uuid": "7380d4ff-71fd-4c9d-ad63-e8110251282c", "comment": "Malware payload (Heodo)", "value": "0ce25378c0968006350ca1a06c55ac80023cfabe", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656307, "uuid": "70513011-a0cb-49e8-a8a4-f460ddaa081e", "comment": "Malware payload (Heodo)", "value": "47fd925d5737feee1bc5658b7a563c41c22426b14c3129168dd4f148babffca1d82fd970d32335638ef872ae15ea1bd1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656307, "uuid": "d40fce62-2ddc-4d99-98f7-8b1044387d9e", "value": "T1CF04023EE5031A98C22ED8FC58EE6DF9D5F634006268063A1BA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656307, "uuid": "142af574-a2a8-4919-b1dd-605146ecdada", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656307, "uuid": "328e4485-833f-4cb7-8457-99fd45be2f05", "value": "3072:VpjftLFs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VRli1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654656307, "uuid": "2e32a94e-1172-437d-8b88-fcc434f26de2", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654656307, "uuid": "2cf73243-4a5d-42f3-aa9d-7411bae020b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656307, "uuid": "21e58ca7-66d0-4b08-84c0-f4eef5d87404", "value": "F5685A4A3C25BEA67D1316297F65C093F9EC64837ECEC4AC5E14F3F9B5B1395A.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03dcbf24-e733-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654696683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696683, "uuid": "cec1dabd-d902-4c52-be7c-92d2b748c000", "comment": "Malware payload", "value": "ae67ac1bf5402777612835913a88435c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696683, "uuid": "cb01eda0-e739-414c-bead-7b0e32007cb7", "comment": "Malware payload", "value": "f62599940739f42b7d9865ee1a2e80683da235e53b78e7bf39c57748d3cab540", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696683, "uuid": "17d3c15b-80ea-4207-aa59-c9e211f82f08", "comment": "Malware payload", "value": "c8f1c05216c5cfb91529fc5e4335d9662e771319", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654696683, "uuid": "c591dc70-27a5-470c-825b-a4d8b3686bec", "comment": "Malware payload", "value": "6c364526405a82c580b3a06d55f07118aedeb74517584d0794d89fd10084da7a31c03a1f9e3ae620b2a13a56c21df64a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654696683, "uuid": "91a9d6ae-c3d1-4601-9bcc-f14d5fbc7b8c", "value": "T12213F13062162877E46988F521AD23329B760FF57483B49F7643C4298E816EF3563BA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654696683, "uuid": "df267530-7f83-4b4d-9471-7b9d74a305b7", "value": "768:eXZFz/9LXDVf7cRLGBWgM+2SOcGl+kgs5AJgGlzDpxYsnU0fujUhBWG:eXVTVzQYU+2Fcw+k35AVrYqEjUh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654696683, "uuid": "96068582-983c-4a04-a245-340104c0ff49", "value": 45188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654696683, "uuid": "0b139448-2263-4382-b1cc-e385754ee9a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654696683, "uuid": "c685ecc0-5fa6-4810-8220-ba671f5e6b6a", "value": "gummy.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d3c0393-e769-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654720080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654720080, "uuid": "e0b99584-24e8-48a6-b215-68e9a89c7aca", "comment": "Malware payload (Mirai)", "value": "78d982d60820cd669d225775ec94bbb1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654720080, "uuid": "a8cc1a2b-ce8b-46c7-a90c-cae26a9ef383", "comment": "Malware payload (Mirai)", "value": "f69d43070c28c3eb878ed97f6bd12437ecd283a961c665952483b20788f636b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654720080, "uuid": "f70870ee-0235-410a-a6fa-6cb49d34104c", "comment": "Malware payload (Mirai)", "value": "29a9aa3e7899e491193a6c7f294aa91b00ca8f5a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654720080, "uuid": "3b4aca22-f8b5-4550-81d5-9ea7472cbe4b", "comment": "Malware payload (Mirai)", "value": "e225520bd00ea7ffbe6af9214f9e8ed5fca2bcaf77cef0efaebb8c69d6d8a1f2ecb570cacc1b072aaf54f98c7db79e4d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654720080, "uuid": "74b6b992-e4e0-4f6c-93c0-f3c1378cf7ce", "value": "T1FB434CDBB401AD7DF99BE6BD80230D0DB93062205093072777A7FC93BD322A89956E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654720080, "uuid": "14b51de1-b026-44ca-bc0e-43467f28bd44", "value": "768:lKexZ0heQrB5z0UlJVWr2KpZQQtO4gFHTVjkuE2SQmSYCrq5s9C3Vm8Y/my:0qqUrEUuFhjtE2PYCrq29C3k8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654720080, "uuid": "52542d04-b53a-4402-9d74-ad5ac2b14175", "value": 55216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654720080, "uuid": "cf4a55e8-76d8-4b74-a4b9-69cb0c5a6800", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654720080, "uuid": "d106fc8f-4521-47c9-9448-5f681e892fa9", "value": "78d982d60820cd669d225775ec94bbb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5807dd4e-e741-11ec-93bb-42010a9c0043", "comment": "Malware payload (RedLineStealer)", "timestamp": 1654702837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702837, "uuid": "3b93f4a3-623c-4169-b199-279cc5a1c8cc", "comment": "Malware payload (RedLineStealer)", "value": "271a0c12776c723578e212a609f11cb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702837, "uuid": "24c250cf-f547-47c8-955b-d21410c1894c", "comment": "Malware payload (RedLineStealer)", "value": "f6b17c14e9d29f9c08cb8f90bcd471e2c6fd82fdbd39965862249091efb2d598", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702837, "uuid": "160e6c05-cf30-421b-863b-5b0af7df57f9", "comment": "Malware payload (RedLineStealer)", "value": "7bd0f91507edcee7a4d16116d167f4050fe0c94d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702837, "uuid": "93c57331-2f02-497b-bcde-aebac2b3fece", "comment": "Malware payload (RedLineStealer)", "value": "fadbd4745bfeb348bf3ecb3bf7225ca2bac7ffd68207d1405a3e31192a6cd2fd102a408611bb1ac1adb82c3e391257ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702837, "uuid": "f7b42eb1-fce5-446b-8403-a1f89f77cf70", "value": "T173447C10BB90D034F5B716F449B993A8B93E7AB15B2491CB62D41BEE5634BE4EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702837, "uuid": "04bbe52b-2f06-4e8a-bc82-4b66fd4b5e72", "value": "f3934bb0048d44387137e6b580143d69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702837, "uuid": "cd0296f0-7650-4650-a497-40fa5677f5bc", "value": "6144:Vpbzn37vP/9XID8hePv3Kx3gmH7AVVxUQ+S03S7h7:VpHTFXE8ePvKWcEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654702837, "uuid": "25f1d520-084b-477e-9bc8-614aabadf530", "value": 272896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654702837, "uuid": "afb1ff15-3fd5-4099-9761-b6db7475a490", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702837, "uuid": "c9dc8301-8bc6-4f58-ac9b-bb4e0a8ca08c", "value": "271a0c12776c723578e212a609f11cb1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc86ffcd-e709-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654678981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654678981, "uuid": "12f8dc2e-cbb6-4dfc-bebb-018149d50760", "comment": "Malware payload (AgentTesla)", "value": "dfdba8187e90c8ea7ee95b5b9f1082b2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654678981, "uuid": "c10a2a28-e893-46f7-abad-d83d60d25c6a", "comment": "Malware payload (AgentTesla)", "value": "f70a565da62f7c4d2544e1ce7c6e8f24e801d965fb860408dcea8b5f6146b031", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654678981, "uuid": "5f32e69e-35c3-4e19-a264-c77e1726f40d", "comment": "Malware payload (AgentTesla)", "value": "5711404c68b8b28ed42194de7cce39db6ebc479c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654678981, "uuid": "85959f78-1cfc-4b8f-b666-624c87befceb", "comment": "Malware payload (AgentTesla)", "value": "4a8cfb2f0b7964347b63e136f9dd95f39a4b4bf05b156026e3eeeb5aa97b4d2daddbf7999f14da9b140192d0b663e4ff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654678981, "uuid": "fd3d3879-d6c3-4f69-ba7c-ec2d04d2d9ac", "value": "T169A4CF042FAC781CFA9BCBF591A1810102B55C8FBD73F21B5A93098E695F7039661E7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654678981, "uuid": "f403f719-3914-4582-a2ae-99b246909ce5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654678981, "uuid": "e5d413b3-b45f-40d8-9956-106fb1977593", "value": "12288:TjnxG41P2KVoBcjiaFAdFwZAaqwRwJ1t0:v447J5bZzF2J1t0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654678981, "uuid": "7d2d48c8-67e3-45b3-b897-8539fe1684e2", "value": 451072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654678981, "uuid": "620a886b-f697-4ccd-91cb-5d9cc14c983e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654678981, "uuid": "3d111bb8-d93e-41af-a065-d543379a6b9f", "value": "dfdba8187e90c8ea7ee95b5b9f1082b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a1cfcad-e742-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654703297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703297, "uuid": "f411802e-b1e7-4e20-b977-de8fd94473ba", "comment": "Malware payload", "value": "601ccdad5d43290b18ce9c0728e52d38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703297, "uuid": "f303b36b-b0e6-48d7-89b3-04fa90377bed", "comment": "Malware payload", "value": "f78aa003a899db2d88065eefcad78377325e31bc2f7c4d6ce19e21773cd27d23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703297, "uuid": "60a3cfa6-7550-4f38-9e9c-837955f22831", "comment": "Malware payload", "value": "d6a142337788d09e98af6665ea44899b248e46fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654703297, "uuid": "41af1cb2-eba6-4802-96d1-5b5ea710acb5", "comment": "Malware payload", "value": "5e363a52ecc47aa35bf361ccc358e62abc18950094349acf2119f9879dbbfed01e3a57e9961c5ef293dea28dc07f490c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703297, "uuid": "f76807c8-f492-4e77-b6bd-704ecb256f98", "value": "T1782633E3B48C33ACD4538CB467E5916289B4B089A2E71CFA49C7C13E78E3B578A20D55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703297, "uuid": "804d3a03-8915-4a3c-9045-d23f5c776b5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703297, "uuid": "48090bff-1dc4-4771-9429-e0e62affaf88", "value": "98304:+XjW2zyivc/oHruK4uOQRKRvIgfxgGtaeOwvPDUG2WImwOsxJ:+XjWtivIoHStuOFlIogGc7wvAepwTxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654703297, "uuid": "6aace48c-c227-4d2c-9e1f-b2315673b13e", "value": 4773888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654703297, "uuid": "de004508-35a0-4b30-90c2-450e03ae97f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654703297, "uuid": "f3400c09-e36b-40f9-a9e0-83be76e22465", "value": "r.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "607b92a6-e747-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654705428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654705428, "uuid": "90c5d8d6-2ed4-4e1f-b640-1cea73f2ca13", "comment": "Malware payload (AgentTesla)", "value": "a92db53ef147f94baf28d2c4d4411016", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654705428, "uuid": "deed7718-3ba6-4e17-8998-7fdd55bef4c7", "comment": "Malware payload (AgentTesla)", "value": "f82267f4c4c2d06ceca55586d9b4217c8462f43ed5bda4428e0b63d5ab0fafad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654705428, "uuid": "4f0c1a7f-49a1-40e3-bc19-3032701e0b4a", "comment": "Malware payload (AgentTesla)", "value": "069a0aa55c0d403e99e177fd0e085af32b679395", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654705428, "uuid": "46560656-3521-49e5-b2ca-ef338d00d659", "comment": "Malware payload (AgentTesla)", "value": "84f17be82a795589727049099f39210ec4067ee5145c5c9df67541a7aeeb4e0819e4c41ba4d60a64cfb39ae1cb4fe153", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654705428, "uuid": "4b8c8d87-6b40-45c7-b43d-6cd2c8f0b3dd", "value": "T19AD3F119724CF5CFE1C2187E65FEBB15B4ACACD72A526236E497327676F00A06F61230", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654705428, "uuid": "cc390eb4-be2d-4268-a3bf-1e72ded5b3e9", "value": "3072:1CePDN5p5pgMTaW0qaCAtJU8zH+byP3KXalc:QebN5pjJHCz/xlc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654705428, "uuid": "8f9ea6cc-fd49-4e2d-9168-c792a99fe72c", "value": 136184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654705428, "uuid": "16206300-8dcd-4737-a581-c0fc03218fa6", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654705428, "uuid": "19c1feb8-57e2-4a64-bbda-3f6b78ea76a6", "value": "Original Shipping Documents.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "353beffe-e6ca-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654651669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654651669, "uuid": "71d9c0dd-6731-48db-b86a-a3c7c5270235", "comment": "Malware payload (Heodo)", "value": "89a29d4adf4f544f6142524e821ec74f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654651669, "uuid": "0040ba54-0991-4ffd-87a5-4bd443a982d0", "comment": "Malware payload (Heodo)", "value": "f833f628dc19620dd8d7c69ad1044c969f127c0404f45eaf464fdf6cdc91842b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654651669, "uuid": "91f411e5-4c6e-4f1e-ba56-6110d6989d52", "comment": "Malware payload (Heodo)", "value": "98e72e79512cd6ed48afd153dbc7ba6900931869", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654651669, "uuid": "fc061841-f81d-491a-9e20-120c83653e1d", "comment": "Malware payload (Heodo)", "value": "4921dcd23e56aa0dcd8fc3ce906f20b10a81a49def957274e09849717fb3d61010d48639692c454a738022c91992966d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654651669, "uuid": "e5248df9-317d-4758-a754-247f329eff85", "value": "T15804023EE5031A98C22ED8FC58EE6DF9D5F634006268063A1BA77E7C1D71661C11BC6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654651669, "uuid": "becf97c9-2286-4c13-94e5-14262c652167", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654651669, "uuid": "197db40c-fb9a-43ef-814e-db24c637a624", "value": "3072:Vpjft0Fs/tjHj5JsmWyeqzExHlsdPYbeIuUkNftScov+nMNfWsO:VR2i1/wm//KgWeIkGwCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654651669, "uuid": "cecdfb96-5a8b-48fc-b2fc-df4b80260331", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654651669, "uuid": "ef5ae2f9-004b-4373-8b56-d71171992136", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654651669, "uuid": "c0512e77-9472-44eb-a8a6-cd5836c5f8dc", "value": "89a29d4adf4f544f6142524e821ec74f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9295d50a-e76c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654721404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654721404, "uuid": "2b5143f3-e922-4309-b764-c1473cba617d", "comment": "Malware payload (Mirai)", "value": "8d1fc636ba44a91b4037d2a7934de8c8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654721404, "uuid": "02b780b2-b0b2-45af-a871-3ac2df4b2cdd", "comment": "Malware payload (Mirai)", "value": "f964b11f7aca6e4f1377693b6cf1717ddfdee18e1de781eede258c59ce7de962", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654721404, "uuid": "dcf699c4-9b13-4e64-87e8-8fa51774d6e2", "comment": "Malware payload (Mirai)", "value": "a98b64aafcd074f79f83a8addfcae286d60a5146", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654721404, "uuid": "7d44d40d-8ea7-4489-af2f-e608965ac7b4", "comment": "Malware payload (Mirai)", "value": "ed1e99ee47a8ef5495bb49c55ce0ac91f36d3ebacf3ad55fb943b79242d2a3963b8a9b44845f95b3b4e507edf6ab1b3b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654721404, "uuid": "874ad014-0408-4afd-86d1-1f13062725db", "value": "T1E2D34B86EA408E13C0D51B76FAEF41493322D755E3DB73068D189FB43F86A9E4E23645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654721404, "uuid": "62c789be-4231-44a1-b0c0-3eac21bffe19", "value": "3072:wybUEGniGQYtOR7aCgk9mrsplDKZUmQBKXAVanJX+F8Jyve4hL5AJI4+3jJNx13/:jbUEGniGQYtOR7aPk9mrsplDKZUmQBK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654721404, "uuid": "c305ddbe-cc5c-44d9-9e34-c072e8c5e23d", "value": 142435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654721404, "uuid": "316b8cb4-4237-4750-b249-cb9e08ca9a5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654721404, "uuid": "bdce9fb5-7245-4b21-b341-ed7c5e9d378e", "value": "lessie.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d5de5e9-e73f-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654702068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702068, "uuid": "a45271aa-93e3-4c89-add4-4d7714db5d02", "comment": "Malware payload (Heodo)", "value": "52f8c985a14d703525e13af80a31facc", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702068, "uuid": "772df32c-ed36-4299-99cc-4a4ac9a919cf", "comment": "Malware payload (Heodo)", "value": "fad4e60c994dae5c90584c88b6085f6471015a8ee65558686bd3f235e10a067b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702068, "uuid": "a09a2c71-00dc-40be-94bb-40865a0693da", "comment": "Malware payload (Heodo)", "value": "edd91f93693da2bcfa24a3850c6ab99bb9f6a211", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654702068, "uuid": "44a0cfae-bf82-4dd8-b42c-7524063cdb51", "comment": "Malware payload (Heodo)", "value": "e6a163964cb89d68a120b99d20a2e177998362ba445b41f9debfd77798161dfc6a28e306a23932f4c7375820e129d675", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702068, "uuid": "ded921c1-f5e1-493e-9246-2025f3a20ed2", "value": "T1D271E0142EFA1128F9F3DF76BCE972559EB6F667A4025E8F008143014C12A14ED92B3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702068, "uuid": "b20c0560-1d15-48f1-af4b-0431ff7c465f", "value": "48:8k+hE9ssSuIm6GtynQbwsqvZUVQi5awr4trEz9OvWd78aSUIKAIHaby:8k+h8sPm6obwsqBUVQQaQz9D77NA0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654702068, "uuid": "bfc47267-d256-41bf-babc-5e9226977623", "value": 3801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654702068, "uuid": "7933ff80-9577-41c1-8a67-e39f4ca5abac", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654702068, "uuid": "e1ca0248-801e-4f35-97aa-1b1e00afa618", "value": "gescanntes-Dokument.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd24e244-e74b-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654707356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654707356, "uuid": "9916660d-8ca5-440a-a04a-717df2054afa", "comment": "Malware payload", "value": "8951d58845bb1e1541624941a7637585", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654707356, "uuid": "d024d62a-ed4d-4e21-bb2c-d035658ced9d", "comment": "Malware payload", "value": "fae27214f69c6827a706a1d7d357bcf4d9be871a3a5e70d0dc8d93032c7140aa", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654707356, "uuid": "9ac77639-e1ee-4ce3-9932-0461760f517f", "comment": "Malware payload", "value": "8150f03be67e745f4cb79f981f104aecaabebd9e", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654707356, "uuid": "463b911e-5ff6-4990-aabf-a639b909cfe4", "comment": "Malware payload", "value": "ae2b527c96de709c6fe0990bcdf0d31bdae271aa957cab4aecfc79eb4f6008749ad4e2ceff0884a4396c0c1205f46dd9", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654707356, "uuid": "7c812477-ab2e-402a-87f9-eece9e5fc6d5", "value": "T1C8A4233753B88940C30698F5077C06838B6906E4D6A8CE62E151DD75BBD85CD7EE8B3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654707356, "uuid": "2b26eb4c-32e6-4bbc-a367-9ec58ec5ea10", "value": "12288:rCcPl9OnQ8Ju1JAMLi5QKI5IFhGVqb3x1Pg/Br7Xx/:lPluQd285nVutWvh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654707356, "uuid": "86445d2a-53c5-4e8e-a999-ff31b4c4c894", "value": 487845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654707356, "uuid": "2b5100ca-b4b2-4946-b053-e9d03c84e37a", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654707356, "uuid": "3c657dc0-74e6-4941-b4b0-5edcc758724a", "value": "INVOICE_SKM_C450i22051816020 (2).pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "563e4cb3-e6fd-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654673628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673628, "uuid": "fd88eeab-688c-4365-86e2-c63cf7c2b770", "comment": "Malware payload (AgentTesla)", "value": "796a2ace3cec3e459aadccb33b26187a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673628, "uuid": "95f13092-48c4-44a1-b7e7-bfcef4026ea5", "comment": "Malware payload (AgentTesla)", "value": "fb13f5302756081d7dc2545468beddd187e44de679d3a776c62298bc18cf28c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673628, "uuid": "15322efd-7659-4bbb-95b2-5fa1a9ef82e4", "comment": "Malware payload (AgentTesla)", "value": "1d8583272f1384afe9fbfde7d7c304c84b9f028b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673628, "uuid": "75eee419-6cdd-4a83-b8a5-d8539df309c3", "comment": "Malware payload (AgentTesla)", "value": "fe3aa62ca9adb9ae3deb65fa4914da9eb12d46a13be30cb8d2c8a97bafd82a4fe2eaba4bf245f58eb1113c7d23c7d28d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673628, "uuid": "0c8cad9a-b0f4-4b18-81df-e166469d832a", "value": "T14CE4126076EC0FD1CA3E4BFA9CA9044003B5BE2A5027EB1D6E4971DE0F76781867361B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673628, "uuid": "9e2a6412-d95c-414a-98ec-95b23fbb31db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673628, "uuid": "aa5e6d11-b3fe-4e49-824e-202b5376e6ed", "value": "12288:7MxOV/GxyPItvwYt7uHc181qAMojhNA93w7f/hh+3sjuEMLcDykYMW13e/bo9q:9jGvwNHc18csjfugJhitTLcDJQ3ebo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654673628, "uuid": "e959bee0-e926-42f1-a562-40d3ada3a26b", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654673628, "uuid": "ff3f7717-e4c2-41b0-b995-db2b9f373a51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673628, "uuid": "e0c6502f-c483-492f-b7df-8159c589dbe5", "value": "SecuriteInfo.com.W32.AIDetectNet.01.2098.13132", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e32a8ce-e6ec-11ec-93bb-42010a9c0043", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1654666367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654666367, "uuid": "f14b701a-aa31-4634-b81a-36ee29bda448", "comment": "Malware payload (SnakeKeylogger)", "value": "55756599222b39d9ca9783811a638964", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654666367, "uuid": "56f1edee-2321-4911-8052-a33554e885b2", "comment": "Malware payload (SnakeKeylogger)", "value": "fb1d8087e8cbbaf2f4b0236806a6b8503134b0b7b5557aafb6e27e8b1e9dd092", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654666367, "uuid": "9b857ae4-04bf-4ab6-bd78-f0762d4721b2", "comment": "Malware payload (SnakeKeylogger)", "value": "b41343392669d8988b185bfe0183c698b0e52a01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654666367, "uuid": "a2debf35-db20-40a2-9a00-b1cff1809d8a", "comment": "Malware payload (SnakeKeylogger)", "value": "4ba76f1ccdc8c7fae3b69425c66c84edb1c4ead1c53eec8c175bdafdb2b6799cfcb35e34d1a5787133403438567453a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654666367, "uuid": "b1c75ffd-fb41-4d96-8efa-cd4840e08080", "value": "T1AF65BE11B350E74BC229B33B5965F739126A0BD7BA13E7A0A574B6E338533808F617D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654666367, "uuid": "6ba46e95-9644-47d8-8667-11faf1fd4bff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654666367, "uuid": "6e9685bf-2321-4d41-b3b1-62e58a3f247b", "value": "24576:nxn0hYPE/wZ5fq+z5fq+sOT75fq+W5fq+tJX5fq+z0sz5fq+Q5fq+:x0es/srOEIZJVXG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654666367, "uuid": "8c839447-2f46-486f-8efb-775b768d141c", "value": 1523712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654666367, "uuid": "46603c95-61cc-47f0-ac88-91a371bf1163", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654666367, "uuid": "f9d17314-36e4-41da-adf9-5cf2d846d1bd", "value": "SecuriteInfo.com.Variant.Tedy.135937.21747.5991", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69011fbf-e768-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654719616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719616, "uuid": "fb727748-37d1-47bf-a408-9675ef969c86", "comment": "Malware payload (Mirai)", "value": "e345cac334b1fb9c31cc3821a3327914", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719616, "uuid": "fa860d31-fece-41c9-afcf-93c691029ada", "comment": "Malware payload (Mirai)", "value": "fb629978753fe5ca5f2661970eb55949bf159c7900264210d9915e1d1b5974ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719616, "uuid": "59d76c96-f6ea-4788-a059-31ac44ff4bdb", "comment": "Malware payload (Mirai)", "value": "26d7c2c24814f0aff2918229e17dc7802612572a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654719616, "uuid": "73d2ec86-7c8b-4bae-beb8-dcc56b9d5625", "comment": "Malware payload (Mirai)", "value": "78479834fef6b4bc5ee03202cc5c1bd9a1aacdd1f706bbfd276960c1dded7377673a40e59d061ca34ea944089ba53a32", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654719616, "uuid": "5ccdb29a-9f39-4ae3-835a-e63a161cff41", "value": "T1A6C2D19EA3559596C61D0EB5F3DE03C4CE69A081B3872F2CD7254D887E3EA0B3EE5025", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654719616, "uuid": "9b202016-d028-4610-9d73-2dc9be491e76", "value": "384:ZsGn5I6vQnheNcpQCKzsZ/XsLo1o4Caz9nxN8TPZ1IXCRWGVCz0NvJf:Fn5cheN5v0QoN1zqZzWc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654719616, "uuid": "4eefbdce-331f-4b6f-b2cd-d7385ae7deec", "value": 26288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654719616, "uuid": "5ae8b47c-b8be-42ad-b654-8235be17fde5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654719616, "uuid": "1b066d52-a8b3-4859-be63-eab154503928", "value": "e345cac334b1fb9c31cc3821a3327914", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b9b266-e71a-11ec-93bb-42010a9c0043", "comment": "Malware payload (SilentBuilder)", "timestamp": 1654686170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654686170, "uuid": "40c46d9c-2db7-42ee-846e-6ee135686f37", "comment": "Malware payload (SilentBuilder)", "value": "2f85bf493217c29023600ac7db9de575", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654686170, "uuid": "fab652df-9603-4ca4-87da-efb6bf44de73", "comment": "Malware payload (SilentBuilder)", "value": "fb94e0bd93b98047396983324c296ff55798d35cfc7ba22232d50f7166113bb5", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654686170, "uuid": "2ae6f67c-e532-43c1-8760-1813d3d3b8c6", "comment": "Malware payload (SilentBuilder)", "value": "db91219bcbf8fb76fe5ddf0059f6ed4f4010a8c2", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654686170, "uuid": "25fc8452-0535-43ef-9f3c-6b3c98c115bb", "comment": "Malware payload (SilentBuilder)", "value": "8eecef41f986bd9530bc42da8fd46ac21cdd1b276c8c9ceb1bc9c813881bc3a2d09b7efe486f5ebd8167d8b6768a2cec", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654686170, "uuid": "5871c2d2-d55b-45ef-af1d-d29144f74feb", "value": "T15C634B59B769884EE9198B3448F747D62323FD308F6F0A433259F3926FB95A05703A0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654686170, "uuid": "80452271-f0a5-4f53-868d-143010ba9292", "value": "1536:DhKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+J+hDcnTLiQrRTZws8En:FKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654686170, "uuid": "64a420ee-c376-4c3d-a425-c03c4ca083ee", "value": 72704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654686170, "uuid": "d18e3ac2-647b-4832-9815-f1c242836446", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654686170, "uuid": "2fd2c9d6-ecc5-4b7c-80d7-7715b63a2047", "value": "2022-06-08_1228.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38b7e533-e70c-11ec-93bb-42010a9c0043", "comment": "Malware payload (Socelars)", "timestamp": 1654680021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680021, "uuid": "bdfd3cbd-aa96-401b-809b-4d695a762d83", "comment": "Malware payload (Socelars)", "value": "3c2a725783431275ea9635e8ceea1f95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680021, "uuid": "e6c23a3f-811a-4a59-bf39-379c2aad27a9", "comment": "Malware payload (Socelars)", "value": "fbc1a6bc90640ee96eaa3f49481f3414feaaa26934cd9b17494555fc1833af84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680021, "uuid": "279d02f1-7fc6-41b7-9438-6d80dc0903ed", "comment": "Malware payload (Socelars)", "value": "996b09bd36726698eda91b72956b1d4227a24739", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654680021, "uuid": "3ffac61f-d7d6-458e-8ed6-2cf3e255b347", "comment": "Malware payload (Socelars)", "value": "5bd3fbdffbbac6798bf06a801094017430f1d5c5916d27469df1cddf58c82aaa90c787450d9513c1c367c2dfcf9945d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680021, "uuid": "06f88d55-c6e5-423c-a8e5-03a88c0f013a", "value": "T15F659F25F642A136ECE3017282FF4AFE8D2C7A21070854D7D3C46D6A5A719E23B3765B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680021, "uuid": "f48983ca-b493-46ca-9e23-a7939dcfb287", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680021, "uuid": "44121a04-e52d-47c8-913b-87682b69e0ae", "value": "24576:fGpRLIyfjIOFnT5LP27ObjNbLbYtS8H1TPPeb13iV7+9:upuipUmVMVTPPeb1iFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654680021, "uuid": "2422274b-fa9f-42cb-ba82-44c020cc5090", "value": 1524224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654680021, "uuid": "a2171f5b-72b4-4655-bf84-4a4f81b9aec1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654680021, "uuid": "65af32e8-8c5c-462c-a8e2-efeac2b39a81", "value": "3c2a725783431275ea9635e8ceea1f95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0b06adb-e75c-11ec-93bb-42010a9c0043", "comment": "Malware payload (njrat)", "timestamp": 1654714609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714609, "uuid": "3e29df49-a858-401a-b998-0968c30ef95f", "comment": "Malware payload (njrat)", "value": "3919486a205c68cc82bc5c18f135c644", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714609, "uuid": "48f954e9-b5c9-48f3-bd67-523cfaf89dae", "comment": "Malware payload (njrat)", "value": "fdacd07d5b4337250f82a03192b0be1af1db598307bc1e84547d8865b6eca446", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714609, "uuid": "357cada3-c127-4600-952c-8953db2c63e5", "comment": "Malware payload (njrat)", "value": "c4bd120329667fa1a4cc3b9a07a10ac05418cbc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654714609, "uuid": "a6929248-1553-47d3-874c-f93545fe7a05", "comment": "Malware payload (njrat)", "value": "4ee8c5c2271dc1fafbf2690deabb524bc4c6b1a2761fc88e3a6c66f4696d12c0b870f3813b47d688d44013d10f3b37e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654714609, "uuid": "a4d81851-01d9-4ec5-bdac-83ab48b1b467", "value": "T145E2285B77A94225C5BD16F848B703209372E3878932EB9B4CDC58CA5FA33E44152EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654714609, "uuid": "826708c2-b2a4-4ba6-8b94-9355031ad56a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654714609, "uuid": "558b0d16-b4b3-4f12-a29d-ddb7c9b3e2a4", "value": "384:ml3kcQnkUoSsJGG5JfRviAwt4U3Qu0/7FTgPtTFAqzmmsSiU:mWcQneSwP5p5E4U3Cevsg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654714609, "uuid": "af4941f1-a2a9-43c9-b2e0-da4bb596c199", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654714609, "uuid": "b8aa68c0-5e44-4ede-aaa9-2feb8c320243", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654714609, "uuid": "291693da-1f4d-4d09-8b0c-1ef1cdd1cc6a", "value": "FDACD07D5B4337250F82A03192B0BE1AF1DB598307BC1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "545e6ed5-e6fd-11ec-93bb-42010a9c0043", "comment": "Malware payload (GuLoader)", "timestamp": 1654673625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673625, "uuid": "9106b00e-8b08-42e1-8fb6-449ed4a77390", "comment": "Malware payload (GuLoader)", "value": "e48b8aac46521b3826ac016a173aa257", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673625, "uuid": "bcc77499-6058-4d4f-b7ab-d897332ea845", "comment": "Malware payload (GuLoader)", "value": "fe8a753bd345edd341de5e5cf629dfac621d903a07f2f373c277d78535ec6605", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673625, "uuid": "c6b84003-319f-4234-8037-c9584d8d9d5c", "comment": "Malware payload (GuLoader)", "value": "9e01ad037d24e33a60d6f4166eebd92c56c46e6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654673625, "uuid": "09a41b63-cc36-465b-9be5-ecfbb6557129", "comment": "Malware payload (GuLoader)", "value": "8fa05b5195175d103bf2afe0117d2fa9008969328964b7e33795f61db8360cb4293cb0b88d013aeae6e0175ef96da890", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673625, "uuid": "4eb9d956-833f-4a79-a30e-c42bbd7dc594", "value": "T17444E120AB94CA37D8C318B47A76E45DE4F4FD1168658963B3253B2EF238752DA0D363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673625, "uuid": "c2f5af61-946d-41d7-b1fe-2a31f98b925a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673625, "uuid": "72ce6b22-93cc-4088-af91-88049500ec57", "value": "3072:kfY/TU9fE9PEtu/EA6uNZUkjATLEbzWlr+NqOgMxjhg1as97DxKOnhIfGJIV9mEY:yYa6lE5sZUknzWMNFjhn4ozf1V9KqdQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654673625, "uuid": "eb2ab677-59e0-483c-8b33-d1bf44f42d40", "value": 273521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654673625, "uuid": "32d1ba9a-63b2-4742-8085-a28602eb2225", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654673625, "uuid": "366252e3-f3a9-49d2-8b9d-8b9cc670a08b", "value": "SecuriteInfo.com.Trojan.NSIS.Agent.14071.13982", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "080cc4e2-e6d5-11ec-93bb-42010a9c0043", "comment": "Malware payload (Heodo)", "timestamp": 1654656317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656317, "uuid": "809fde9d-b955-49ba-abf7-d43c56c52a5f", "comment": "Malware payload (Heodo)", "value": "0bc08936925b595adc2e0537eb2f8cef", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656317, "uuid": "b8a7d0e3-8ad5-48ca-a9e8-657bd9207eb7", "comment": "Malware payload (Heodo)", "value": "feb7d957ec97cd12f8f6bbf92b41cda507ebb0a882fa698d7f2e4160cb2e304c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656317, "uuid": "3a799185-3e47-4b7d-90ea-67ced6b02b8d", "comment": "Malware payload (Heodo)", "value": "a09acf4ea8f1993e3f232f1c1d0ba11791c8d5d5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654656317, "uuid": "92339de2-1941-48a8-b076-ca7dbb7c758d", "comment": "Malware payload (Heodo)", "value": "a470e58f5fc796277664311a4a1f57d8a9b156fc995a77eb30430e8583c41b5f6f1984d07f65ca67cd7b25b2733cb356", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656317, "uuid": "93cdc847-4399-4a70-880c-ea8c1c20556a", "value": "T19304026DD14C06DDD611137CACE90F3392FCF980A0262B5BBB70A6774BA4B96DB5B900", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656317, "uuid": "40ab4abc-823a-43e9-8a02-fb90d9d84376", "value": "70e266113c1f28d1a5ed37642718e2f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656317, "uuid": "c82ec0e1-bb14-4035-a96b-b6caf9957c7c", "value": "3072:rpjfOFcO4J8FYMh1PAzu8GmeR8dk5pL/rRn/02QBgjVcoe5Uy5i6zNL4ZNgzPKcQ:rRmWW6u8QKkXzN/09gjV/eey5/NsAziz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654656317, "uuid": "7ebaa0d8-f719-46a3-a0bc-1f9647381750", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654656317, "uuid": "ae406184-74b6-4b6d-aefa-87e06fe199cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654656317, "uuid": "66a80b4e-47c9-4453-894a-a5eceb5ce6e7", "value": "FEB7D957EC97CD12F8F6BBF92B41CDA507EBB0A882FA698D7F2E4160CB2E304C.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bfc3488-e729-11ec-93bb-42010a9c0043", "comment": "Malware payload (AgentTesla)", "timestamp": 1654692563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692563, "uuid": "b142dbcc-b50e-47c2-b3f1-79b4f396f3b7", "comment": "Malware payload (AgentTesla)", "value": "e03eab640a9d36b532e0bba0b54e228d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692563, "uuid": "0836ba7e-a768-4b4f-b2cd-c92352416afe", "comment": "Malware payload (AgentTesla)", "value": "ff27368e4af5109ffce1cedd527fd833940aa61dd68d060dd95e9a984e26ebd2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692563, "uuid": "dd263dc3-4964-4512-9ae0-cfa11db32e6b", "comment": "Malware payload (AgentTesla)", "value": "a9e19e5dfbe66aab8d14f86f0f0a82a66dcf6bf7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654692563, "uuid": "01e88020-99f0-43cc-909b-ac5a2ca04692", "comment": "Malware payload (AgentTesla)", "value": "6736bf6a3975862cc683fa60f37c2f29f3a0c26fc4716328d3c8ec31b8bd472cac3a3a7307d26ebac551556f6affeea7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692563, "uuid": "8f8a51f5-9aa6-4716-9fc1-9650565cb6bf", "value": "T112E4122476ED1723D67E4BFE98A5090087F1A626591BF30E2E8471EB2D67FC18522723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692563, "uuid": "6e37de68-5506-4931-9718-99299051c30f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692563, "uuid": "13504935-8b63-4dc6-bdf5-cd189bfc3044", "value": "12288:g+m04QJcPMdMW1Au5JTRgkeJSXCh0w+gH6zXnsFGtPljzfBbo9q:+ecUd1RfHu9HWnNdTBbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654692563, "uuid": "c11ed510-7fcd-4439-83d7-406e66bb5b07", "value": 692736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654692563, "uuid": "c478485d-a84b-46ad-835b-48c866421766", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654692563, "uuid": "4233e70a-ee8c-4fca-9a5b-dfe071696d8a", "value": "SecuriteInfo.com.W32.AIDetectNet.01.25422.23984", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3db0d6f-e733-11ec-93bb-42010a9c0043", "comment": "Malware payload (Formbook)", "timestamp": 1654697032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654697032, "uuid": "ac02fc63-05cd-44b7-af6a-ea4159bbb47e", "comment": "Malware payload (Formbook)", "value": "c2a8cc6623d2302cdb1537cab34923f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654697032, "uuid": "38b7321e-b3d6-4672-ad46-e29dca94e142", "comment": "Malware payload (Formbook)", "value": "ff77c6e9dc25a550d8f37600c25b0ad1069e94196cbd2372968b3ad11f47268f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654697032, "uuid": "89a769d8-572c-4d53-8ebb-bee25f14ca19", "comment": "Malware payload (Formbook)", "value": "cf26dcb4f037e4802fea71f45efc464398fa0e71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654697032, "uuid": "b3fc3be1-cb59-4d12-bd96-644fd48e57b9", "comment": "Malware payload (Formbook)", "value": "14b18acaa1822dc87b4419e5884370da40ad367270117cb8a90179cfd263d240056c5c26ce42c19b850b3bd7ce1e3d5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654697032, "uuid": "874f7223-edca-4103-88e1-971f79e26df8", "value": "T16705CF85B36AAF36F13857F27451C05917B82E2E8AE0D22A5CDA70CE21B1B4305F5F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1654697032, "uuid": "0b032e58-d8a6-4fcc-93f8-becf0b4af368", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654697032, "uuid": "2cd5b928-d859-4a91-9d24-e22fae2c4eba", "value": "12288:Pg442iNqDdpbS72AEXJhFeLsSjTufX+wfE3a5OK9yv3L1pCIhUuf:Y441QHbcZE7FeAWT6fya5nyv3vphl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654697032, "uuid": "ee9b7159-27a5-49b4-8ac7-e76732452c05", "value": 797184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654697032, "uuid": "90a95acf-c057-4918-89bc-f9d0ebe35468", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654697032, "uuid": "6ea1fae4-61b0-436e-a2cc-4ab49dbd930f", "value": "Request for Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b9fb4a-e6f3-11ec-93bb-42010a9c0043", "comment": "Malware payload", "timestamp": 1654669363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654669363, "uuid": "9e2dd593-12ef-4d06-95ea-c8cef6a8ad96", "comment": "Malware payload", "value": "8e6b59d8e6f3e95d66b495d2df945832", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654669363, "uuid": "3fa0a8e5-6790-43d3-a7a9-440f7560fdc1", "comment": "Malware payload", "value": "ffa22c40ac69750b229654c54919a480b33bc41f68c128f5e3b5967d442728fb", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654669363, "uuid": "c6de010b-e5e4-47c9-8024-4484d931ef18", "comment": "Malware payload", "value": "9c5dbfa7f70cf5151ee706598f5434b1e13d64a4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654669363, "uuid": "89ae53f2-05b7-4aad-be65-967bed280b17", "comment": "Malware payload", "value": "43af2aba43cc4e294fdf8185110dd2aef777b664c47ac335ed22d1fb2aa22585a980d866124893ba9419e4ff3bd3981b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654669363, "uuid": "13b18a27-0ef7-498a-80aa-10d130b923f2", "value": "T143828E24DA0B44AEC5BDD378F4DA0FAAEE05706B96726D0F7D6480C88C512E5460FCA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654669363, "uuid": "4dc78ff3-9155-449d-b121-40a6f601ef94", "value": "384:7NrSuEYGbaDCjyRpAd4trsVMlzTmb+w6+HHHHHaKZyBG+0ulF6MXih:VFTGbaccpAdErsVazqw+HHHHHtyo0P6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654669363, "uuid": "9d6cfd12-a209-458b-b8bd-26f8cdba4137", "value": 17594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654669363, "uuid": "95d0edcf-b32d-4178-bcd6-747b590164f1", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654669363, "uuid": "ee9700e3-a98c-4f2b-b493-96af9230a503", "value": "D09FD0B0D0BCD18FD182D0BAD0B0.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac1badd-e763-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654717498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717498, "uuid": "4b0d0ebd-f1d8-4716-bb5d-5e1d517880bd", "comment": "Malware payload (Mirai)", "value": "97aa0aa550268b906e89a67735141e2e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717498, "uuid": "df0b4006-afb7-43d5-8d4a-58df70dbfc39", "comment": "Malware payload (Mirai)", "value": "ffa5a1a31058410390caa3f0b648b2ceba400e5665a6a4dda594107783ddb56b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717498, "uuid": "5286d4be-e229-439e-a6f9-15dabe9eca23", "comment": "Malware payload (Mirai)", "value": "3cfa8ea0d2e24a6f615abfa0d28fb5c5b0c1c3a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654717498, "uuid": "98d5b47f-fd17-4e5d-90ae-9edcc0e8fa47", "comment": "Malware payload (Mirai)", "value": "1cac82fa0651e0a74c6a3934a47a5db7e59fae2f59760004b6414e89ef6f8034228fae521558bffed987647c1ff1da74", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717498, "uuid": "d6ff3463-b32a-4fb5-a288-4bdd925b82fb", "value": "T1D2D2C063C0960B98C79A0832E82F3D0C6978BB09D5BD06B4AFEDF1058D61F255BDCB61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717498, "uuid": "01311b42-9e8a-4bb0-a555-bb034e933209", "value": "768:iYicrAqMzfOwAHnMZvPFInoL1FKQTCEnoznbcuyD7Uryq4:1zAVfgHMZvPWovnTeznouy8mq4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654717498, "uuid": "2f54325e-e8f9-479e-aff0-e0dd2d6f5a3d", "value": 29508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654717498, "uuid": "397aa543-2938-4669-acc8-a33ceabc08c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654717498, "uuid": "5f31f2b3-cc6d-4362-b62a-b088363e6827", "value": "97aa0aa550268b906e89a67735141e2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48358738-e73a-11ec-93bb-42010a9c0043", "comment": "Malware payload (Mirai)", "timestamp": 1654699804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699804, "uuid": "6ba71f61-2bcb-4817-be73-ab86ce5dc986", "comment": "Malware payload (Mirai)", "value": "2e50a39bde41a33708331384441e9224", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699804, "uuid": "8d1b189f-fd52-494f-93bb-3e16d5dbffcd", "comment": "Malware payload (Mirai)", "value": "ffd3bcd68f44ba8ec49183d83ead3a634e9ed9f4dbfd80747bd301b0cb84c159", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699804, "uuid": "317ccafe-c8bc-4f94-a70f-8f6ed658883f", "comment": "Malware payload (Mirai)", "value": "9b1db5c03dbf178ab43e35d2076ef78c5fc00b93", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1654699804, "uuid": "46a71ae9-8437-4767-8219-19c194490713", "comment": "Malware payload (Mirai)", "value": "4c8611b463e1527d17240d05a9cf84932f3d4d85466ec75af926e76a3cf076777954efe1027a87357328e556f6d958c5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699804, "uuid": "e066efc4-9d1b-4d60-be49-d70bdc95fbaa", "value": "T176B2E1FEB6984EBDF400E63BAE6447D74196E060826D539CA7D0B89B075314D2232EC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699804, "uuid": "030cc474-d7b3-4bd8-87df-209b41250ea0", "value": "384:MLcnZ4Dj8/hG1I4QVxAs+Zw68Z6h1nQRQ7voMAhmFJ/yeQAxOC/EUp173yp:d4j8/hGavVKR8ZQFVFIJAxOC/p12p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1654699804, "uuid": "e2483c3f-b2c3-4e55-afc3-77bd531cd3c1", "value": 23616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1654699804, "uuid": "cd57543f-aef0-4198-98f5-c6836a5eec36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1654699804, "uuid": "24a52408-3af0-44c7-af27-486ef66f23c3", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }